> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-server/mcp-setup.md).

# Connect an MCP client

Connect an agent to the correct endpoint, transport and license header.

## Connection settings

| Setting       | Value                                                                 |
| ------------- | --------------------------------------------------------------------- |
| Transport     | Streamable HTTP; select `http` when the client offers stdio/http/sse. |
| URL           | `http://127.0.0.1:8081/mcp` for a local default instance.             |
| Header        | `X-BURPBOUNTY-LICENSE: <the server's license key>`                    |
| OAuth         | Not used for this credential.                                         |
| Server launch | Add `--mcp`; the REST API remains active.                             |

{% hint style="info" %}
**Choose HTTP**

`/sse` is not this server's endpoint. Do not reuse configuration for a separate Burp Suite MCP extension just because both are MCP services.
{% endhint %}

## OpenCode example

Configure one named connection per server. **The two entries below are a minimal example, not a two-server limit.** Add an entry with a unique name, endpoint and license header for every additional server you want the agent to use. Keep credentials in the client environment and use the client-supported substitution below:

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "burp_bounty_local": {
      "type": "remote",
      "url": "http://127.0.0.1:8081/mcp",
      "enabled": true,
      "oauth": false,
      "timeout": 30000,
      "headers": {
        "X-BURPBOUNTY-LICENSE": "{env:BURPBOUNTY_LOCAL_LICENSE}"
      }
    },
    "burp_bounty_vps": {
      "type": "remote",
      "url": "https://scanner.example.test/mcp",
      "enabled": true,
      "oauth": false,
      "timeout": 30000,
      "headers": {
        "X-BURPBOUNTY-LICENSE": "{env:BURPBOUNTY_VPS_LICENSE}"
      }
    }
  }
}
```

Set each environment variable to the key configured on that server. `type: remote` describes the HTTP transport even for loopback. `timeout` is a client connection/tool-discovery setting, not the lifetime of the submitted scan. See [OpenCode's MCP configuration](https://opencode.ai/docs/mcp-servers/) and [environment substitution](https://opencode.ai/docs/config/#env-vars).

Other clients use different configuration keys. Transfer the URL, transport and header values, not an unverified JSON wrapper.

## Check access without scanning

Ask the agent to call `server_info` and `list_profiles` on each connection. This confirms the responding server and its catalogue without calling `create_scan`. Record aliases alongside results so findings remain associated with the server that produced them. See [distributed scanning](/burp-bounty-server/distributed-scanning.md) to assign work and combined budgets across all participating connections.

## Agent skills

Download the [agent skills bundle](https://github.com/BountySecurity/burpbountypro_documentation/tree/main/downloads/burp-bounty-agent-skills.zip). It contains two companion skills:

* **burp-bounty-server**: discover profiles, plan/distribute scans, handle approvals, poll progress and retrieve evidence.
* **burp-bounty-profiles**: technical help with profile formats and validation, with examples and an offline linter for exported `.bb` files. The profile creation tutorials use Pro's graphical editor.

Copy the complete skill folders, including references and scripts, to a skill directory supported by the agent client. For OpenCode, a project `.agents/skills/` or global `~/.agents/skills/` can be used; see [its skills documentation](https://opencode.ai/docs/skills/). On other clients, use their supported discovery mechanism or load the guidance explicitly.

Installing a skill does not register an MCP connection, upload the commercial profile pack or configure credentials. The authoritative inventory is always `list_profiles` on the actual server.