Giving BountyForge a Body: MCP, Burp, and the Case for Tool-Native Security Agents

How we're building a security-native agent that can reason across Burp Suite, sandboxes, reconnaissance tooling, and specialized security skills through MCP, instead of trying to rebuild all of it from scratch.

AI security agents have gotten very good at reasoning about vulnerabilities. They can read a diff, spot a suspicious auth check, hypothesize about an IDOR, and explain the class of bug in fluent, convincing prose.

The problem is that reasoning alone doesn't find bugs.

Real security research is physical, in the way that penetration testing has always been physical. It requires an agent to inspect traffic, replay requests, manipulate parameters, execute code, drive a browser, watch how an application actually behaves under pressure, and, critically, verify that an interesting hypothesis actually holds up against a live target rather than just sounding plausible on paper. A model that can describe an SSRF is not the same as a system that has triggered one and captured the evidence.

That gap, between narrating a vulnerability and proving it, is why we've been pushing BountyForge toward a more open architecture. We wanted the agent to use the tools security researchers already trust, instead of reimplementing every security capability inside the model itself. That led us to MCP.

Why MCP

BountyForge started as an AI-powered security research environment: autonomous agents, sandboxes, recon pipelines, hypothesis generation, and a verification layer to keep the whole thing honest. As the system got more capable, we ran into a structural problem that no amount of better prompting was going to fix:

Every new security tool shouldn't require us to rebuild the agent.

Burp Suite might hold the HTTP state we need. A sandbox might hold the execution environment we need. A browser might hold the authenticated session we need. A specialized scanner might already know how to run a particular class of test better than we ever could in-house. The agent shouldn't need to know or care where a capability lives; it should just be able to ask for it.

In practice, that means the agent can say things like:

• "I need to inspect this request."
• "I need to replay this request under a different authorization context."
• "I need an isolated environment to execute this experiment."

MCP is what lets those requests resolve to real, external tools instead of hardcoded wrappers we have to maintain forever. It turns "the agent's capabilities" into an open set instead of a fixed one.

BountyForge MCP + Burp Setup Guide

Access: Pro / Enterprise / OEM tiers

What this is

BountyForge runs security-native agents that reason across:

• Burp Suite: HTTP traffic inspection, replay, and manipulation, via MCP
• Sandboxes: isolated execution environments for running experiments safely
• Reconnaissance tooling: subfinder, httpx, nuclei, and similar
• Specialized security skills: XSS, SQLi, SSRF, auth bypass, business-logic abuse

The agent doesn't reimplement any of these tools natively. It requests capabilities through MCP and uses whatever's available and connected.

What you need

1. BountyForge Pro or Enterprise, this integration isn't on the free tier.
2. The Burp extension enabled in Burp Suite (the MCP server / Burp Extender plugin).
3. Nothing else. Start the agent and it connects to Burp automatically.

What you get

• The agent inspects live HTTP traffic directly through Burp, not a shadow copy of it.
• It replays requests with modified authorization headers, parameters, or session context.
• Every finding ships with evidence pulled from an actual Burp replay, not just a model's claim that something is broken.
• The supervisor layer validates findings against observed behavior, not against text patterns in a report.

That's the whole setup. No agent rebuild required. The agent asks; Burp answers.

Why this matters

Without MCP, an agent is limited to whatever tools we happened to hardcode wrappers for, a fixed, shrinking-relevance toolkit that falls further behind the ecosystem every month. With MCP:

• The agent can inspect live HTTP state through Burp in real time.
• Evidence is captured as structured data (request, response, hash, tool), not prose summaries that have to be taken on faith.
• Findings reference actual replay results instead of asserting a vulnerability exists.
• The supervisor validates against observed, reproducible behavior rather than pattern-matching on the write-up.

The agent doesn't need to know where its capabilities come from. It asks, and MCP provides. That's the architecture we're betting on: not a bigger model that knows more about vulnerabilities, but a connected one that can go verify them.