Skip to content

Commit a1b0374

Browse files
roomoteroomote
committed
docs: add BurpSuite MCP server integration documentation
- Created comprehensive documentation for BurpSuite MCP server setup - Added installation, configuration, and troubleshooting guides - Created MCP servers documentation directory structure - Updated main README with link to MCP server integrations Fixes #6844
1 parent ad0e33e commit a1b0374

File tree

3 files changed

+229
-0
lines changed

3 files changed

+229
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ Make Roo Code work your way with:
112112

113113
- [Basic Usage Guide](https://docs.roocode.com/basic-usage/the-chat-interface)
114114
- [Advanced Features](https://docs.roocode.com/advanced-usage/auto-approving-actions)
115+
- [MCP Server Integrations](./docs/mcp-servers/) - Documentation for integrating MCP servers like BurpSuite
115116
- [Frequently Asked Questions](https://docs.roocode.com/faq)
116117

117118
### Community

‎docs/mcp-servers/README.md‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# MCP Server Integrations
2+
3+
This directory contains documentation for integrating various MCP (Model Context Protocol) servers with Roo-Code.
4+
5+
## Available MCP Servers
6+
7+
### Security & Testing
8+
9+
- [BurpSuite](./burpsuite.md) - Web application security testing and vulnerability scanning
10+
11+
## What are MCP Servers?
12+
13+
MCP servers extend Roo-Code's capabilities by providing access to external tools and services through the Model Context Protocol. They enable AI assistants to:
14+
15+
- Interact with specialized tools and applications
16+
- Access domain-specific functionality
17+
- Automate complex workflows
18+
- Integrate with existing development and testing infrastructure
19+
20+
## Adding MCP Servers
21+
22+
MCP servers can be configured in two ways:
23+
24+
1. **Project-level**: Add configuration to `.roo/mcp.json` in your project
25+
2. **Global**: Configure in the system-wide MCP settings file
26+
27+
For detailed instructions on configuring specific MCP servers, refer to their individual documentation pages.
28+
29+
## Contributing
30+
31+
To add documentation for a new MCP server:
32+
33+
1. Create a new markdown file in this directory
34+
2. Follow the structure used in existing documentation
35+
3. Include prerequisites, installation steps, configuration examples, and troubleshooting
36+
4. Add a link to your documentation in this README
37+
38+
## Resources
39+
40+
- [Model Context Protocol Documentation](https://modelcontextprotocol.io/)
41+
- [Roo-Code MCP Documentation](https://docs.roocode.com/advanced-usage/mcp)
42+
- [MCP Server Registry](https://github.com/modelcontextprotocol/servers)

‎docs/mcp-servers/burpsuite.md‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# BurpSuite MCP Server Integration
2+
3+
This guide explains how to integrate the [BurpSuite MCP Server](https://github.com/PortSwigger/mcp-server) with Roo-Code, allowing AI assistants to interact with Burp Suite for security testing and web application analysis.
4+
5+
## Overview
6+
7+
The BurpSuite MCP Server enables AI clients to interact with Burp Suite through the Model Context Protocol (MCP). This integration allows Roo-Code to:
8+
9+
- Analyze HTTP requests and responses captured by Burp Suite
10+
- Perform security scans and vulnerability assessments
11+
- Interact with Burp Suite's proxy, scanner, and other tools
12+
- Automate security testing workflows
13+
14+
## Prerequisites
15+
16+
Before setting up the BurpSuite MCP server, ensure you have:
17+
18+
1. **Burp Suite Professional or Community Edition** installed and running
19+
2. **Java** installed and available in your system's PATH
20+
3. **The BurpSuite MCP Extension** installed in Burp Suite
21+
22+
## Installation Steps
23+
24+
### Step 1: Install the BurpSuite Extension
25+
26+
1. Clone the BurpSuite MCP repository:
27+
28+
```bash
29+
git clone https://github.com/PortSwigger/mcp-server.git
30+
cd mcp-server
31+
```
32+
33+
2. Build the extension JAR file:
34+
35+
```bash
36+
./gradlew embedProxyJar
37+
```
38+
39+
3. Load the extension in Burp Suite:
40+
- Open Burp Suite
41+
- Navigate to the **Extensions** tab
42+
- Click **Add**
43+
- Set **Extension Type** to **Java**
44+
- Select the JAR file from `build/libs/burp-mcp-all.jar`
45+
- Click **Next** to load the extension
46+
47+
### Step 2: Configure the MCP Server in Burp Suite
48+
49+
1. In Burp Suite, navigate to the **MCP** tab
50+
2. Enable the MCP server by checking the **Enabled** checkbox
51+
3. Note the server URL (default: `http://127.0.0.1:9876`)
52+
4. Optionally, enable **Enable tools that can edit your config** if you want the MCP server to modify Burp configuration
53+
54+
### Step 3: Configure Roo-Code
55+
56+
There are two ways to configure the BurpSuite MCP server in Roo-Code:
57+
58+
#### Option A: Project-Level Configuration (Recommended)
59+
60+
Create or edit `.roo/mcp.json` in your project root:
61+
62+
```json
63+
{
64+
"mcpServers": {
65+
"burpsuite": {
66+
"command": "java",
67+
"args": ["-jar", "/path/to/mcp-server/build/libs/mcp-proxy-all.jar", "--sse-url", "http://127.0.0.1:9876"],
68+
"env": {},
69+
"disabled": false,
70+
"alwaysAllow": [],
71+
"disabledTools": []
72+
}
73+
}
74+
}
75+
```
76+
77+
#### Option B: Global Configuration
78+
79+
Edit the global MCP settings file:
80+
81+
- **Windows**: `%APPDATA%\Roo-Code\mcp-settings.json`
82+
- **macOS**: `~/Library/Application Support/Roo-Code/mcp-settings.json`
83+
- **Linux**: `~/.config/Roo-Code/mcp-settings.json`
84+
85+
Add the same configuration as shown above.
86+
87+
### Step 4: Verify the Connection
88+
89+
1. Restart Roo-Code or reload the window
90+
2. Open the MCP tab in Roo-Code to verify the BurpSuite server is listed
91+
3. The server status should show as "connected" when Burp Suite is running
92+
93+
## Configuration Options
94+
95+
### Environment Variables
96+
97+
If your Burp Suite installation requires specific environment variables, add them to the `env` object:
98+
99+
```json
100+
{
101+
"mcpServers": {
102+
"burpsuite": {
103+
"command": "java",
104+
"args": ["-jar", "/path/to/mcp-proxy-all.jar", "--sse-url", "http://127.0.0.1:9876"],
105+
"env": {
106+
"JAVA_HOME": "/path/to/java",
107+
"BURP_LICENSE": "your-license-key"
108+
}
109+
}
110+
}
111+
}
112+
```
113+
114+
### Custom Port Configuration
115+
116+
If you've configured Burp Suite's MCP server to use a different port:
117+
118+
1. Update the port in Burp Suite's MCP tab
119+
2. Update the `--sse-url` argument in your configuration to match
120+
121+
### Tool Permissions
122+
123+
Control which Burp Suite tools are available to the AI:
124+
125+
```json
126+
{
127+
"mcpServers": {
128+
"burpsuite": {
129+
"command": "java",
130+
"args": ["..."],
131+
"alwaysAllow": ["scan", "proxy_history"],
132+
"disabledTools": ["config_edit", "active_scan"]
133+
}
134+
}
135+
}
136+
```
137+
138+
## Usage Examples
139+
140+
Once configured, you can ask Roo-Code to:
141+
142+
- "Analyze the HTTP requests in Burp Suite's proxy history"
143+
- "Check for SQL injection vulnerabilities in the captured requests"
144+
- "Export the scan results from Burp Suite"
145+
- "Review the authentication flow captured in Burp"
146+
147+
## Troubleshooting
148+
149+
### Server Not Connecting
150+
151+
1. **Verify Burp Suite is running** and the MCP extension is enabled
152+
2. **Check the server URL** matches between Burp Suite and your configuration
153+
3. **Ensure Java is in PATH**: Run `java -version` to verify
154+
4. **Check firewall settings** aren't blocking localhost connections
155+
156+
### Permission Errors
157+
158+
- Ensure the JAR file path is correct and accessible
159+
- On macOS/Linux, ensure the JAR file has execute permissions: `chmod +x mcp-proxy-all.jar`
160+
161+
### Logs and Debugging
162+
163+
- Check Burp Suite's **Extender** tab for error messages
164+
- Enable debug logging in Roo-Code's output panel
165+
- Review the MCP server logs in Burp Suite's MCP tab
166+
167+
## Security Considerations
168+
169+
1. **Local Only**: The default configuration only allows connections from localhost
170+
2. **Sensitive Data**: Be aware that the MCP server can access all data in Burp Suite
171+
3. **Tool Permissions**: Use `disabledTools` to restrict access to sensitive operations
172+
4. **Production Systems**: Avoid using this integration when testing production systems without proper authorization
173+
174+
## Additional Resources
175+
176+
- [BurpSuite MCP Server Repository](https://github.com/PortSwigger/mcp-server)
177+
- [Model Context Protocol Documentation](https://modelcontextprotocol.io/)
178+
- [Burp Suite Documentation](https://portswigger.net/burp/documentation)
179+
- [Roo-Code MCP Documentation](https://docs.roocode.com/advanced-usage/mcp)
180+
181+
## Support
182+
183+
For issues specific to:
184+
185+
- **BurpSuite MCP Server**: Open an issue on the [GitHub repository](https://github.com/PortSwigger/mcp-server/issues)
186+
- **Roo-Code Integration**: Visit the [Roo-Code support](https://github.com/RooCodeInc/Roo-Code/issues)

0 commit comments

Comments
 (0)