All Classes and Interfaces
Class
Description
Evaluates permission policy and Burp target scope for a tool call and
resolves "prompt" outcomes through the operator UI via
ApprovalManager.Outcome of a gate evaluation.
Config seams so tests can pin enforcement without the McpConfig singleton.
Coordinates operator approvals for prompt-gated tool calls and out-of-scope
targets.
Everything a pending approval needs to describe itself.
One operator decision covering the permission and/or scope requirement.
UI hook; callbacks run on the calling thread.
A pending (or already resolved but not yet consumed) approval request.
Decision for a permission-gated tool.
Decision for an out-of-scope target.
Approvals tab: pending operator decisions for prompt-gated tools and
out-of-scope targets, active session grants, and a short decision history.
Bounded AsyncRunner honoring the
thread_pool_size and
max_queue_size preferences.Returns Burp Suite version, edition, and connected MCP server info.
Returns server metrics including uptime, request counts, latencies,
tool call distribution, and cache hit rate.
Utility for hex encoding/decoding and byte array conversion.
Circuit breaker for external-calling tools.
Generate a Collaborator payload for DNS/log4j/etc. interaction testing.
Get Collaborator interactions for a previously generated payload.
Get Burp configuration options.
Returns all MCP-specific preferences and their current values.
Set Burp configuration options.
List all cookies in the Burp cookie jar.
Set a cookie in the Burp cookie jar.
Holds live
Crawl handles by ID so agents can poll and stop
crawls across MCP calls.Decode data from base64, url, or hex encoding.
Encode data to base64, url, or hex encoding.
File-based error logger with log rotation (max 5MB, keep 3 files),
structured JSON-lines output, and JVM info header on new sessions.
Build an HTTP request from individual components (method, URL, headers, body).
Compare two HTTP responses to identify variant and invariant attributes.
Retrieve a previously stored HTTP request from the cache by its request_id.
Search for keywords across multiple HTTP responses.
Serializes Montoya HTTP objects to JSON-compatible Maps.
Modify an existing raw HTTP request by adding/removing headers, changing body or method.
Parse an HTTP request and return its structured components.
Parse an HTTP response and return its structured components.
Send multiple HTTP requests in parallel and return their responses.
Send a single HTTP request and return the response.
Send data items to the Comparer tool.
Send data to the Decoder tool.
Send an HTTP request to the Intruder tool.
Send an HTTP request to Burp Organizer for manual follow-up.
Send an HTTP request to the Repeater tool.
Store a raw HTTP request in the shared cache for later retrieval.
Input validation for MCP tool parameters.
Structured log entry capturing all context for a single log event.
Add an HTTP request/response pair to the site map.
Shared color palette for consistent Burp MCP UI styling.
Configuration manager backed by Montoya Preferences API.
Custom exception for MCP errors with JSON-RPC error codes.
JSON-RPC 2.0 encoding/decoding utilities.
Owns the MCP listeners' lifecycle so they can be started, stopped, and
restarted from the UI without reloading the extension.
Registry of all MCP tools.
Main UI tab for the Burp MCP Server extension.
Message Viewer — browse proxy history via a searchable dropdown,
navigate with prev/next, inspect request/response in split pane.
Thread-safe metrics collector for the MCP server.
List items stashed in Burp Organizer (manual follow-up store).
Middleware permission manager for MCP tool access control.
Evaluation result for one tool call.
Per-tool policy for CUSTOM mode.
Permission control with a collapsible tree — categories as parent nodes,
tools as leaf nodes with a per-tool Allow / Prompt / Deny policy in CUSTOM
mode (click to cycle).
How to create a new Burp project via the Burp executable.
Locates the
.burp file of the current project.Get a specific proxy history entry by its unique ID.
List proxy HTTP history entries with optional filtering.
Check if proxy intercept is currently enabled.
Toggle proxy intercept on/off.
List WebSocket messages from the proxy history.
Token-bucket rate limiter keyed by source IP.
Thread-safe request cache with TTL-based expiry, LRU eviction, and stats.
Minimal wrapper panel that catches all exceptions during Swing painting/layout.
Base class for Scanner tools that checks for Burp Suite Professional edition.
Import a custom BCheck scan definition into Burp's Scanner.
Poll progress of a crawl started with scanner_start_crawl.
Stop and delete a crawl started with scanner_start_crawl.
Generate a scanner report.
Get detailed information about a specific scanner issue.
List scanner issues with optional filtering.
List all scanner issues from the site map.
Start an active vulnerability scan on specified URLs.
Start a site crawl.
Check whether a given URL is in Burp's scope.
Lists the target scope from two angles:
configured_scope — the actual include rules from Burp's project
configuration, so includes show up even with an empty sitemap.
urls/count — in-scope URLs observed in sitemap traffic.
Add or remove a URL from Burp's target scope.
Panel for editing extension preferences with inline validation,
logical group separators, export/import, and reset-to-defaults.
Get a specific sitemap entry by URL.
Filter sitemap entries by URL prefix, host, method, and/or status code.
List sitemap entries with optional filtering by scope and limit.
Full-text regex search across sitemap request/response bodies.
Panel showing server status, lifecycle controls, metrics dashboard, and
request log with search, filtering, and export capabilities.
Implemented by tools that act on a target host so the access gate can
evaluate Burp's target scope before the tool executes.
Pause or resume Burp's task execution engine (Spider, Scanner).
Report Burp's task execution engine state (Spider/Scanner running or paused).
TLS/SSL manager for the MCP server.
Common interface for all MCP tools.
Metadata for an MCP tool: name, description, and input schema.
Panel for test-invoking MCP tools with custom JSON arguments.
Minimal HTTP/1.1 listener on a Unix domain socket, exposing the same
JSON-RPC surface as the TCP server.
Reads build version info from version.properties (filtered by Maven at build time).
Get a specific WebSocket message by index from the proxy WebSocket history.