Loading ToolBench
MCP server for Burp Suite that provides tools for HTTP testing, security scanning, and configuration management
Mixed quality across 16 tools. Naming is generally strong (verb_noun pattern: send_http1_request, create_repeater_tab, url_encode). Descriptions present but often terse (10-150 chars, below the 194-char baseline). Input schemas visible and properly typed for all tools, but parameter descriptions are minimal. Error handling exists but lacks recovery guidance. Security concerns: HTTP request tools accept raw hostnames/ports without validation; no permission gates on destructive operations (send_to_intruder, set_project_options). Output schemas not documented. Pagination implemented for get_scanner_issues but not consistently across list-like tools.
Base64 decodes the input string
Base64 encodes the input string
Creates a new Repeater tab with the specified HTTP request and optional tab name. Make sure to use carriage returns appropriately.
Generates a Burp Collaborator payload URL for out-of-band (OOB) testing. Inject this payload into requests to detect server-side interactions (DNS lookups, HTTP requests, SMTP). Use get_collaborator_interactions with the returned payloadId to check for interactions.
Generates a random string of specified length and character set
Polls Burp Collaborator for out-of-band interactions (DNS, HTTP, SMTP). Optionally filter by payloadId from generate_collaborator_payload. Returns interaction details including type, timestamp, client IP, and protocol-specific data.
HTTP request tools (send_http1_request, send_http2_request) lack input validation and permission gates. No hostname/port allowlist, no SSRF prevention, no rate limiting. Agents can be tricked into scanning internal networks or launching attacks.
Destructive tools (send_to_intruder, set_project_options, set_user_options) lack confirmation/dry-run patterns. No recovery guidance in error messages. Agents can irreversibly modify Burp Suite state without safeguards.
Descriptions are terse (10-150 chars, well below 194-char baseline). Examples: 'URL encodes the input string' (40 chars), 'Generates a random string of specified length and character set' (65 chars). Lack context on WHEN to use each tool and what it returns.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | <=2025-11-25 | v2 |
Displays information about issues identified by the scanner
Outputs current project-level configuration in JSON format. You can use this to determine the schema for available config options.
Outputs current user-level configuration in JSON format. You can use this to determine the schema for available config options.
Issues an HTTP/1.1 request and returns the response.
Issues an HTTP/2 request and returns the response. Do NOT pass headers to the body parameter.
Sends an HTTP request to Intruder with the specified HTTP request and optional tab name. Make sure to use carriage returns appropriately.
Sets project-level configuration in JSON format. This will be merged with existing configuration. Make sure to export before doing this, so you know what the schema is. Make sure the JSON has a top level 'user_options' object!
Sets user-level configuration in JSON format. This will be merged with existing configuration. Make sure to export before doing this, so you know what the schema is. Make sure the JSON has a top level 'project_options' object!
URL decodes the input string
URL encodes the input string
Output schemas not documented. Tools return strings or JSON but LLMs cannot infer structure. Example: get_scanner_issues returns paginated results but response format (fields, nesting) is not specified. Agents cannot reliably extract data for downstream calls.
Error messages lack recovery guidance. Code shows generic 'Error: {e.message}' responses. No actionable hints for LLMs (e.g., 'Invalid hostname. Allowed: internal.burp.local, staging.burp.local'). Agents cannot self-correct.