MCP Server · Burp Suite · Claude Code
Burp Suite MCP Server
Launch agentic penetration tests from Burp Suite and Claude Code. The TurboPentest MCP server connects your AI assistant to real pentests - findings with CVSS and proof-of-concept, reports, and retests, without leaving your workflow.
Free MCP server and Burp extension · Pentest results in a few hours
One pentest engine, driven from Burp or your AI assistant
TurboPentest ships two ways to launch and read agentic pentests from the tools security engineers already use. The MCP server connects Claude Code, Claude Desktop, Cursor, and Windsurf; the Burp Suite Professional extensionlaunches the same pentests from Burp's target scope and imports findings as native Burp Scanner issues. Add a GitHub repo for white-box source analysis on any scan.
Prefer the full picture? See all TurboPentest integrations, or learn what web application penetration testing covers.
Connect Burp Suite & Claude Code in minutes
1. Create your API key
Generate a key in your TurboPentest account. Both the MCP server and Burp extension authenticate with it.
2a. Claude Code (local, via npx)
Add this to .mcp.json in your project root. Works with Claude Desktop, Cursor, and Windsurf too.
{
"mcpServers": {
"turbopentest": {
"command": "npx",
"args": ["@turbopentest/mcp-server"],
"env": {
"TURBOPENTEST_API_KEY": "tp_live_..."
}
}
}
}2b. Remote endpoint (no install)
Or connect the hosted MCP endpoint over streaming HTTP - nothing to install locally.
{
"mcpServers": {
"turbopentest": {
"type": "url",
"url": "https://mcp.turbopentest.com/mcp",
"headers": {
"Authorization": "Bearer tp_live_..."
}
}
}
}3. Install the Burp Suite extension
Download the latest release and load it in Burp Suite Professional (Extensions → Add). Launch pentests from Burp's target scope and read findings as native Burp Scanner issues.
What you can do from Claude Code
- ✓Launch agentic pentests against your verified domains
- ✓Check scan status and progress in real time
- ✓Pull findings with severity, CVSS, CWE, proof-of-concept, and remediation
- ✓Download reports as Markdown, JSON, or PDF
- ✓Check your credit balance and available scan tiers
- ✓List verified domains and verify attestation letters
Pentest your app from Burp or Claude Code
A full agentic pentest - the same tools and methodology a senior pentester uses - from $99, with results in a few hours.
Burp Suite MCP server FAQ
What is a Burp Suite MCP server?
An MCP (Model Context Protocol) server exposes tools to an AI assistant like Claude Code. TurboPentest's MCP server lets you launch agentic penetration tests and read findings from your assistant, and the companion Burp Suite Professional extension launches those pentests straight from Burp's target scope - so Burp and your AI coding assistant drive the same TurboPentest engine.
How do I connect Burp Suite to Claude Code?
Create a TurboPentest API key, add the @turbopentest/mcp-server block to your .mcp.json (Claude Code) or connect the remote endpoint at https://mcp.turbopentest.com/mcp, then install the TurboPentest extension in Burp Suite Professional. Claude Code drives pentests over MCP; Burp launches and reads the same scans natively.
Does the TurboPentest MCP server work with GitHub?
Yes. Connect a GitHub repository to add white-box source analysis (SAST, SCA, secret detection) to any pentest you launch from the MCP server, and run TurboPentest in CI with the GitHub Action so scans fire on every deploy.
Which AI assistants are supported?
Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible assistant. Install locally via npx (stdio) or connect the remote HTTP endpoint - both authenticate with your TurboPentest API key.
How much does it cost?
The MCP server and Burp Suite extension are free. Pentests start at $99 per run, and every pentest consumes one credit - so you only pay when you launch a scan.