Installation and first start

Choose your executable, start the listener and verify authenticated access.

Select the executable

Platform	Release executable
macOS Apple Silicon	burpbounty-server-darwin-arm64
macOS Intel	burpbounty-server-darwin-amd64
Linux x86-64	burpbounty-server-linux-amd64
Windows x86-64	burpbounty-server-windows-amd64.exe

Use a binary matching the host architecture. Release contents and licensing terms come from your distribution channel; this guide does not imply an unlimited device entitlement.

License and listener

The executable reads BURPBOUNTY_LICENSE_KEY at startup. Clients authenticate with the same value in X-BURPBOUNTY-LICENSE. Configure the real key through your shell or service environment; do not commit it into scripts or documentation.

macOS / Linux (Bash)

Prompt for the key without writing it into shell history:

read -r -s -p 'License key: ' BURPBOUNTY_LICENSE_KEY
printf '\n'
export BURPBOUNTY_LICENSE_KEY
chmod +x ./burpbounty-server-darwin-arm64
./burpbounty-server-darwin-arm64 --ip 127.0.0.1 --port 8081

Substitute the Linux or Intel binary where appropriate.

Windows (PowerShell)

Set $env:BURPBOUNTY_LICENSE_KEY through your normal secret-management process and launch:

.\burpbounty-server-windows-amd64.exe --ip 127.0.0.1 --port 8081

The current licensing implementation validates the same product variants as Burp Bounty Pro. Startup can activate the device when required, subject to the license's device limits. Header authentication checks that the client supplies the server's configured key; it is distinct from startup license validation.

Verify REST availability

From a terminal that has the key configured:

curl --fail --silent --show-error -o /dev/null -w '%{http_code}\n' \
  -H "X-BURPBOUNTY-LICENSE: ${BURPBOUNTY_LICENSE_KEY}" \
  http://127.0.0.1:8081/health

Expected result

A healthy authenticated call returns 200 with an empty body. A request missing the header returns 401, including ordinary browser visits.

Enable MCP and a catalogue

./burpbounty-server-darwin-arm64 \
  --ip 127.0.0.1 --port 8081 \
  --mcp \
  --profiles-dir "/absolute/path/BurpBountyData/profiles" \
  --mcp-allow-targets example.test

Use the actual directory on the server host and your approved target hosts. An explicitly supplied empty, inaccessible or invalid catalogue stops startup with an error. Omit --profiles-dir if clients will upload profiles and do not need catalogue discovery. REST remains enabled when MCP is on.

Stop and update

Ctrl+C initiates shutdown: HTTP/MCP connections are cancelled, scans stop and result writes finish before temporary cleanup. A second Ctrl+C forces exit if needed. Retained history survives normal shutdown; active work is not resumed after restart.

Keep the old executable before updating. --update applies a published compatible update when available. No message is printed when no update or compatible installer is published. Other update-check failures can still produce a warning; that warning does not by itself invalidate a working license.