OpenBurp Integrating Burp Suite with Claude Code, Codex, and...

src/AI/AI-Burp-MCP.md

@@ -21,17 +21,17 @@ Install **MCP Server** from the Burp BApp Store and verify it is listening on `1
 
 ### 2) Extract the proxy JAR
 
-In the MCP Server tab, click **Extract server proxy jar** and save `mcp-proxy.jar`.
+In the MCP Server tab, click **Extract server proxy jar** and save `mcp-proxy-all.jar`. The packaged proxy adapts clients that only support stdio to Burp's SSE server.<sup>[[2]](#references)[[7]](#references)</sup>
 
 ### 3) Configure an MCP client (Codex example)
 
-Point the client to the proxy JAR and Burp's SSE endpoint:
+Point the client to the proxy JAR and Burp's SSE endpoint:<sup>[[2]](#references)[[7]](#references)</sup>
 
 ```toml
 # ~/.codex/config.toml
 [mcp_servers.burp]
 command = "java"
-args = ["-jar", "/absolute/path/to/mcp-proxy.jar", "--sse-url", "http://127.0.0.1:19876"]
+args = ["-jar", "/absolute/path/to/mcp-proxy-all.jar", "--sse-url", "http://127.0.0.1:9876"]
 ```
 
 Then run Codex and list MCP tools:
@@ -65,13 +65,44 @@ reverse_proxy 127.0.0.1:9876 {
 EOF
 ```
 
-Start the proxy and the client:
+Start the proxy, change the MCP client's `--sse-url` to `http://127.0.0.1:19876`, and then start the client:<sup>[[1]](#references)[[3]](#references)</sup>
 
 ```bash
 caddy run --config ~/burp-mcp/Caddyfile &
 codex
 ```
 
+## Proxy-aware browser automation (OpenBurp)
+
+The Burp MCP connection and the intercepted browser path are separate data flows. The MCP service exposes Burp tools on `127.0.0.1:9876`, whereas a dedicated Chromium instance sends its HTTP(S) traffic through Burp's proxy on `127.0.0.1:8080`. Requests generated directly by an MCP tool may therefore be absent from **Proxy > HTTP history**; use the proxied browser whenever the request/response must be observable, editable, or retained as evidence.<sup>[[2]](#references)[[6]](#references)</sup>
+
+A client with SSE support can register Burp directly. A stdio-only client can launch PortSwigger's proxy JAR instead. In both cases, register a second browser-control MCP and point it at Burp's embedded Chromium (`BURP_CHROMIUM` is a local executable path):<sup>[[6]](#references)</sup>
+
+```bash
+# Claude Code: direct SSE plus a proxied browser
+claude mcp add -s project -t sse burpsuite http://127.0.0.1:9876/
+claude mcp add -s project -t stdio chrome-devtools -- chrome-devtools-mcp \
+  --executablePath "$BURP_CHROMIUM" --proxy-server=http://127.0.0.1:8080 \
+  --accept-insecure-certs --isolated
+
+# Codex: SSE-to-stdio bridge plus a proxied browser
+codex mcp add burp -- /path/to/java -jar /path/to/mcp-proxy-all.jar \
+  --sse-url http://127.0.0.1:9876
+codex mcp add burp-browser -- npx -y @playwright/mcp@latest \
+  --executable-path "$BURP_CHROMIUM" --proxy-server=http://127.0.0.1:8080 \
+  --ignore-https-errors --isolated
+```
+
+The TLS-bypass flag tolerates certificates generated by the interception proxy, while `--isolated` prevents the assessment from reusing the operator's normal browser profile. Isolation protects profile state but is **not a security sandbox**: the controller can still access authenticated sessions opened in that test browser, and the Burp MCP can expose sensitive requests, responses, and configuration.<sup>[[6]](#references)</sup>
+
+Test the SSE listener independently before debugging the client bridge:<sup>[[6]](#references)</sup>
+
+```bash
+curl -i --max-time 3 http://127.0.0.1:9876/
+```
+
+A healthy listener returns `Content-Type: text/event-stream`. A timeout after the headers is expected because an SSE stream remains open for future events. If the client still fails, confirm the extension's configured route: PortSwigger notes that the endpoint may be the root path or `/sse`, depending on the client and extension configuration.<sup>[[6]](#references)[[7]](#references)</sup>
+
 ## Using different clients
 
 ### Codex CLI
@@ -162,6 +193,8 @@ Operational cautions: cloud backends may exfiltrate session cookies/PII unless p
 - [3] [PortSwigger MCP server strict Origin/header validation issue](https://github.com/PortSwigger/mcp-server/issues/34)
 - [4] [Burp MCP Agents (workflows, launchers, prompt pack)](https://github.com/six2dez/burp-mcp-agents)
 - [5] [Burp AI Agent](https://github.com/six2dez/burp-ai-agent)
+- [6] [OpenBurp: Burp Suite orchestration for Claude Code and Codex](https://github.com/luispacheco22/OpenBurp)
+- [7] [PortSwigger MCP Server extension source and transport documentation](https://github.com/PortSwigger/mcp-server)
 
 {{#include ../banners/hacktricks-training.md}}