> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/ai-scan.md).

# AI Scanner

Configure model-assisted analysis and control when it launches active work.

The built-in AI Scanner analyzes selected Burp exchanges using a configured model. It can suggest attack surfaces, technologies and relevant profiles, and optionally launch local active scanning. It is separate from an external AI agent connected to Server's MCP.

## Configure a provider

Open **Scanners → AI → Settings**. Configure:

| Setting              | Purpose                                                         |
| -------------------- | --------------------------------------------------------------- |
| Provider             | OpenAI, Anthropic, Google Gemini, OpenRouter or Local (Ollama). |
| API key              | Credential for the selected hosted provider, where required.    |
| Model                | A model available to your configured provider/account.          |
| Endpoint             | The endpoint expected by that provider adapter.                 |
| Enabled              | Enable AI analysis.                                             |
| Auto-scan            | Permit analysis results to launch active profiles.              |
| System prompt        | Analysis instructions and expected result contract.             |
| User prompt template | Request, response analysis and available-profile context.       |
| Analysis workers     | Parallel model analysis; distinct from active HTTP concurrency. |

The current implementation defaults to enabled analysis and enabled auto-scan when no saved setting exists. Review auto-scan before the first run. Provider/model access is configured separately from the Burp Bounty license.

Click **Save** to apply and persist the connection settings. The prompt editor saves its two prompts together using its own **Save** button. The provider, API key, model, endpoint, enable/auto-scan choices and prompts are stored in Pro's [per-user storage](/burp-bounty-pro/installation.md#persistent-user-storage), so a renamed or moved JAR can restore them even when Burp has no extension preferences. Unsaved form edits are not applied on unload.

## Launch and inspect

Choose **Local Scanner → AI Scanner** on selected requests. The dialog separates **AI Analysis Concurrency** from **Active Concurrency** and **Requests per second**. Model requests and target scan requests are different workloads.

Inspect the AI row's status, structured analysis, request/response and selected profiles. If auto-scan launches work, check the Active tab for the actual scan and evidence. A model recommendation is not a confirmed vulnerability.

## Prompts and data

The prompt contract includes available profiles and programmatic response analysis. Keep the expected fields and placeholders when customizing it; an incompatible response may not be usable by the scanner. Saved custom prompts are preserved exactly across updates. Use **Reset to Defaults** in the prompt editor and then **Save** when you deliberately want to adopt the current templates.

The selected provider receives the context assembled from the HTTP exchange. Review sensitive headers, cookies and body data before using a hosted provider. Local (Ollama) uses the configured local endpoint but still requires a compatible running model service.

## Live AI analysis

Use **Live AI Scanner** under Settings for continuous analysis, with its own scope, method/extension exclusions and analysis limits. More model concurrency can increase API usage without making active scans faster. For server-side scanning controlled by an agent, use [MCP workflows](/burp-bounty-server/mcp-workflows.md).