> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-pro/overview.md).

# Overview

Capture traffic, run focused scans and investigate findings inside Burp Suite.

Burp Bounty Pro is the Burp Suite extension. It combines a profile editor, local active and passive scanners, rule-based Smart Scan, AI-assisted analysis, and remote execution through Burp Bounty Server.

Upgrading to **4.0.0**? Read the [release and migration notes](/changelog.md) for saved settings, scanner defaults and the current Server integration. Pro includes Server access for the same user, within the [shared activation allowance](/licensing.md).

## Typical workflow

1. [Install the extension](/burp-bounty-pro/installation.md), activate the license and select the `BurpBountyData` directory.
2. Capture representative requests in Burp, including authentication and any response needed for passive analysis.
3. Enable the profiles relevant to the application, or [create your own](/creating-profiles/creating-active-profile.md).
4. Right-click a request and choose **Burp Bounty Pro → Local Scanner** or **Burp Bounty Server Scanner**.
5. Review the selected URLs and performance limits before starting.
6. Inspect scan progress and findings in Burp; verify the evidence before reporting a vulnerability.

## Which scanner should I use?

| Scanner                    | Purpose                                                                                           |
| -------------------------- | ------------------------------------------------------------------------------------------------- |
| Active Scan                | Inject payloads from selected enabled profiles.                                                   |
| Passive Scan               | Analyze existing requests/responses without active probe requests.                                |
| Smart Scan                 | Use passive detections to select active checks through Pro rules. It can send traffic.            |
| AI Scanner                 | Ask a configured model to analyze a request/response and optionally launch local active profiles. |
| Live scanners              | Apply the configured workflow to traffic observed while enabled.                                  |
| Burp Bounty Server Scanner | Distribute active or passive work across as many configured servers as you need.                  |

Smart Scan and the built-in AI Scanner remain Pro features. Connecting an external agent to the Server MCP does not expose the Pro interface, Burp's proxy history or Burp's project automatically. A separate Burp Suite MCP connection is a different service.

For a tour of the tabs and menus, see [the interface guide](/burp-bounty-pro/interface-overview.md).

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Run your first scan</strong></td><td>Follow a request from selection to finding.</td><td><a href="/burp-bounty-pro/quick-start.md">Quick start</a></td></tr><tr><td><strong>Connect a server</strong></td><td>Add execution capacity while working in Burp.</td><td><a href="/burp-bounty-pro/remote-scanning.md">Connect Burp Bounty Servers</a></td></tr></tbody></table>