How to Configure MCP Servers for AI Client Integration: A Complete Guide to reverse-skill

Connect your LLM-driven AI client to local security tools using the Model Context Protocol by configuring a JSON bridge that translates stdio messages into HTTP API calls.

The reverse-skill repository by zhaoxuya520 implements a complete Model Context Protocol (MCP) ecosystem that exposes penetration testing tools as native AI functions. MCP servers act as JSON-RPC 2.0 bridges, allowing clients like Kiro, Claude Code, or Cursor to invoke Burp Suite, jshook, and Metasploit through standardized function calls. This guide walks through the exact configuration steps, file paths, and verification commands needed for production integration.

Understanding the MCP Architecture in reverse-skill

Each MCP server in reverse-skill follows a consistent two-layer pattern:

1. Native tool layer — The actual security tool (Burp Suite, jshook binary, etc.) exposing HTTP endpoints
2. Bridge layer — A thin Node.js script (mcp-bridge.js) that converts MCP stdio traffic into HTTP requests

This design keeps the AI client isolated from tool-specific networking. The client only spawns the bridge process; the bridge handles all HTTP communication with the underlying tool.

Core Components

Component	Location	Purpose
burp-mcp-full/	Repository root	Burp Suite MCP extension + bridge
skills/pentest-tools/src-hunter/	skills/pentest-tools/src-hunter/	Documentation for jshook MCP and related tools
skills/pentest-tools/references/burpsuite-mcp-guide.md	skills/pentest-tools/references/	Complete tool reference and health-check specifications
skills/routing.md	skills/	Runtime MCP server discovery and routing rules

Step 1: Start the Local MCP Server

Before AI client integration, verify your target MCP server is running and reachable.

Burp Suite MCP

1. Compile the Java extension once: javac -cp burp.jar BurpMcpExtension.java
2. Load the resulting JAR in Burp Suite via Extensions → Add
3. Confirm the HTTP API listener starts on 127.0.0.1:9876

jshook MCP

1. Install the jshookmcp binary or pull the Docker image
2. Start the server: it binds to port 23816 by default

Step 2: Configure the AI Client

AI clients read MCP server definitions from a JSON configuration file. The standard location is ~/.mcp-config.json, though clients like Cursor or Claude Code may use client-specific paths.

Minimal Configuration Example

{
  "mcpServers": {
    "burpsuite": {
      "command": "node",
      "args": ["/path/to/reverse-skill/burp-mcp-full/mcp-bridge.js"]
    },
    "jshook": {
      "command": "node",
      "args": ["/path/to/reverse-skill/skills/pentest-tools/src-hunter/jshook-mcp-bridge.js"]
    }
  }
}

Replace /path/to/reverse-skill with your actual clone path. Each entry requires:

• Unique key (burpsuite, jshook, metasploit) — used by the router
• Command — typically node to execute the bridge
• Args — absolute path to the specific mcp-bridge.js or equivalent script

Step 3: Verify Bridge Connectivity

Run direct health checks against the HTTP endpoints before testing through the AI client:

# Burp MCP health check

curl http://127.0.0.1:9876/health

# jshook MCP health check  

curl http://127.0.0.1:23816/health

A healthy response matches this structure (documented at lines 45–46 of burpsuite-mcp-guide.md):

{"status":"ok","version":"2.0.0","tools":["proxy_history","scan_issue","intruder_payload",...]}

If either check fails, verify the native tool is running and ports are not blocked by firewall rules.

Step 4: Enable Automatic Routing

The reverse-skill router dynamically discovers available MCP servers without manual registration. As implemented in skills/routing.md (lines 222–230), the router:

1. Polls well-known ports on startup: 23816 (anything-analyzer/jshook) and 9876 (Burp)
2. Adds successful health-checks to the active MCP capability list
3. Exposes tool schemas to the AI client for function calling

No additional configuration is required. The router re-evaluates server availability on each request cycle.

Step 5: Optional Environment Configuration

Override default networking parameters when running tools on non-standard interfaces:

Variable	Default	Used By
BURP_MCP_HOST	127.0.0.1	Burp MCP bridge
BURP_MCP_PORT	9876	Burp MCP bridge

These variables are documented in burpsuite-mcp-guide.md (lines 79–82). Set them before starting the AI client to propagate to spawned bridge processes.

Testing the Integration

Send a test function call through your AI client to validate the full pipeline. Example request compatible with any MCP-aware client:

{
  "tool": "proxy_history",
  "params": { "limit": 5 }
}

The execution flow:

1. AI client serializes the request as JSON-RPC 2.0 over stdio to the bridge
2. mcp-bridge.js translates to: GET http://127.0.0.1:9876/proxy_history?limit=5
3. Burp Suite returns proxy entries as JSON
4. Bridge streams the response back to the AI client

Security Considerations

The reverse-skill routing engine implements a local-only trust policy as documented in skills/ops/skill-supply-chain.md (line 27). Key restrictions:

• Remote MCP servers are rejected regardless of authentication
• Only servers passing localhost health-checks are enabled
• Bridge processes inherit limited environment scope

Do not expose MCP HTTP ports to external interfaces. Keep BURP_MCP_HOST at 127.0.0.1 unless operating within a controlled container network.

Complete Configuration Examples

Kiro AI Client (~/.mcp-config.json)

{
  "mcpServers": {
    "burpsuite": {
      "command": "node",
      "args": [
        "/home/user/reverse-skill/burp-mcp-full/mcp-bridge.js"
      ]
    }
  }
}

Automated Health Verification Script

#!/usr/bin/env bash

# save as: check-mcp-health.sh

check_server() {
  local name=$1
  local port=$2
  
  if curl -s "http://127.0.0.1:${port}/health" | grep -q '"status":"ok"'; then
    echo "✅ ${name} MCP is alive on port ${port}"
    return 0
  else
    echo "❌ ${name} MCP not reachable on port ${port}"
    return 1
  fi
}

check_server "Burp" 9876
check_server "jshook" 23816

Raw JSON-RPC Request Format

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "proxy_history",
  "params": { "limit": 10 }
}

Summary

• MCP servers in reverse-skill use mcp-bridge.js scripts to translate AI client stdio into HTTP API calls
• Configure AI clients via JSON entries specifying the Node.js command and absolute bridge path
• Verify deployments with curl health checks against ports 9876 (Burp) and 23816 (jshook)
• The routing engine auto-discovers servers; no manual skill registration required
• Maintain security by binding to localhost and respecting the local-only trust policy

Frequently Asked Questions

What file do I edit to add a new MCP server to my AI client?

Add an entry to ~/.mcp-config.json (or your client's specific MCP configuration file). Each server needs a unique key, the node command, and the absolute path to the appropriate mcp-bridge.js file from the reverse-skill repository.

Why does my AI client show no available tools after configuration?

The bridge process likely failed to start or cannot reach the native tool. Run curl http://127.0.0.1:9876/health for Burp or curl http://127.0.0.1:23816/health for jshook directly. If these fail, verify the native tool is running and ports are not blocked.

Can I run MCP servers on a remote machine?

No. According to skills/ops/skill-supply-chain.md, the reverse-skill router explicitly rejects remote MCP servers as a security measure. Bridges must bind to 127.0.0.1 and pass localhost health-checks to be enabled.

How do I expose custom tools through the MCP interface?

Create a new bridge script following the pattern in burp-mcp-full/mcp-bridge.js, then add its path to your AI client configuration. The bridge must accept JSON-RPC 2.0 on stdio and translate requests to your tool's HTTP API.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}