agentburp icon agentburp v0.1.0
LinkedIn GitHub Get Started
OPEN SOURCE • GO • MCP NATIVE

HTTP Security Testing,
Built for Humans and Agents.

agentburp is a CLI-first, agent-native HTTP intercepting proxy and bug bounty toolkit designed for terminal power-users and autonomous AI security agents. Zero heavy GUI, SQLite-backed, and native stdio JSON-RPC out of the box.

Quick Start Guide View on GitHub Download .exe (v0.1.0)
Go 1.22+
Embedded SQLite
MCP Stdio Protocol
CLI First
MIT License
agentburp — bash — 80x24
Introduction

What is agentburp?

A headless, CLI-first, agent-native HTTP intercepting proxy and bug bounty toolkit designed from the ground up for terminal power-users and LLM security agents.

For two decades, GUI proxies like Burp Suite Professional and OWASP ZAP have defined manual web application penetration testing. However, modern engineering has fundamentally changed: developers ship code non-stop with Cursor, Claude Code, and GitHub Actions, while autonomous security agents require high-speed, programmatic, JSON-driven tooling.

agentburp strips away the heavyweight Java GUI, memory bloat, and manual mouse clicks. It condenses Burp's battle-tested workflow into a single compiled Go binary backed by an embedded SQLite database, strict declarative YAML scope enforcement, and a native Model Context Protocol (MCP) stdio server.

Proxy

Intercepts HTTP/1.1 traffic, validates against strict scope rules, and writes full request/response pairs directly into SQLite.

agentburp proxy start

HTTP History

Query, search, and filter captured transactions by host, HTTP method, status code, or regular expression body matches.

agentburp hist list

Repeater

Replay stored requests with overridden headers, modified auth tokens, and custom bodies without altering original baseline logs.

agentburp repeat <id>

Fuzzer

Fuzz query and body parameters over wordlists or numeric ranges, automatically flagging status and body anomalies.

agentburp fuzz <id>

Diffing

Structurally compare two requests side-by-side: status code variations, response lengths, header differences, and body deltas.

agentburp diff <a> <b>

Heuristic Scanner

Analyzes transactions for high-value bug bounty candidates: IDOR patterns, open redirects, CORS flaws, JWT tokens, and SSRF hints.

agentburp scan <id>

Bug Bounty PoC Reporting

Instantly turn validated vulnerabilities into professional, platform-compliant Markdown writeups ready for HackerOne and Bugcrowd submissions.

agentburp report <id> --format hackerone

MCP Server for AI Agents

Expose the entire proxy, history, repeater, and scanner toolkit to Claude Desktop, Cursor, and autonomous security agents over JSON-RPC stdio.

agentburp mcp-serve --scope scope.yml
Interactive Simulation

See It in Action

Click any module tab below to inspect live simulated commands and structured JSON responses generated by agentburp.

$ agentburp proxy start --addr 127.0.0.1:8888 --scope scope.yml 
[INFO]  2026/10/16 11:44:10 scope.yml loaded (allow_hosts: 2, deny_hosts: 1)
[INFO]  safe_mode is ENABLED: active fuzzing requires --confirm
[INFO]  global rate limit set to 10 req/s (token bucket)
[PROXY] agentburp interceptor listening on 127.0.0.1:8888 (workspace=default)
[AUTH]  Forwarding allowed for *.target.com
[TRX]   GET http://target.com/api/user/1 -> 200 OK (length: 68, id: 1)
[TRX]   POST http://target.com/auth/login -> 302 Found (length: 0, id: 2)
[GUARD] DENIED request to payments.target.com (matches deny rule)
Zero Dependencies

Installation

No Git clone, Go toolchain, or npm required. Download the precompiled, standalone binary for your platform using one line.

Option A: Graphical Setup Installer (NSIS — Recommended)

Download the official Windows installer. Sets up user-space installation, configures PATH automatically, and adds Start Menu shortcuts with zero admin privileges required:

Option B: One-Line Automated PowerShell Install

Runs from any directory (including C:\Windows\System32) without permission issues, installs to %LOCALAPPDATA%\Programs\agentburp, and adds to your user PATH:

irm https://raw.githubusercontent.com/jojin1709/agentburp/main/install.ps1 | iex

Option C: Portable Standalone Executable

Download single binary: agentburp.exe

Download and set execution permissions on Linux AMD64 / ARM64:

curl -sSL -o agentburp https://github.com/jojin1709/agentburp/releases/latest/download/agentburp-linux-amd64 && chmod +x agentburp

For Apple Silicon Macs (M1 / M2 / M3 / M4):

curl -sSL -o agentburp https://github.com/jojin1709/agentburp/releases/latest/download/agentburp-darwin-arm64 && chmod +x agentburp

For Intel-based Mac hardware:

curl -sSL -o agentburp https://github.com/jojin1709/agentburp/releases/latest/download/agentburp-darwin-amd64 && chmod +x agentburp

Compile and install to $GOPATH/bin via Go's official package proxy:

go install github.com/jojin1709/agentburp/cmd/agentburp@latest

Documentation index: pkg.go.dev/github.com/jojin1709/agentburp

Step-by-Step Workflow

Quick Start

From binary download to intercepting, modifying, fuzzing, and producing HackerOne PoC reports in minutes.

01

Download Executable

Grab the binary with PowerShell irm or curl as shown in the Installation section above.

./agentburp --help
02

Configure Target Scope

agentburp enforces a default-deny policy. Download the starter configuration and add your authorized target domain:

# Windows irm https://raw.githubusercontent.com/jojin1709/agentburp/main/examples/scope.yml -OutFile scope.yml # Linux / macOS curl -sSL -o scope.yml https://raw.githubusercontent.com/jojin1709/agentburp/main/examples/scope.yml
03

Start the Proxy Listener

Bind agentburp to your desired local port (defaults to 127.0.0.1:8888):

./agentburp proxy start --addr 127.0.0.1:8888 --scope scope.yml
04

Capture & Search HTTP History

Configure your browser or curl client to route through http://127.0.0.1:8888. Query captured transactions:

./agentburp hist list --host target.com --limit 20 ./agentburp hist show 12
05

Replay with Repeater

Replay stored request #12, overriding headers or request payloads:

./agentburp repeat 12 --set "Authorization: Bearer ATTACKER_TOKEN"
06

Fuzz Parameters for Vulnerabilities

Fuzz an ID parameter over numeric range 1..100. Safe mode requires --confirm:

./agentburp fuzz 12 --param id --range-from 1 --range-to 100 --confirm
07

Run Heuristic Vulnerability Scan

Run heuristic candidate checks on baseline request #12:

./agentburp scan 12
08

Generate Bug Bounty PoC Report

Format confirmed findings into a ready-to-submit HackerOne markdown writeup:

./agentburp report 12 --format hackerone > report.md
Network Interception

Proxy Interceptor

agentburp operates as an HTTP forward proxy. Every request passing through the listener is filtered against the scope guard and recorded to the active workspace's SQLite database.

agentburp proxy start [--addr 127.0.0.1:8888] [--scope scope.yml]

Routing Client Traffic Through agentburp:

# Curl via agentburp curl -x http://127.0.0.1:8888 http://target.com/api/test # Environment Variables export HTTP_PROXY=http://127.0.0.1:8888 export HTTPS_PROXY=http://127.0.0.1:8888
HTTPS Interception Notice
HTTPS traffic is currently handled via a transparent TCP tunnel (pass-through). Full MITM TLS certificate generation and decryption is under active development for v0.2.0.
Persistent Storage

HTTP History Engine

All captured transactions are stored permanently inside ~/.agentburp/history.db. Filter history instantly using structured query flags.

# List entries with filters agentburp hist list --host target.com --method POST --status 200 --limit 50 # Inspect raw request/response headers and body for entry #12 agentburp hist show 12

All history commands stream pure, valid JSON by default, making them instantly pipeable to jq, grep, or LLM agent tool interfaces.

Interactive Replay

Repeater Engine

Replay captured transactions with modified headers, updated tokens, or customized body payloads to test access control and authentication bypasses.

agentburp repeat 12 --set "Authorization: Bearer ATTACKER_TOKEN" --set "X-Forwarded-For: 127.0.0.1" --body '{"role":"admin"}'
Parameter Intruder

Fuzzer & Intruder Engine

Systematically test endpoints against numeric ID ranges or external wordlists. The engine compares every fuzzed response against the baseline and flags anomalies (status mismatches, length deltas, unexpected JSON keys).

# Numeric range IDOR fuzzing agentburp fuzz 12 --param id --range-from 1 --range-to 200 --confirm # Wordlist fuzzing agentburp fuzz 12 --param action --wordlist ./wordlists/actions.txt --anomalies --confirm
Differential Analysis

Differential Analysis Engine

Compare two history entries side-by-side. Crucial for verifying Insecure Direct Object References (IDOR), Broken Object Level Authorization (BOLA), and privilege escalation.

agentburp diff 12 13
Passive & Heuristic

Heuristic Vulnerability Scanner

Runs rule-based heuristic checks over stored transactions to spot high-confidence vulnerability indicators.

agentburp scan 12

Active Scanner Checks:

  • IDOR Candidates: Flags sequential numerical parameters in GET/PUT/DELETE requests.
  • Open Redirect: Scans for redirect parameters (url, redirect, next) paired with 30x responses.
  • CORS Misconfiguration: Checks for Access-Control-Allow-Origin: * on authenticated responses with credentials allowed.
  • JWT Flaws: Inspects Bearer tokens for weak algorithms, missing expiration, or sensitive claims.
  • SSRF Indicators: Flags URL parameters targeting internal IP schemes (127.0.0.1, 169.254.169.254).
PoC Generation

PoC Report Generator

Automate the creation of submission-ready markdown bug reports formatted according to major bug bounty platform standards.

# Generate HackerOne report agentburp report 12 --format hackerone > h1_report.md # Generate Bugcrowd report agentburp report 12 --format bugcrowd > bugcrowd_report.md # Generate Generic Security Advisory Markdown agentburp report 12 --format generic > advisory.md
AI Agent Integration

Model Context Protocol (MCP) Server

agentburp includes a built-in JSON-RPC server operating over standard I/O (stdio), implementing Anthropic's Model Context Protocol. AI assistants can discover endpoints, fuzz parameters, and investigate traffic autonomously.

./agentburp mcp-serve --scope scope.yml

Universal AI Agent Integration Guides

Select your AI agent or IDE below to get the exact configuration and tool setup:

Add to claude_desktop_config.json:

{ "mcpServers": { "agentburp": { "command": "agentburp", "args": ["mcp-serve", "--scope", "scope.yml"] } } }

Add to .cursor/mcp.json and enable .cursorrules:

{ "mcpServers": { "agentburp": { "command": "agentburp", "args": ["mcp-serve", "--scope", "scope.yml"] } } }

Google DeepMind Antigravity IDE and Gemini automatically load .agents/skills/agentburp/SKILL.md and GEMINI.md:

# Antigravity skill activation command: # Agent automatically activates .agents/skills/agentburp/SKILL.md agentburp mcp-serve --scope scope.yml

For OpenAI Custom GPTs, use examples/ai/openai_tools.json and paste system prompt from examples/ai/chatgpt_instructions.md.

# System Prompt Directive: "You are a security assistant driving agentburp CLI & JSON-RPC tools. Respect scope.yml at all times."

Integrate with Ollama, LangChain, AutoGen, and CrewAI using Python wrapper examples/ai/langchain_tools.py:

from examples.ai.langchain_tools import AgentBurpClient client = AgentBurpClient(scope_path="scope.yml") results = client.search_history(status=200, limit=10) scan_results = client.scan_entry(entry_id=1)

Interactive JSON-RPC Playground:

Request Payload (JSON-RPC)

            

            

              
Response Output (stdio stdout)

              

            

          

        

      


      
      

        Security Guarantee
        
Scope Guard & Safety Rails

        

          Security testing requires strict boundaries. agentburp protects testing programs from out-of-scope violations through multiple defense-in-depth safety layers.
        


        

          
          

            
Strict Authorization Requirement

            

              Only test hosts and endpoints you have explicit written permission to assess. agentburp hard-refuses all traffic unless explicitly whitelisted in allow_hosts.
            

          

        


        
    
          
  • Default-Deny Model: Any request to an unlisted host produces an immediate 403 Forbidden block.
    • 
          
  • Deny Always Wins: Entries in deny_hosts override all wildcard allowances (e.g. blacklisting payments.target.com while allowing *.target.com).
    • 
          
  • Safe Mode Guard: When safe_mode: true is active, active intrusive operations (such as fuzzing) fail immediately unless executed with --confirm.
    • 
          
  • Global Token-Bucket Rate Limiter: Enforces strict request throttling across proxy, repeater, and fuzzer calls.
    • 
          
  • Immutable Audit Logging: Active scans and intruder attacks log reasons and payloads to the separate audit_log table in SQLite.
    • 
        

      


      
      

        Live Policy Checker
        
Interactive Scope Visualizer

        

          Simulate how agentburp evaluates target hostnames against active scope policies. Enter any domain below to test:
        


        

          

            
            
          


          

            

              
✓ REQUEST ALLOWED

              
Permitted: matches whitelist rule "*.target.com". Forwarded to target.

            

            
Live Rule Evaluator

          


          

            

              
ALLOW_HOSTS:

              
• target.com

              
• *.target.com

            

            

              
DENY_HOSTS (Takes Precedence):

              
• payments.target.com

            

          

        

      


      
      

        YAML Specification
        
Configuration Reference (scope.yml)

        

          agentburp uses a lightweight YAML configuration file to enforce boundaries and rate controls.
        


        

          
          workspace: mytarget

allow_hosts:
  - "target.com"
  - "*.target.com"

deny_hosts:
  - "payments.target.com"

rate_limit_per_sec: 10
safe_mode: true

notify:
  webhook_url: ""        # Optional Slack/Discord webhook
  min_confidence: "high"
        

      


      
      

        Internal Design
        
System Architecture

        

          How traffic flows through agentburp's scope filter, intercepting forward proxy, SQLite storage engine, and AI tool bridge.
        


        

          
            
            
              
                
                
              
              
                
                
              
              
                
                
              
            

            
            
              
              
              
              
              
              
              
              
              
              
              
              
            

            
            
            
            CLIENT
            Browser / Curl

            
            
            PROXY
            Forward Interceptor
            :8888

            
            
            SCOPE GUARD
            Rate Limiter / Safe Mode

            
            
            TARGET
            Authorized Host

            
            
            SQLITE DB
            history.db + audit_log

            
            
            CORE ENGINES
            • Repeater Engine
            • Anomaly Fuzzer
            • Heuristic Scanner
            • Structural Diff

            
            
            MCP SERVER
            JSON-RPC stdio
            HackerOne Reports
          
        

      


      
      

        Practical Workflows
        
Real-World Examples

        

          Automate bug bounty recon, CI/CD security regression testing, and autonomous agent triage.
        


        
Workflow A: Detecting & Confirming IDOR

        

          # 1. Inspect captured transaction #42
agentburp hist show 42

# 2. Fuzz user ID parameter from 1 to 200
agentburp fuzz 42 --param id --range-from 1 --range-to 200 --confirm

# 3. Diff two responses where anomalous lengths occurred
agentburp diff 42 45

# 4. Generate writeup
agentburp report 45 --format hackerone > idor_writeup.md
        

      


      
      

        Searchable Reference
        
CLI Command Index

        

          Search the entire agentburp CLI syntax. Type to filter instantly:
        


        

          
          
        


        

          
          

            

              agentburp proxy start
              Interceptor
            

            
Starts the forward HTTP intercepting proxy server and records all in-scope traffic into SQLite.

            

              
--addr <host:port>Listen address (default: "127.0.0.1:8888")

              
--scope <file>Path to scope.yml rules (default: "scope.yml")

            

          


          
          

            

              agentburp hist list
              History Query
            

            
Queries and filters captured transactions from the current workspace history database.

            

              
--host <string>Filter by host substring or domain name

              
--method <verb>Filter by HTTP method (GET, POST, PUT, DELETE)

              
--status <code>Filter by exact HTTP status code (200, 302, 403, 500)

              
--body <regex>Search request or response body content via regex

              
--limit <int>Maximum number of results to output (default: 50)

            

          


          
          

            

              agentburp hist show <id>
              Transaction Detail
            

            
Outputs full request and response details, complete headers, duration, and body payload for a transaction ID.

          


          
          

            

              agentburp repeat <id>
              Repeater
            

            
Replays a stored transaction with modified headers or body without mutating the original history entry.

            

              
--set <"Key: Val">Override request header (can be specified multiple times)

              
--body <string>Override request body payload

            

          


          
          

            

              agentburp fuzz <baseline_id>
              Intruder
            

            
Fuzzes a designated query or body parameter against a baseline request, recording anomalies to the audit log.

            

              
--param <name>Parameter name to replace and fuzz (required)

              
--range-from <n>Start integer for numeric sequence

              
--range-to <n>End integer for numeric sequence

              
--wordlist <path>Path to wordlist file

              
--anomaliesOnly print responses that diverge from the baseline (default: true)

              
--confirmExplicit confirmation flag required when safe_mode is enabled

            

          


          
          

            

              agentburp diff <id_a> <id_b>
              Diff
            

            
Compares two stored transactions, calculating status code mismatches, length deltas, and header/body differences.

          


          
          

            

              agentburp scan <entry_id>
              Heuristic Scanner
            

            
Runs automated heuristic vulnerability detection algorithms against a transaction, logging findings to the database.

          


          
          

            

              agentburp report <entry_id>
              Reporting
            

            
Generates a structured bug bounty submission writeup in HackerOne, Bugcrowd, or generic markdown format.

            

              
--format <type>"hackerone", "bugcrowd", or "generic" (default: "generic")

              
--finding-id <n>Specific finding ID to generate report for

            

          


          
          

            

              agentburp workspace use <name>
              Workspace
            

            
Switches the active workspace, isolating captured traffic and findings per target.

          


          
          

            

              agentburp workspace current
              Workspace
            

            
Prints the currently active workspace name.

          


          
          

            

              agentburp mcp-serve
              AI Agent Stdio
            

            
Runs an interactive Model Context Protocol (MCP) server over stdin/stdout for seamless AI agent integration.

          

        


        
      


      
      

        Evolution
        
Roadmap

        

          Current production capabilities versus planned features on the release timeline.
        


        

          

            

              
✓ Production Ready (v0.1.0)

              Active
            

            
    
              
  • ✓ Forward HTTP intercepting proxy with SQLite logging
    • 
              
  • ✓ Queryable HTTP history engine with regex body search
    • 
              
  • ✓ Header/body mutation repeater engine
    • 
              
  • ✓ Automated intruder & anomaly fuzzer
    • 
              
  • ✓ Structural request/response differential analysis
    • 
              
  • ✓ Heuristic scanner (IDOR, CORS, JWT, Open Redirect, SSRF)
    • 
              
  • ✓ HackerOne & Bugcrowd PoC writeup generator
    • 
              
  • ✓ Model Context Protocol (MCP) JSON-RPC stdio server
    • 
              
  • ✓ Default-deny scope guard and token bucket rate limiter
    • 
              
  • ✓ Multi-target workspace isolation
    • 
            

          


          

            

              
Planned Releases (v0.2.0+)

              In Pipeline
            

            
    
              
  • ○ Full HTTPS MITM with auto-generated local CA certificates
    • 
              
  • ○ GraphQL-aware query parsing and mutation fuzzing
    • 
              
  • ○ Built-in OOB Collaborator (DNS/HTTP callback listener for blind SSRF)
    • 
              
  • ○ Secret & credential leak scanner across JS bundles
    • 
              
  • ○ Autonomous crawler & spider for sitemaps and robots.txt
    • 
              
  • ○ WAF auto-detection with exponential backoff throttling
    • 
            

          

        

      


      
      

        Frequently Asked Questions
        
Common Questions (FAQ)

        

          Answers to common architectural, operational, and integration questions.
        


        

          

            
            

              agentburp is a lightweight, CLI-first, agent-native HTTP intercepting proxy and bug bounty toolkit written in Go. It packages Burp Suite's core workflow (Proxy, History, Repeater, Intruder, Diff, Heuristic Scanner, and PoC Reporting) into a headless CLI and MCP server that both human terminal users and autonomous AI agents can drive effortlessly.
            

          


          

            
            

              No. agentburp is completely standalone, written in Go with an embedded pure-Go SQLite database engine. It has zero dependencies on Java, Burp Suite, Python, or external database servers.
            

          


          

            
            

              Yes. Running agentburp mcp-serve launches a native Model Context Protocol (MCP) server communicating via JSON-RPC over stdin/stdout. AI agents like Claude Desktop, Cursor, or autonomous agent frameworks can search history, trigger fuzzing runs, and inspect anomalies directly.
            

          


          

            
            

              agentburp operates on a strict default-deny model. Unless a host is explicitly listed in allow_hosts in scope.yml, all requests are blocked with a 403 Forbidden error. Furthermore, deny_hosts always overrides wildcard allowances to prevent testing sensitive payment or third-party domains.
            

          


          

            
            

              All transactions are stored locally on your machine in ~/.agentburp/history.db. When you switch workspaces with agentburp workspace use <name>, traffic and findings are isolated per target program.
            

          


          

            
            

              No. You can download precompiled, single-file binary executables for Windows (agentburp.exe), Linux, and macOS directly from the GitHub Releases page with zero toolchain dependencies.
            

          


          

            
            

              Windows (x86_64), Linux (AMD64 and ARM64), and macOS (Apple Silicon ARM64 and Intel AMD64).
            

          


          

            
            

              Yes! agentburp is 100% free and open-source software distributed under the permissive MIT License.
            

          

        

      


      
      

        Community & Legal
        
Contributing & License

        

          agentburp is developed with passion by JOJIN JOHN. Connect on LinkedIn.
        


        

          Contributions are welcome! Each internal package in internal/ (db, proxy, fuzzer, repeater, scanner, scope) is intentionally modular and decoupled, allowing developers and agents to extend functionality without regression.
        


        
        

          
            

              
              
Contributing Guide

            

            
Step-by-step workflow for reporting bugs, submitting PRs, and agent development.

          

          
            

              
              
Code of Conduct

            

            
Contributor Covenant pledge ensuring a safe, welcoming, and inclusive community.

          

          
            

              
              
Security Policy

            

            
Responsible disclosure and private vulnerability reporting instructions.

          
        


        

          MIT License

Copyright (c) 2026 JOJIN JOHN

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software...
        


        

          
          

            
Legal Disclaimer

            

              agentburp is created solely for authorized security research, ethical penetration testing, and vulnerability disclosure programs. The author assumes no liability for unauthorized or illegal use of this software.