Release and migration notes

Catch up on renamed products, current workflows and compatibility notes.

Documentation edition: 4 October 2026

This edition consolidates the current working implementations. It is not a claim that every feature was first released under a particular public version number. Check Pro's About tab and Server's server_info.version / engine_version independently.

Product and path names

• Burp Bounty Server replaces the former server product name in executable/client guidance.

• Client authentication uses X-BURPBOUNTY-LICENSE and startup uses BURPBOUNTY_LICENSE_KEY.

• The pack is BurpBountyData. Update saved paths after renaming an older BurpBountyData_3.0 directory.

• Pro's Settings tab contains Burp Bounty Servers.

• Right-click choices are Local Scanner and Burp Bounty Server Scanner.

Pro workflow updates

Local Active uses concurrency and RPS with derived worker counts. Scan planning, budgets, service preservation, lifecycle controls and remote result ingestion have been revised. Local partial execution failures display Incomplete when some requests completed. Remote terminal entries carry end times, and missing Collaborator support no longer changes the displayed label to Finished (incomplete).

Remote passive findings feed both Burp issues and Scanners → Passive. Controls target the server owning the scan ID, with reconnection/reconciliation for temporary failures. Use the current complete JAR for the Apple Silicon JNA licensing bootstrap.

Server and MCP

REST remains available when MCP is enabled. The Streamable HTTP /mcp interface supports catalogue discovery, explicit HTTP services, supplied passive exchanges, validated profile selection, lifecycle controls, compact status, paginated findings and individual evidence retrieval.

Persistent findings have bounded retention and storage, with explicit differences between MCP and REST defaults. Pending approvals expire and are bounded. MCP destination checks use the service origin. The approval routes intentionally share the license credential and do not provide separate operator authorization.

$BBOUNTY$ selects one exclusive request span for Server active scanning. Startup validates an explicitly supplied catalogue directory. Debug controls routine diagnostics; shutdown handles MCP connections. No notification is shown merely because there is no published compatible update.

Documentation corrections

Profile creation is documented through Pro's graphical editor: named controls, steps, saving with OK and distributing the generated .bb file. JSON fields and IDs are retained as an exported-file reference for integrations.

MatchType values, insertion IDs, typed grep columns, time units, showIssue behavior and rule serialization now follow the source. Compatibility notes document remaining engine differences. The reviewed pack inventory separates total profiles from enabled profiles and records missing rule dependencies.

Earlier Pro features retained

The extension continues to provide the AI Scanner and provider configuration introduced in earlier versions, dedicated Active/Passive/Smart/AI/Live views, tag-based scanning, multi-step profile editing, variables and Smart Scan automation. Use the current guides for names and behavior rather than older screenshots or unverified JSON examples.