Skip to content

Installation

Jump to bottom
Sean edited this page Sep 25, 2026 · 2 revisions

Installation

DoubleAgent has two required halves: Agent A in Burp and Agent B in a browser or macOS app.

What you need

  • Burp Suite Professional or Community
  • Jython standalone 2.7.x
  • PortSwigger's MCP Server BApp for full Burp-native capability
  • Python 3.10 or later when running Agent B from source
  • macOS 13 or later for the optional Agent B application
  • A model connection you configure yourself

Step 1: install Agent A

  1. Download and extract the latest DoubleAgent-v3.0.1.zip release bundle.

  2. In Burp, open Extensions → Settings → Python Environment.

  3. Select your Jython standalone JAR.

  4. Open Extensions → Installed → Add.

  5. Choose Python and select:

    burp/DoubleAgent.py

  6. Confirm the Double Agent tab appears without an extension error.

  7. Open the Agent AI tab and start the Agent API.

DoubleAgent.py automatically finds burp/src/. You do not need to select or move any of the internal files.

If an unusual launcher cannot locate the source folder, set DOUBLE_AGENT_EXTENSION_DIR to the extracted burp folder before starting Burp.

Step 2: enable PortSwigger MCP

  1. In Burp, open Extensions → BApp Store.
  2. Install MCP Server by PortSwigger.
  3. Open Burp's MCP tab and enable the server.
  4. Keep the listener on 127.0.0.1:9876 unless you have a local port conflict.

Agent B uses MCP indirectly: Agent B requests an action from Agent A, Agent A applies scope and safety gates, and only then does Agent A call the local MCP server. You do not need to configure Claude Desktop or the MCP stdio proxy.

Read PortSwigger MCP integration for the architecture, verification commands, fallbacks and security settings.

Step 3A: start Agent B in a browser

From the extracted source:

cd agent_b
./run.command

Open http://127.0.0.1:4310.

Agent B uses the Python standard library and starts with no saved model connection. Its local state lives under agent_b/data/, which is ignored by Git and should never be shared.

Step 3B: install Agent B on macOS

Instead of the browser launch above:

  1. Download Agent-B-macOS-v3.0.1.zip from the latest release.
  2. Extract Agent B.app.
  3. Move it to Applications.
  4. Open the app.

Developers can build it locally:

cd agent_b
./build-macos-app.sh
codesign --verify --deep --strict "dist/Agent B.app"
open "dist/Agent B.app"

Step 4: verify the local services

With Agent A's API and Agent B running:

curl -s http://127.0.0.1:8777/api/health
curl -s http://127.0.0.1:4310/api/health
curl --max-time 2 -N -i http://127.0.0.1:9876/

The Agent A and Agent B health checks should return JSON. The MCP request should return an event-stream response containing an endpoint event; its short timeout is expected.

Step 5: connect the team

  1. Add and test a model under Agent B → Settings → Add connection.
  2. Set the authorized target scope in Burp.
  3. Select Send bootstrap in Agent B.
  4. Review the target and scope Agent B received.

Continue with Configuration or Operator Workflows.

DoubleAgent

Clone this wiki locally