Breaking

AIHTTPAnalyzer Adds AI Vulnerability Detection and PoC Generation to Burp Suite

June 28, 2026 at 04:59 EDT

Security
Open Source
AI Agents

AIHTTPAnalyzer, an extension that integrates into the Web app testing tool Burp Suite and analyzes HTTP requests and responses with AI, has been released as open source under the MIT License. The developer is ALPEREN ERGEL (alpernae), and it is distributed on GitHub and also listed on PortSwigger's official BApp Store.

Custom AI Agent · by six2dez

MCP-Based AI Agents Come to Burp Suite

An open-source extension turns Burp into a tool that external AI clients can drive — running AI-assisted analysis and scans across 11 backends, from local LLMs to the cloud, with privacy controls built in.

MCP tools (full build)

AI backends, local & cloud

Vulnerability classes targeted

Privacy modes

MCP tools exposed: full build vs BApp Store

Same extension, different distribution — the easy-install BApp Store version surfaces a slim subset.

Full build

BApp Store

How it works: AI clients drive Burp over MCP

AI Client

Claude Desktop, Cursor

→

MCP Server

SSE :9876 / stdio

→

Burp Functions

History, send, scan

Scoped MCP Access can restrict operations to in-scope hosts only.

Privacy-first by design

v0.9.0 adds a native Anthropic backend and enhanced privacy controls layered across the data path.

3 modes

STRICT / BALANCED / OFF

Pre-send tripwire

High-entropy value warnings

AES-256-GCM

Encrypted storage + HKDF anonymization

Audit logs

JSONL + SHA-256, body redaction

What it adds

Broad backend choice incl. Ollama, LM Studio, NVIDIA NIM, Gemini, Claude
Passive scanner runs as Burp Pro PassiveScanCheck
Options for users prioritizing local LLMs and privacy

Use with caution

AI output is a lead requiring manual verification
Tends to be incomplete in broad contexts
Overreliance should be avoided

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.