OpenBurp Integrating Burp Suite with Claude Code, Codex, and...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://github.com/luispacheco22/OpenBurp
• Blog Title: OpenBurp: Integrating Burp Suite with Claude Code, Codex, and an Isolated Kali Pentest Container
• Suggested Section: AI Security > Burp MCP: LLM-assisted traffic review

🎯 Content Summary

OpenBurp is an orchestration toolkit for connecting Burp Suite Professional to Claude Code, Codex, or both through the Model Context Protocol (MCP). Burp MCP provides web-traffic analysis capabilities, while an AI-controlled instance of Burp's embedded Chromium sends browser traffic through Burp's HTTP proxy. An optional persistent Kali Linux Docker container gives the agent an isolated environment for reconnaissance, exploitation, a...

🔧 Technical Details

MCP transport adaptation: When a security tool exposes MCP over Server-Sent Events but an AI client expects or operates more reliably over stdio, place a local transport bridge between them. In this workflow, Burp exposes SSE on 127.0.0.1:9876, while mcp-proxy-all.jar --sse-url http://127.0.0.1:9876 presents Burp as a local stdio MCP process. Clients with native SSE support can register the endpoint directly instead.

Proxy-aware AI browser automation: Launch a dedicated browser through an MCP browser controller with --proxy-server=http://127.0.0.1:8080. Use --accept-insecure-certs or --ignore-https-errors to tolerate the TLS certificate generated by an interception proxy, and --isolated to prevent testing cookies, credentials, and browser state from mixing with the user's normal profile. This makes AI-driven navigation observable and modifiable in the intercepti...

🤖 Agent Actions

Updated src/AI/AI-Burp-MCP.md with:

• OpenBurp’s separate MCP-control and proxied-browser traffic paths.
• Claude Code and Codex configuration commands.
• SSE-to-stdio transport bridging.
• Isolated Chromium proxying and TLS interception flags.
• SSE endpoint health testing and troubleshooting.
• Corrected mcp-proxy-all.jar naming and endpoint configuration.
• Numbered citations to OpenBurp and PortSwigger sources.

Validation passed: clean diff, balanced code fences, sequential references, working source URLs, and no forbidden sources. mdbook was unavailable locally.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://github.com/luispacheco22/OpenBurp

Content Categories: Based on the analysis, this content was categorized under "AI Security > Burp MCP: LLM-assisted traffic review".

Repository Maintenance:

• MD Files Formatting: 997 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0