MCP Inspector

[Manjesh24]

Extension URL

https://github.com/Manjesh24/MCP-Inspector/tree/main

Version number

1.0.0

Author display name

Manjesh S

Contact Details

manjesh24@gmail.com

Discord username

manjesh24

I confirm that the following is true:

• I have permission from all relevant persons to submit this extension to the BApp Store for public use, under the terms and conditions of the EULA.
• I have read and understood the submission requirements for the BApp Store.

Extension overview

MCP Inspector is a comprehensive testing tool for Model Context Protocol (MCP) servers. It provides a full-featured interface for connecting to MCP endpoints, listing available tools/resources/prompts, and executing requests with full Burp Repeater-style functionality including request history, custom headers, and intelligent JSON unescaping for nested responses.

Key features

• Full MCP Protocol Support: Connect to any MCP server over HTTP/SSE with session management
• Interactive Tools Browser: View all available tools with parameters and descriptions, right-click to send to editor
• Request Editor: Burp-native message editors with Raw/Hex/Pretty tabs, encoding tools, and search
• History Navigation: Browse previous requests with forward/back buttons (50 request history)
• Smart JSON Unescaping: Automatically extract and format nested/escaped JSON from MCP responses
• Custom Headers: Configure authentication tokens and custom HTTP headers
• Resources & Prompts: Browse and interact with MCP resources and prompts
• SSE Support: Real-time Server-Sent Events for async operations with progress tracking
• Configurable Timeouts: Adjust request timeouts and progress tracking behavior
• Theme-Aware UI: Automatically adapts status indicators for dark/light mode
• Auto-Discovery: Automatically lists tools after successful connection

Usage instructions

1. Installation: Load the extension through Burp's Extensions tab (Extender > Extensions > Add)

2. Connect to MCP Server:

   • Navigate to the "MCP Inspector" tab
   • Enter your MCP endpoint URL (e.g., https://example.com/mcp)
   • Click "Headers" to add authentication tokens if needed
   • Click "Connect" - tools will automatically load

3. Browse Available Tools:

   • View all tools in the "Tools" tab with parameters and descriptions
   • Right-click any tool and select "Send to Request Editor"
   • The editor will pre-fill with sample parameters based on the tool's schema

4. Execute Requests:

   • In "Request Editor" tab, modify the JSON request as needed
   • Click "Send" (orange button) to execute
   • Response appears in the right panel with full Burp editor features

5. Handle Nested JSON:

   • If response contains escaped JSON strings (common in MCP), click "Unescape JSON" (blue button)
   • This extracts and formats nested JSON for easier reading

6. Advanced Features:

   • Use < and > buttons to navigate request history
   • Click "Timeouts" to configure async request handling
   • Check "Server Info" tab for connection details and capabilities
   • Monitor "Logs" tab for detailed protocol-level information

Requirements:

• Burp Suite
• Java 11+ (for HTTP/2 client support)
• Python/Jython support enabled in Burp

Template identifier (Internal use only - please ignore)

• template:01-submit-extension

[github-actions]

❌ Submission failed.

Error: Missing required fields: Author name

Please correct the issue and submit a new request.

[Hannah-PortSwigger]

Hi @Manjesh24 - don't worry, I'll reopen this. It looks like something has gone slightly wrong with our automation.

[Hannah-PortSwigger]

We've added your submission to our review queue.

We will review your extension as soon as possible. You can track the progress of your submission in our Extension Submissions project.

If you have any questions, please comment on this issue. For urgent matters, contact bapps@portswigger.net.

[Hannah-PortSwigger]

Thank you for your patience.

I'm pleased to inform you that we're progressing your extension through to our "Code review" stage. This is where we take a look at the code for your extension and make sure that it meets our guidelines.

If there's anything else we can help with in the meantime, please let us know.

[andrew-stevenson-portswigger]

Thank you for your patience.

After reviewing your extension, we have the following feedback:

• Your extension makes several HTTP requests outside of Burp's networking stack. Where possible, these should always be routed through Burp to ensure they respect the user's proxy settings, timeout configuration, and connection controls.

• Your extension doesn't register an unload handler (IBurpExtenderCallbacks.registerExtensionStateListener), so background threads are left running when the extension is unloaded.

• Shared mutable data structures (such as pending_requests) are accessed from multiple threads without synchronisation. Using thread-safe collections or explicit locking around accesses to shared state would prevent race conditions and data corruption.

• Several action handlers run blocking operations on the Event Dispatch Thread — including time.sleep() calls and thread.join() with up to a 2-second timeout inside _on_connect_click. Any blocking work should be moved off the EDT, with UI updates posted back via SwingUtilities.invokeLater. Blocking the EDT can freeze the entire Burp UI until the operation completes.

---

After you've implemented the above feedback, simply make a comment starting with /reopen and we'll put your extension back into the submission process.