Installation

Installation

• Burp Suite extension
• Browser extension
• Desktop app

---

Burp Suite extension

Requirements

Item	Requirement
Burp Suite	Professional or Community, 2025.6 or later recommended
Java	17 or later (Burp ships its own runtime)

Version notes: the passive scan check needs Burp Suite Professional 2025.6 or later; on older versions it is skipped. AI triage with Burp AI (MCP edition) needs Burp 2025.2 or later.

Community Edition: Burp's passive scan check requires Burp Suite Professional. In Community Edition, use Bulk Scan, Scan Site Map and the SecretSifter tab on responses in the HTTP message editor.

Choose a JAR

Download from the Releases page:

JAR	Edition
secretsifter-1.0.3.jar	Burp Suite extension
secretsifter-mcp-1.0.2.jar	Burp MCP edition: the same scanner plus AI triage and a local MCP server (see AI Triage and MCP Integration)

Install one or the other, not both.

Install

1. Open Burp Suite and go to Extensions, then Installed.
2. Click Add.
3. Set Extension type to Java.
4. Select the downloaded JAR and click Next.
5. A Secret Sifter tab appears (SecretSifter MCP for the MCP edition).

If nothing appears, check Extensions, Errors and see Troubleshooting.

The Burp Suite extension has been submitted to the PortSwigger BApp Store and is pending review.

Verify a download (optional)

Both JARs are reproducible builds. Each release lists its SHA-256, and building from source at the release tag with JDK 17 produces a byte-identical file:

git clone https://github.com/OWASP/SecretSifter.git
cd SecretSifter && git checkout burp-extension-v1.0.3
cd burp-extension && ./gradlew shadowJar
shasum -a 256 build/libs/secretsifter-1.0.3.jar

For the MCP edition, use tag burp-mcp-v1.0.2 and the burp-mcp folder.

---

Browser extension

Install from your browser's store:

• Chrome Web Store
• Firefox Add-ons

---

Desktop app

Download the installer for Windows (.exe) or macOS (.dmg) from the secretsifter-desktop releases. The desktop app is documented in that repository.