Burp Bounty Pro 4.0.0: From Burp Suite to Your Servers and AI Agents

Build your checks in Burp Suite. Run them locally or on your own servers. Connect an AI agent when it fits your workflow.

Burp Bounty Pro 4.0.0 brings these workflows together. Your Pro subscription now includes Burp Bounty Server, with remote scanning integrated into the extension and a standalone REST API and MCP interface for automation.

This release also addresses the everyday experience of running scans: simpler performance controls, more efficient local execution, clearer remote results, and saved settings that survive JAR updates. You can keep building and reviewing checks in Burp while choosing where the scanning work happens.

Burp Bounty Server is now part of Pro

Your laptop is often doing several jobs during an engagement: running Burp, capturing traffic, holding a browser session, and supporting manual testing. With 4.0.0, you can move scanning work to a separate machine while continuing to investigate findings in Burp.

Add your instances under Settings > Burp Bounty Servers. Then, from the right-click menu, choose Local Scanner or Burp Bounty Server Scanner. The remote workflow sends the selected requests, profiles, and custom variables to Server and brings findings back into the extension and Burp Suite.

Active and passive remote findings appear in their corresponding scanner views, with domain totals and severity counts in the Dashboard. You can inspect the supporting requests and responses alongside the rest of your testing work.

The remote scanning workflow previously associated with Burp Bounty Go is now integrated into Pro. Burp Bounty Server is the standalone companion: it can run independently of Burp Suite, and your Pro license also activates it.

Distribute work across your infrastructure

Configure multiple Server instances on workstations, dedicated machines, or VPSs. Pro can distribute scan batches across the selected healthy servers, with request-rate and concurrency budgets to control the workload.

For example, you might keep one instance near an internal application and use another for an external staging environment. Select servers with the right network access for each target, and set limits appropriate to the engagement.

The workflow supports multiple instances within your license's activation allowance. Remote pause, resume, cancellation, and recovery after temporary connection loss have also been improved, so managing a batch remains practical once it has left your laptop.

Pro connects through Server's REST API. Enable MCP when you also want an AI agent to use that server; both interfaces can run together.

Give your AI agent a scanning engine

Burp Bounty Server exposes its scanning workflow through MCP, the Model Context Protocol. A compatible agent can inspect the available profile catalogue, select checks by name or tag, launch scans, monitor progress, and retrieve the evidence behind a finding.

The included agent skills explain how to use the tools and work with profiles. Once your server and agent are configured, a task can be as specific as this:

Use the request I provide for our authorized staging application. List the available SQLi profiles, then scan only the id parameter at 5 requests per second and concurrency 1. Summarize the findings and retrieve the evidence for anything that needs manual verification.

Server supports selecting a single insertion point using $BBOUNTY$ markers. Register multiple Server instances with the agent to assign different targets or batches to different machines. You define the scope and limits; the agent uses the available tools to carry out the task.

The scanning engine executes the repeated HTTP work. The agent can request compact progress updates, paginated finding summaries, and detailed evidence only when needed. This can keep the conversation smaller than passing every request and response through the model; actual token usage depends on how the agent uses those tools.

With result retention enabled, findings remain available after the scan ends and across Server restarts, subject to the configured retention period and disk limits. An agent can return later to review a finding without repeating the scan.

Profile-based scanning works without AI. MCP uses your chosen agent and provider, while Pro's optional AI Scanner remains a separate feature inside the extension.

A more efficient local scanner

Local scanning remains useful when you want to work directly inside Burp. In 4.0.0, we have reduced the overhead around executing and displaying those scans.

Payload tasks are prepared as needed, worker pools are reused with bounded queues, and repeated matching work is reduced. Batch preparation runs away from the interface thread, while progress refreshes are grouped to avoid updating the UI for every small change.

Manual active scans now expose two main performance controls:

• Concurrency: the maximum number of requests in flight.
• Requests per second: the request-rate ceiling.

The manual Local Active and Server Scanner dialogs start at concurrency 5 and 10 requests per second. Adjust these to your target and testing conditions. Actual throughput depends on response times, network conditions, and available resources.

For larger batches, moving scans to Server also moves their execution off Burp's JVM. Pro still handles coordination and displays results, so you retain the workflow while reducing the scanning work performed on your workstation.

Update the JAR. Keep your setup.

Version 4.0.0 stores configuration in a per-user location independent of the JAR's name and path. When you retain that saved data, replacing the extension preserves your license and activation information, profiles location, configured servers, custom variables, and saved AI provider settings.

Existing preferences and recognized legacy license files can be imported. On a new installation, Pro can detect the supplied BurpBountyData pack beside the JAR and copy it into user storage. Previously configured data directories take precedence.

This works across Windows, macOS, and Linux. If your environment restricts write permissions, Settings > Storage lets you choose a writable location. The result is a more predictable upgrade process for both individual testers and managed workstations.

Keep building on your existing profiles

The visual profile editor, Smart Scan rules, multi-step checks, time-based matching, and global variables remain central to Pro. These capabilities were already part of the product; 4.0.0 builds on them with corrections to matching, payload preparation, cookie reuse, and rule evaluation.

Create a check in the graphical editor, export it as a .bb file, and reuse it in Pro or Server where the required features are supported. Teams can maintain a shared collection of checks for their applications and testing methodology.

Both engines share the profile format, with documented differences in execution and supported features. For example, remote scans need their own blind-host configuration where a profile requires it; Burp's Collaborator configuration is not automatically inherited by Server.

Findings include evidence from the profile's match conditions. Review that evidence and verify impact as part of your normal testing process.

A practical way to try 4.0.0

1. Start with a familiar request. Run a small set of relevant profiles locally and review the evidence in Burp.
2. Add a Server instance. Configure its connection, select Burp Bounty Server Scanner, and run a batch against an authorized target.
3. Try an agent-driven task. Enable MCP, install the supplied usage skill in a compatible agent, and ask it to select profiles and retrieve findings.
4. Build a reusable check. Adapt a profile to a behavior you encounter during an engagement and keep it for future testing.

Upgrading and licensing

Keep a copy of your previous JAR and back up your profiles and user configuration. Unload the old extension, load the complete 4.0.0 release JAR, and check your profile directory and server connections before starting a larger scan.

Pro expects the base BurpBountyData folder, containing both profiles and rules. Server's --profiles-dir option points directly to the profiles subdirectory. Use the current Server release alongside Pro 4.0.0.

Burp Bounty Pro requires Burp Suite Professional, purchased separately. A valid Pro subscription includes Server access and provides 10 registered activations in total, shared across both products, for one individual user. Each team member needs their own license.

Server is also available separately for standalone REST and MCP workflows. Hosting and external AI services are configured and paid for separately.

Explore the documentation, read the full changelog, or contact us with questions about your setup.