RamanMG/Burp-MCP-Unrestricted

What it is

RamanMG/Burp-MCP-Unrestricted is an unofficial fork of PortSwigger's mcp-server Burp extension (by Raman_MG, not affiliated with PortSwigger). It connects Burp Suite to an AI client over MCP. The distributed artifact is burp-mcp-unrestricted-1.3.0.jar, a ready-to-load build with the stdio MCP proxy embedded. The name "unrestricted" refers specifically to disabling upstream's per-action approval dialogs by default.

How it works

Two categories of change over upstream:

Changed defaults (the security-relevant part). Upstream shows a confirmation dialog before the AI client sends an HTTP request or reads captured data. This fork ships those dialogs off by default, and enables config-editing tools by default. As shipped, a connected MCP client can send HTTP requests and read your proxy history without prompting. Nothing is removed — every prompt can be re-enabled in the MCP+ tab (restoring upstream behaviour) or changed in McpConfig.kt before rebuild.

New tools targeting real-engagement scale: get_proxy_http_history_latest (reorders history newest-first — upstream returns oldest-first, unusable past ~100k entries), a maxLength parameter on read tools overriding the hardcoded 5000-char truncation (pass 0 or negative to disable), site-map inventory reads, and Repeater automation. The Repeater tools drive the Swing UI directly (the Montoya API exposes no Repeater surface), making them build-sensitive; run swing_dump to find button indices after a Burp update.

Preconditions / Affected

Requires Java 21 and the jar command on PATH. Server binds 127.0.0.1:9876 by default (as upstream). Risk materializes once the extension is loaded with default toggles and an MCP client is connected.

What to do

If you install, flip the three approval toggles back on after first load, or edit defaults before building:

git clone https://github.com/RamanMG/Burp-MCP-Unrestricted.git
cd Burp-MCP-Unrestricted
./gradlew embedProxyJar

Output lands at build/libs/burp-mcp-all.jar. Use embedProxyJar, not plain build. Load via Extensions → Add → Java.

Do not expose port 9876 on a routable interface with approval prompts disabled. Keep it on localhost.

Caveats

• The page explicitly corrects a common misstatement (echoed in the existing summary's framing): upstream imposes no 1000-URL cap and no pagination ceiling. The real upstream limits are oldest-first ordering, 5000-char truncation, and no site-map inventory read.
• "Verified against the source, not assumed" is the author's claim; full diffs are in CHANGES.md (not fetched).
• Repeater tooling breaks if a Burp update reshuffles the UI.

flowchart TD
  A[Load fork with defaults] --> B{Approval toggles?}
  B -->|off, as shipped| C[MCP client sends HTTP + reads history, no prompt]
  B -->|re-enabled in MCP+ tab| D[Upstream supervised behaviour]
  C --> E{Bound to 127.0.0.1?}
  E -->|yes, default| F[Local risk only]
  E -->|routable interface| G[Remote unauthenticated Burp control]