What the MCP tools expose
The extension turns Burp's main features into tools the AI can call. From a Claude Code prompt you can:
- Send HTTP/1.1 and HTTP/2 requests directly, with Burp handling TLS impersonation (TLS is the encryption layer behind https, and impersonation makes the request look like it came from a real browser).
- Search and filter proxy history (HTTP + WebSocket) with regex - pattern matching to find specific requests.
- Generate and poll Burp Collaborator payloads for out-of-band testing, meaning checks that happen over a separate channel (Professional only).
- Create Repeater tabs and send requests to Intruder for fuzzing - automatically resending a request with many varied inputs.
- Export and modify project + user configuration via JSON.
- Control proxy intercept and the task execution engine.
- Use built-in encoders (URL, Base64) and random string generation.
An automatic Claude Desktop installer is packaged with the extension, so the typical setup is "install Burp extension → restart Claude Desktop → MCP tools appear" with no manual configuration.
Why this matters for scraping recon
Before this extension, figuring out which cookie unlocks which route, when the anti-bot's sensor data is sent, and what gets re-checked on a POST took a 1–4 hour manual walk through HTTP history. Most of that work is spotting patterns in a human-readable timeline - exactly what LLMs are good at. With the MCP server you can prompt: "I have a Burp session captured against retailer.com. Trace the cookie lifecycle for _abck. When does it flip from ~-1~ to ~0~? Which endpoint fires the sensor POST? Which subsequent endpoints check the cookie state?" Here _abck is the session cookie an anti-bot sets; the value flipping from -1 to 0 signals you have passed the check. The LLM reads through the history and answers in minutes.
The practical effect: Step 0 of the scraping decision flow — "identify the anti-bot and the approach that will work" — collapses from a half-day to a single conversation.
Build a reusable recon skill
The biggest payoff is to write a single burp-antibot-recon.md skill file holding the prompts you keep rerunning against new targets. Typical contents:
- Identify the anti-bot vendor from cookies and response headers.
- Map the cookie lifecycle for the vendor's primary session token.
- Find the sensor / challenge POST endpoint.
- Identify routes that enforce vs. ignore the cookie state.
- Recommend a step from the scraping decision flow.
Run the same skill against every new target. The recon output feeds directly into your scraper architecture decisions - which TLS library, which proxy type, whether to invest in a patched browser, or whether to skip straight to a managed API.