v1.3.0-unrestricted

Unofficial fork of PortSwigger/mcp-server v1.3.0. Tweaked by Raman_MG.

Install

Download burp-mcp-unrestricted-1.3.0.jar below, then in Burp: Extensions → Add → Java → select the jar.
The stdio MCP proxy is embedded, so this is the only file you need. Java 21.

Adds 8 tools the official extension does not expose

Tool	Why
get_proxy_http_history_latest	Proxy history newest-first. Upstream is oldest-first, so on a 100k-request project the newest sits at offset ~100000.
get_site_map	The discovered URL inventory, including crawled URLs with no response yet. Upstream reads siteMap().issues() but never requestResponses().
active_scan_url	Start an active audit. Upstream can read findings but never start a scan. (Professional)
crawl_url	Start a crawl from seed URLs. (Professional)
repeater_send	Upstream can put a request into Repeater but cannot send it.
repeater_read	Read the request/response panes back.
repeater_rename	Rename a Repeater sub-tab.
swing_dump	Dump the Burp UI tree, for mapping the Repeater tools on your build.

Read tools also take maxLength, overriding the hardcoded 5000-character truncation. Pass 0 for no truncation.

Changed defaults, read before installing

HTTP-request approval and data-access approval prompts are off by default, and config-editing tooling
is on. A connected MCP client can send requests and read your proxy history without asking first.

Nothing was removed. Every prompt is switchable in the MCP+ tab, and turning all three back on gives you
upstream behaviour. The server still binds to 127.0.0.1:9876; do not expose it with the prompts disabled.

Licence

GPL-3.0, same as upstream. Changes documented in CHANGES.md per GPLv3 section 5(a).
Not affiliated with or endorsed by PortSwigger.