What the MCP tools expose
The extension surfaces Burp's core capabilities as MCP tool calls. From a Claude Code prompt you can:
- Send HTTP/1.1 and HTTP/2 requests directly with TLS impersonation managed by Burp.
- Search and filter proxy history (HTTP + WebSocket) with regex.
- Generate and poll Burp Collaborator payloads for out-of-band testing (Professional only).
- Create Repeater tabs and send requests to Intruder for fuzzing.
- Export and modify project + user configuration via JSON.
- Control proxy intercept and the task execution engine.
- Use built-in encoders (URL, Base64) and random string generation.
An automatic Claude Desktop installer is packaged with the extension, so the typical setup is "install Burp extension → restart Claude Desktop → MCP tools appear" with no manual configuration.
Why this matters for scraping recon
Before this extension, identifying which cookie unlocks which route, when the sensor payload fires, and what gets re-validated on POST required a 1–4 hour manual walk through HTTP history. Most of that work is pattern matching against a human-readable timeline — exactly what LLMs are good at. With the MCP server you can prompt: "I have a Burp session captured against retailer.com. Trace the cookie lifecycle for _abck. When does it flip from ~-1~ to ~0~? Which endpoint fires the sensor POST? Which subsequent endpoints check the cookie state?" The LLM walks the history and answers in minutes.
The practical effect: Step 0 of the scraping decision flow — "identify the anti-bot and the bypass step that will work" — collapses from a half-day to a single conversation.
Build a reusable recon skill
The highest-leverage move is to author a single burp-antibot-recon.md skill file with the prompts you find yourself rerunning against new targets. Typical contents:
- Identify the anti-bot vendor from cookies and response headers.
- Map the cookie lifecycle for the vendor's primary session token.
- Find the sensor / challenge POST endpoint.
- Identify routes that enforce vs. ignore the cookie state.
- Recommend a step from the scraping decision flow.
Run the same skill against every new target. The recon output feeds directly into your scraper architecture decisions — which TLS library, which proxy type, whether to invest in a patched browser, or whether to skip straight to a managed API.