AI Triage

AI Triage

MCP edition only. AI Triage is in secretsifter-mcp-1.0.2.jar. The Burp Suite extension (secretsifter-1.0.3.jar) has no AI features.

AI Triage is optional. It asks a language model to review findings the detection engine already produced, flag likely false positives and suggest a severity. It never decides what is detected; the deterministic rules always do that.

Providers

Open SecretSifter MCP, Settings, AI Triage and choose a provider:

Provider	What happens
Burp AI (Pro) (default)	Uses Burp Suite Professional's built-in AI. Requires Burp Professional with AI features enabled.
Anthropic API (Claude)	Sends findings to api.anthropic.com with your own API key
OpenAI / Compatible	Sends findings to the OpenAI API (default model gpt-4o) or to an OpenAI-compatible endpoint you configure, such as Ollama or LM Studio. A key is required; for a local endpoint that doesn't need one, enter any placeholder value.
Claude via MCP	Hands findings to a local MCP client such as Claude Code. See MCP Integration.

Running triage

• All findings: click AI Triage All on the Bulk Scan tab.
• One finding: right-click a row in the Bulk Scan results table and choose Triage with AI. This is not available with Claude via MCP.

If an API-based provider isn't ready, the status bar shows "AI Triage unavailable". Check the provider and API key in Settings, AI Triage. With Claude via MCP, triage waits up to 10 minutes for your MCP client and then times out.

What it changes

• Findings the model marks as noise are highlighted, and a review dialog lets you choose which to delete. Nothing is deleted without your approval.
• Severities of confirmed findings are updated automatically. For a few key types, fixed severities override the model: AppKey (CRITICAL), ResourceKey (HIGH), SubscriptionKey (HIGH), AppId (INFORMATION) and JWTs from JSON APIs (CRITICAL). All other confirmed findings take the model's suggested severity.
• If the model's reply can't be read, or leaves a finding out, that finding is treated as real and set to MEDIUM.

Data sent

What leaves your machine depends on the provider:

Provider	Data per finding	Where it goes
Burp AI (Pro)	Rule, key name, full matched value, context, source URL and target URL	Burp's AI service, through Burp
Anthropic API (Claude) and OpenAI / Compatible	Rule, key name, value truncated to 40 characters, context truncated to 80 characters, URL without its query string	The endpoint you selected, with your key
Claude via MCP	Rule, key name, value truncated to 60 characters, context truncated to 100 characters, full URL	Your MCP client, which passes it to the model it uses

Data is sent to an AI provider only when you run triage. While the MCP server is on, a connected MCP client can also read findings directly (see MCP Integration). API keys are stored in Burp's preferences.