> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/burp-bounty-server/overview.md).

# Overview

Run profile-based scans on your own machines, with REST and optional MCP.

Burp Bounty Server runs profile-based web scanning outside Burp Suite. Install it on a workstation, server or VPS and control it through the REST API, Burp Bounty Pro or an MCP-capable agent.

**1.0.0** is the first commercial release under the Burp Bounty Server name. For migration from earlier development builds, see the [release and migration notes](/changelog.md).

## How it fits together

```mermaid
flowchart TD
    pro["Burp Bounty Pro"] -->|REST| server["Burp Bounty Server"]
    api["REST client"] -->|REST| server
    agent["AI agent"] -->|"MCP enabled"| server
    server --> engine["Profile execution"]
    engine --> results["Progress and findings"]
    results --> history["Optional retained history"]
```

## Interfaces

| Interface            | Availability                                                | Profile input                                  |
| -------------------- | ----------------------------------------------------------- | ---------------------------------------------- |
| REST                 | Always enabled on the main HTTP listener                    | Uploaded `.bb` profiles and exchanges.         |
| Pro's Server Scanner | REST client built into Pro                                  | Pro uploads the enabled selection.             |
| MCP                  | Add `--mcp`; endpoint `/mcp` on the same listener           | Catalogue names/tags or supplied profile JSON. |
| Metrics              | Separate monitoring listener, loopback port 8082 by default | No scan submission.                            |

The service does not provide a browser-based scan dashboard. Its MCP is **Streamable HTTP**, not a legacy SSE-only endpoint or a STDIO process. Streamable HTTP can use SSE responses internally; select **HTTP** in a client that offers stdio/http/sse.

## Independent workers

Deploy as many instances as you need and register each one in Burp Bounty Pro, as an MCP connection in your agent, or both. There is no fixed two-server topology. Each installation has its own catalogue, scan IDs, budgets and retained history. Pro distributes a submitted batch; an agent can explicitly divide work across its MCP connections. See [scanning with multiple servers](/burp-bounty-server/distributed-scanning.md) for either workflow. There is no automatic server-to-server scheduler, shared history or live scan migration.

Each license belongs to one individual user and permits 10 registered activations. A Pro license shares those activations between Pro and Server. See [users, products and activations](/licensing.md) when planning deployments.

## What it retains

When requested, Server keeps compact scan metadata, finding summaries and bounded finding evidence. It does not persist a replayable queue of every probe. See [results and retention](/burp-bounty-server/results-and-retention.md).

For existing deployments, jump to [Pro integration](/burp-bounty-pro/remote-scanning.md) or the [REST reference](/burp-bounty-server/rest-api.md).

## Keep exploring

<table data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Start the server</strong></td><td>Choose a binary, configure licensing and verify access.</td><td><a href="/burp-bounty-server/installation.md">Installation and first start</a></td></tr><tr><td><strong>Connect an agent</strong></td><td>Configure the HTTP endpoint and discover profiles.</td><td><a href="/burp-bounty-server/mcp-setup.md">Connect an MCP client</a></td></tr></tbody></table>