Connect an MCP client

Connect an agent to the correct endpoint, transport and license header.

Connection settings

Setting	Value
Transport	Streamable HTTP; select http when the client offers stdio/http/sse.
URL	http://127.0.0.1:8081/mcp for a local default instance.
Header	X-BURPBOUNTY-LICENSE: <the server's license key>
OAuth	Not used for this credential.
Server launch	Add --mcp; the REST API remains active.

Choose HTTP

/sse is not this server's endpoint. Do not reuse configuration for a separate Burp Suite MCP extension just because both are MCP services.

OpenCode example

Configure one named connection per server. Keep credentials in the client environment and use the client-supported substitution below:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "burp_bounty_local": {
      "type": "remote",
      "url": "http://127.0.0.1:8081/mcp",
      "enabled": true,
      "oauth": false,
      "timeout": 30000,
      "headers": {
        "X-BURPBOUNTY-LICENSE": "{env:BURPBOUNTY_LOCAL_LICENSE}"
      }
    },
    "burp_bounty_vps": {
      "type": "remote",
      "url": "https://scanner.example.test/mcp",
      "enabled": true,
      "oauth": false,
      "timeout": 30000,
      "headers": {
        "X-BURPBOUNTY-LICENSE": "{env:BURPBOUNTY_VPS_LICENSE}"
      }
    }
  }
}

Set each environment variable to the key configured on that server. type: remote describes the HTTP transport even for loopback. timeout is a client connection/tool-discovery setting, not the lifetime of the submitted scan. See OpenCode's MCP configuration and environment substitution.

Other clients use different configuration keys. Transfer the URL, transport and header values, not an unverified JSON wrapper.

Check access without scanning

Ask the agent to call server_info and list_profiles on each connection. This confirms the responding server and its catalogue without calling create_scan. Record aliases alongside results: a local response must not be attributed to the VPS.

Agent skills

Download the agent skills bundle. It contains two companion skills:

• burp-bounty-server: discover profiles, plan/distribute scans, handle approvals, poll progress and retrieve evidence.

• burp-bounty-profiles: technical help with profile formats and validation, with examples and an offline linter for exported .bb files. The profile creation tutorials use Pro's graphical editor.

Copy the complete skill folders, including references and scripts, to a skill directory supported by the agent client. For OpenCode, a project .agents/skills/ or global ~/.agents/skills/ can be used; see its skills documentation. On other clients, use their supported discovery mechanism or load the guidance explicitly.

Installing a skill does not register an MCP connection, upload the commercial profile pack or configure credentials. The authoritative inventory is always list_profiles on the actual server.