diff --git a/src/AI/AI-Burp-MCP.md b/src/AI/AI-Burp-MCP.md
index 50dc52ac714..bc306552db5 100644
--- a/src/AI/AI-Burp-MCP.md
+++ b/src/AI/AI-Burp-MCP.md
@@ -21,17 +21,17 @@ Install **MCP Server** from the Burp BApp Store and verify it is listening on `1
### 2) Extract the proxy JAR
-In the MCP Server tab, click **Extract server proxy jar** and save `mcp-proxy.jar`.
+In the MCP Server tab, click **Extract server proxy jar** and save `mcp-proxy-all.jar`. The packaged proxy adapts clients that only support stdio to Burp's SSE server.[[2]](#references)[[7]](#references)
### 3) Configure an MCP client (Codex example)
-Point the client to the proxy JAR and Burp's SSE endpoint:
+Point the client to the proxy JAR and Burp's SSE endpoint:[[2]](#references)[[7]](#references)
```toml
# ~/.codex/config.toml
[mcp_servers.burp]
command = "java"
-args = ["-jar", "/absolute/path/to/mcp-proxy.jar", "--sse-url", "http://127.0.0.1:19876"]
+args = ["-jar", "/absolute/path/to/mcp-proxy-all.jar", "--sse-url", "http://127.0.0.1:9876"]
```
Then run Codex and list MCP tools:
@@ -65,13 +65,44 @@ reverse_proxy 127.0.0.1:9876 {
EOF
```
-Start the proxy and the client:
+Start the proxy, change the MCP client's `--sse-url` to `http://127.0.0.1:19876`, and then start the client:[[1]](#references)[[3]](#references)
```bash
caddy run --config ~/burp-mcp/Caddyfile &
codex
```
+## Proxy-aware browser automation (OpenBurp)
+
+The Burp MCP connection and the intercepted browser path are separate data flows. The MCP service exposes Burp tools on `127.0.0.1:9876`, whereas a dedicated Chromium instance sends its HTTP(S) traffic through Burp's proxy on `127.0.0.1:8080`. Requests generated directly by an MCP tool may therefore be absent from **Proxy > HTTP history**; use the proxied browser whenever the request/response must be observable, editable, or retained as evidence.[[2]](#references)[[6]](#references)
+
+A client with SSE support can register Burp directly. A stdio-only client can launch PortSwigger's proxy JAR instead. In both cases, register a second browser-control MCP and point it at Burp's embedded Chromium (`BURP_CHROMIUM` is a local executable path):[[6]](#references)
+
+```bash
+# Claude Code: direct SSE plus a proxied browser
+claude mcp add -s project -t sse burpsuite http://127.0.0.1:9876/
+claude mcp add -s project -t stdio chrome-devtools -- chrome-devtools-mcp \
+ --executablePath "$BURP_CHROMIUM" --proxy-server=http://127.0.0.1:8080 \
+ --accept-insecure-certs --isolated
+
+# Codex: SSE-to-stdio bridge plus a proxied browser
+codex mcp add burp -- /path/to/java -jar /path/to/mcp-proxy-all.jar \
+ --sse-url http://127.0.0.1:9876
+codex mcp add burp-browser -- npx -y @playwright/mcp@latest \
+ --executable-path "$BURP_CHROMIUM" --proxy-server=http://127.0.0.1:8080 \
+ --ignore-https-errors --isolated
+```
+
+The TLS-bypass flag tolerates certificates generated by the interception proxy, while `--isolated` prevents the assessment from reusing the operator's normal browser profile. Isolation protects profile state but is **not a security sandbox**: the controller can still access authenticated sessions opened in that test browser, and the Burp MCP can expose sensitive requests, responses, and configuration.[[6]](#references)
+
+Test the SSE listener independently before debugging the client bridge:[[6]](#references)
+
+```bash
+curl -i --max-time 3 http://127.0.0.1:9876/
+```
+
+A healthy listener returns `Content-Type: text/event-stream`. A timeout after the headers is expected because an SSE stream remains open for future events. If the client still fails, confirm the extension's configured route: PortSwigger notes that the endpoint may be the root path or `/sse`, depending on the client and extension configuration.[[6]](#references)[[7]](#references)
+
## Using different clients
### Codex CLI
@@ -162,6 +193,8 @@ Operational cautions: cloud backends may exfiltrate session cookies/PII unless p
- [3] [PortSwigger MCP server strict Origin/header validation issue](https://github.com/PortSwigger/mcp-server/issues/34)
- [4] [Burp MCP Agents (workflows, launchers, prompt pack)](https://github.com/six2dez/burp-mcp-agents)
- [5] [Burp AI Agent](https://github.com/six2dez/burp-ai-agent)
+- [6] [OpenBurp: Burp Suite orchestration for Claude Code and Codex](https://github.com/luispacheco22/OpenBurp)
+- [7] [PortSwigger MCP Server extension source and transport documentation](https://github.com/PortSwigger/mcp-server)
{{#include ../banners/hacktricks-training.md}}