Project context
Burp-MCPwn addresses a recurring issue: many MCP servers are exposed with incomplete security controls (weak validation, verbose errors, or over-permissive tools). The extension brings MCP security testing into Burp Suite so assessments are faster and repeatable.
Why it improves over classic manual workflows
Traditional testing often jumps between scripts, terminal sessions, and Burp. Burp-MCPwn consolidates the process:
- Discovers MCP tools and argument schemas.
- Executes JSON-RPC calls from the UI.
- Sends requests to Repeater for focused manual fuzzing.
- Correlates results into a prioritized audit view.
This reduces setup friction and improves finding traceability.
High-level functional architecture
- MCP connection layer (HTTP/SSE): enumerate exposed capabilities.
- Tool inspection: review names, descriptions, and parameters.
- Controlled execution: send valid and invalid payloads to measure resilience.
- Deep Audit: detect risky patterns (command execution, SQL usage, path handling, prompt poisoning, stacktrace leaks).
- Actionable output: produce practical evidence for hardening and reproduction.
Common weakness classes it helps uncover
- Inconsistent type validation (accepting unexpected nested structures).
- Sensitive error leakage (internal paths, traces, IDs).
- Overly broad tool exposure (dangerous actions without proper context checks).
- Ambiguous tool descriptions that increase prompt-injection risk.
Practical assessment scenario
A typical case is an "exec" or "run_task" tool with partial safeguards. Burp-MCPwn helps you:
- Stress-test boundary values and nested types.
- Verify whether filtering happens server-side (not only in client UI).
- Reproduce requests in Repeater and build clean PoCs.
Bug bounty and engineering value
- Speeds up initial MCP attack-surface discovery.
- Supports regression testing after fixes.
- Standardizes technical evidence for vulnerability reports.
Hardening recommendations
- Strict per-tool schemas with deny-by-default behavior.
- Minimal production error messages.
- Action-level authorization with contextual policy checks.
- Source-based rate limiting and robust telemetry.
- Automated negative tests in CI/CD to prevent regressions.