# Use Burpsuite MCP Bridge

Operate BurpSuite MCP Bridge for professional, authorized web testing.

- Repository: https://github.com/hashgraph-online/awesome-codex-plugins (1479 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add hashgraph-online/awesome-codex-plugins --skill use-burpsuite-mcp-bridge -g -a claude-code -y`
Codex: `npx skills add hashgraph-online/awesome-codex-plugins --skill use-burpsuite-mcp-bridge -g -a codex -y`
Cursor: `npx skills add hashgraph-online/awesome-codex-plugins --skill use-burpsuite-mcp-bridge -g -a cursor -y`
Gemini CLI: `npx skills add hashgraph-online/awesome-codex-plugins --skill use-burpsuite-mcp-bridge -g -a gemini-cli -y`

## Description

Operate BurpSuite MCP Bridge for professional, authorized web testing. Use when Codex needs to inspect Burp live/history/logger/selection traffic, prioritize one target, retrieve a decisive request/response, intercept and edit a request or response before forwarding, replay one controlled mutation, manage temporary rewrite rules, import BChecks/Bambdas, export evidence, or diagnose the Windows Burp to WSL MCP connection.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Use BurpSuite MCP Bridge

Use Burp as the runtime source of truth. Prefer compact indexes and one decisive flow over broad history dumps or speculative requests.

## Start with the bridge

1. Call `burp_bridge_status` and confirm the loaded Burp version, bridge URL, buffers, pending intercepts, and last error.
2. Call `burp_config_get` when scope-only, body preview, static filtering, queue limits, or intercept timeout affect the task.
3. Do not clear buffers until useful existing traffic and selections have been checked.

## Select the shortest workflow

### Target triage

1. Call `burp_target_overview(host=..., focus=...)`.
2. Use `focus="logic"` for client-controlled success, role, permission, verification, approval, payment, or status decisions.
3. Prefer marked candidates from `burp_marked_flows` when Burp comments or highlights exist.
4. Pull only the chosen flow with the source-specific getter.

Use this source mapping:

| Source | Detail |
| --- | --- |
| `history`, `live` | `burp_flow_get` |
| `logger` | `burp_logger_flow_get` |
| `selection` | `burp_selection_get(consume=False)` while iterating |

### One-off request mutation

Use `burp_replay_flow` from a confirmed baseline. Change one variable at a time and compare the full server response. Use `send_to_repeater=True` only when human follow-up in Burp is useful.

### Request or response intercept

Use an intercept when the browser must receive the modified message.

The rest: https://github.com/hashgraph-online/awesome-codex-plugins/blob/HEAD/plugins/6jeffr3y/burpsuite-mcp-bridge/skills/use-burpsuite-mcp-bridge/SKILL.md