Burp Bounty Server
Burp Bounty Server
Custom Vulnerability Profiles. Distributed Scanning. Built for AI Agents.
What is Burp Bounty Server?
Burp Bounty Server is a standalone web vulnerability scanner built for automation and distributed scanning. Run it on your own machines, servers or VPSs, and control scans through AI agents using MCP, the REST API, or Burp Bounty Pro.
Use ready-to-use or custom vulnerability profiles, move scan execution off your laptop, and bring the findings back into your workflow.
Your Scanning Engine, Wherever You Need It
- Built for AI Agents: Connect an MCP-compatible agent to discover available profiles, launch targeted scans, monitor progress and retrieve findings with supporting evidence. The server handles scan execution while your agent coordinates the assessment.
- Distributed Scanning: Deploy multiple instances across your infrastructure. Add them to Burp Bounty Pro or register each one as an MCP connection, then distribute work across the servers you choose.
- Profile-Based Testing: Run active, passive and multi-step checks using reusable profiles. Select the checks relevant to your application by profile name or tag through MCP.
-
Target a Specific Parameter: Use the
$BBOUNTY$marker to select a specific request span for supported active checks. Give your agent precise instructions about what to test. - Control Your Scan Traffic: Configure request-rate and concurrency limits, monitor execution, and pause, resume or cancel scans. Adjust the workload to your infrastructure and assessment requirements.
- Retrieve Findings Later: Retain scan summaries, findings and supporting evidence with configurable storage and retention limits. Agents can request compact result lists and fetch detailed evidence when needed.
- Connect to Your Existing Workflow: Use the REST API for scripts and integrations, MCP for AI agents, or Burp Bounty Pro to launch scans and review remote findings inside Burp Suite.
Licensing: Each Server license is for one user and includes up to 10 registered activations. Burp Bounty Pro subscriptions also include Server access, with 10 activations shared across both products.
Explore the Documentation or request a trial.
Why Pentesters Choose Burp Bounty Server
Custom Vulnerability Profiles
Run ready-to-use and custom profiles for SQL injection, XSS, SSRF, SSTI, RCE and more. Choose active, passive or multi-step checks to focus testing on your application.
AI Agent Integration
Connect your AI agent through MCP to discover profiles, launch scans, track progress and retrieve findings with evidence. The server executes the tests while your agent coordinates the assessment.
Distributed Scanning
Move scan execution to your own servers and VPSs. Register multiple instances in Burp Bounty Pro or as MCP connections, and distribute work across the machines you choose.
Granular Scan Control
Set request-rate and concurrency limits, pause or resume scans, and cancel work when needed. Use the $BBOUNTY$ marker to focus supported active checks on a specific request span.
What You Get on Day One
-
A Standalone Scanning Engine
Run Burp Bounty Server on Linux, macOS or Windows. Configure your license key and start scanning from your workstation, a dedicated server or a VPS. -
Ready-to-Use Vulnerability Profiles
Load the supplied profile pack for checks covering common vulnerabilities, CVEs, technology detection and sensitive data exposure. Select relevant profiles by name or tag through MCP, or supply your own .bb files. -
MCP and REST API Access
Connect a compatible AI agent or integrate scanning into your scripts. Discover profiles through MCP, submit requests, control scans and retrieve results. Companion agent skills explain the available tools and scanning workflows. -
Findings You Can Revisit
Retain scan summaries, findings and supporting request/response evidence with configurable retention limits. Retrieve compact result lists and inspect individual findings when you or your agent need more detail.
FAQs
Get to know Burp Bounty Server before your first scan.
Do I need Burp Suite to use Burp Bounty Server?
No. Burp Bounty Server is a standalone application for Linux, macOS and Windows. You can operate it through its REST API or an MCP-compatible AI agent. You can also connect it to Burp Bounty Pro to launch scans and review findings inside Burp Suite.
Is Server included with my Burp Bounty Pro subscription?
Yes. Monthly and annual Burp Bounty Pro subscriptions include Burp Bounty Server access. Use your Pro license key to activate Server.
A standalone Burp Bounty Server subscription includes Server only and does not activate the Burp Bounty Pro extension.
How many activations does my license include?
Each license is for one individual user and includes up to 10 registered activations.
With a Pro subscription, those 10 activations are shared across Burp Bounty Pro and Burp Bounty Server. With a Server-only subscription, they apply to Server. Separate product registrations on the same machine may consume separate activations.
Each additional user needs their own license. The activation allowance does not make a license shareable across a team.
Can I distribute scans across multiple servers or VPSs?
Yes. Deploy multiple instances within your license's activation allowance, then register them in Burp Bounty Pro or as separate MCP connections in your agent.
Pro can distribute submitted work across eligible servers. An AI agent can divide tasks across its configured connections. Each server manages its own scans, limits and results.
How do I connect an AI agent?
Enable MCP on the server and register its endpoint in a client that supports Streamable HTTP and custom authentication headers. The agent can then discover profiles, launch scans, monitor progress and retrieve findings.
Companion skills explain the tools and scanning workflows. You can also use the REST API directly from scripts and integrations, without an AI agent.
Do I need to create my own vulnerability profiles?
No. The supplied profile pack provides ready-to-use checks for common vulnerabilities, CVEs, technology detection and sensitive data exposure.
You can also run custom .bb profiles, including profiles created with Burp Bounty Pro's graphical editor. Select the profiles relevant to your assessment and review the documented compatibility differences between the engines.
Can I control how much traffic a scan sends?
Yes. Configure requests per second and concurrency, and pause, resume or cancel scans when needed.
When using multiple servers, set a combined budget through Pro's overall limits or assign limits to each server through your agent. Request-rate limits are ceilings; actual throughput also depends on response times and the selected checks.
Can I retrieve findings after a scan finishes?
Yes. With result retention enabled, Server keeps scan summaries, findings and bounded request/response evidence on the server, subject to your configured storage and retention limits.
Your agent can retrieve compact finding lists and request individual evidence when needed. Retained results remain available after a server restart, but unfinished scans do not automatically resume.
Can Burp Bounty Server produce false positives?
Yes. Findings identify matches against a profile's detection conditions and should be reviewed before reporting a confirmed vulnerability.
Inspect the supporting requests and responses and validate the behavior in context. For example, a reflected payload alone does not prove that JavaScript executes in a browser.
Get Burp Bounty Pro. Server Included.
Visual Profile Editor · Smart Scan · Local & Remote Scanning
Build custom vulnerability profiles in a visual editor, run active and passive scans inside Burp Suite, and use Smart Scan rules to launch targeted checks from passive findings.
Your Pro subscription also includes Burp Bounty Server. Distribute scans across your servers and VPSs, review remote findings in Burp, or use Server independently through REST and MCP.
Licensed per user, with 10 activations shared across Pro and Server. The Pro extension requires Burp Suite Professional, sold separately.
