> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/readme.md).

# Introduction

Practical guides for scanning, automation and reusable security checks.

Turn a useful security check into a repeatable workflow. Capture a request, choose the profiles that matter, and run them inside Burp Suite or distribute them across as many Burp Bounty Servers as you need.

Licenses are **per user**, with **10 registered activations per license**. Pro includes Server access, with the allowance shared across both products. All deployments are subject to this allowance. See [users, products and activations](/licensing.md).

## Where would you like to start?

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Burp Bounty Pro</strong></td><td>Work inside Burp Suite: capture traffic, run scans and investigate findings.</td><td><a href="/burp-bounty-pro/overview.md">Overview</a></td></tr><tr><td><strong>Burp Bounty Server</strong></td><td>Distribute scans across your machines and VPSs through Pro, REST or MCP agents.</td><td><a href="/burp-bounty-server/overview.md">Overview</a></td></tr><tr><td><strong>Create profiles</strong></td><td>Build your own checks in the Pro graphical editor, then save and reuse them.</td><td><a href="/creating-profiles/overview.md">Create profiles in the graphical editor</a></td></tr><tr><td><strong>Automate with rules</strong></td><td>Connect passive observations to selected active checks in Smart Scan.</td><td><a href="/burp-bounty-pro-rules/overview.md">Overview</a></td></tr></tbody></table>

## Your first useful result

**Already using Burp?** Follow the [first-scan walkthrough](/burp-bounty-pro/quick-start.md): select a request, choose a small profile set and inspect the evidence.

**Setting up a server?** Start with [installation](/burp-bounty-server/installation.md), then [connect Pro](/burp-bounty-pro/remote-scanning.md) or [an MCP client](/burp-bounty-server/mcp-setup.md).

**Building a detector?** Open the [active-profile tutorial](/creating-profiles/creating-active-profile.md). The graphical editor generates the `.bb` file for you.

## Choose where scanning runs

{% tabs %}
{% tab title="Inside Burp" %}
**Local Scanner** runs on Burp's machine, using the profiles loaded in Pro. Findings appear in Burp and the extension's scan views.

Choose this for an interactive workflow alongside Proxy, Repeater, Smart Scan and the built-in AI Scanner.
{% endtab %}

{% tab title="Pro + Server" %}
**Burp Bounty Server Scanner** distributes selected profiles and exchanges across your configured servers. Add as many instances as you need in **Settings → Burp Bounty Servers**. Pro retrieves the findings into Burp and its scan views.

Choose this to move active/passive execution to other machines while keeping Burp as your workspace. Pro rules remain part of the extension.
{% endtab %}

{% tab title="Agent or API" %}
**REST and MCP clients** control your servers directly. Register each instance as a separate MCP connection so an agent can divide work across the participating servers. Use uploaded profiles or the MCP catalogue, then retrieve results and optional retained findings through that server.

Choose this for automation and explicitly distributed work. Server does not run Pro's rule engine or expose Burp's project automatically.
{% endtab %}
{% endtabs %}

{% hint style="info" %}
**One server, two interfaces.** REST is always available. Add `--mcp` to enable the MCP endpoint on the same listener. A Server instance on your laptop still uses the Server engine.
{% endhint %}

## About these guides

These guides cover **Burp Bounty Pro 4.0.0** and **Burp Bounty Server 1.0.0**, with release guidance updated on **14 October 2026**. Start with the [release and migration notes](/changelog.md) when upgrading, and check [compatibility](/creating-profiles/compatibility.md) for differences between the Java and Go engines.

General examples use reserved domains; performance diagnostics also refer to the Burp Bounty test lab. Substitute the requests and systems in your assessment. Server, engine and profile-pack versions are separate; inspect `server_info` when checking the running server and engine builds.