Solutions
Bounty Security Solutions
From Burp Suite to your AI workflow.
Turn your testing knowledge into reusable vulnerability checks. Run them inside Burp Suite, on your own servers, or through the AI agents you already use.
Choose where the work happens
Create profiles, run local scans, and review findings with Burp Bounty Pro.
Move scan execution to Burp Bounty Server instances on your machines or VPSs.
Connect through MCP to select checks, launch scans, and retrieve evidence.
Professional tools
Two products. Choose your starting point.
Choose Pro for a testing workspace inside Burp Suite with Server included. Choose Server for standalone scanning through agents, scripts, and integrations.
Burp Bounty Pro
Your scanning workspace inside Burp Suite
Build custom vulnerability profiles without writing code, automate repeatable checks, and keep your investigation inside Burp.
- Visual profile editor: define payloads, insertion points, match conditions, and multi-step checks.
- Smart Scan rules: trigger relevant active checks from passive observations.
- Built-in AI Scanner: analyze selected traffic with your configured model and optionally launch recommended profiles.
- Local and remote execution: scan locally or distribute work across your configured Burp Bounty Servers.
- Keep your setup: saved licenses, profile locations, server connections, and AI settings survive JAR updates.
Requires Burp Suite Professional, purchased separately. Available for macOS, Linux, and Windows.
Burp Bounty Server
Scan on your servers. Control it from your AI workflow.
Run profile-based scans on your own infrastructure with a Go engine. Connect an AI agent, integrate your scripts, or use it alongside Pro.
- MCP for AI agents: discover profiles, submit scans, control execution, and retrieve findings.
- REST API: integrate scanning into your existing tools and automated workflows.
- Multiple server instances: distribute work through Pro or an agent connected to each server.
- Control scan traffic: set concurrency and request-rate limits, then pause, resume, or cancel.
- Retained findings: revisit summaries and supporting evidence within your configured storage and retention limits.
Runs independently on Linux, macOS, and Windows. No Burp Suite installation required.
Burp Bounty Pro includes Server access. Use the same Pro license for both products, with 10 registered activations shared across them for one individual user. A Server-only license covers Server.
Built around real testing tasks
Put your checks to work.
01 / REPEATABLE ASSESSMENTS
Turn a finding into a reusable check
Create a profile in Pro's graphical editor, save the payload and matching logic, and reuse it during a retest. Share exported profiles so colleagues can apply the same checks.
02 / DISTRIBUTED EXECUTION
Move scan work off your laptop
Deploy Server instances where they can reach your targets. Distribute submitted work from Pro or assign separate batches through an agent, while keeping the scan budget under control.
03 / AGENT WORKFLOWS
Give your agent a scanning engine
Let the agent select profiles and coordinate the assessment. Server executes the payloads; the agent retrieves compact findings and requests detailed evidence when it needs it.
An example task for a connected agent
Use my Burp Bounty Servers to scan these requests with the available SQLi profiles. Divide the requests without assigning the same request twice, keep the combined rate at or below 20 requests per second, and summarize the findings with evidence.
Connect each server as a separate MCP endpoint. The companion agent skills explain profile discovery, scan control, distribution, and result retrieval.
Find the right fit
Compare the professional solutions.
Both subscriptions provide Server access. Pro adds the Burp Suite extension, graphical editing, Smart Scan, and its built-in AI Scanner.
Scroll sideways to compare both products.
| Capability | Burp Bounty Pro | Burp Bounty Server |
|---|---|---|
| Best fit | Pentesting inside Burp, with remote execution when needed | Standalone scanning and agent/API automation |
| Burp Suite extension | Included | Not included |
| Graphical profile editor | Included | Run supplied or custom profile files |
| Smart Scan rules | Included in the extension | Not included |
| AI workflows | Built-in AI Scanner, plus MCP through included Server | Connect your own MCP-compatible agent |
| REST and MCP endpoints | Through included Server | Included |
| Multiple servers | Distribute work from Pro or an agent | Coordinate instances through your agent or API client |
| Scanning without Burp Suite | Through included Server | Standalone |
| Registered activations | 10 total, shared across Pro and Server | 10 Server activations |
Licenses are per individual user, not shared team seats. Each pentester needs their own license. Server infrastructure and access to your chosen AI provider or agent are configured separately. Monthly and annual plans are available on the product pages.
Build profiles visually. Reuse them across your scanners.
Pro and Server use the .bb profile format. Create profiles in Pro's graphical editor and export them for compatible Server checks. GBounty also uses this format; supported options and engine behavior can differ.
Free and open source
More tools for your security toolkit.
Explore our community projects for prompt-based analysis inside Burp Suite.
AI prompts inside Burp Suite
Bounty Prompt
Send selected HTTP requests and responses to Burp AI or Groq Cloud using reusable security prompts. Review model-assisted analysis and create issues inside Burp Suite.
Free and open source under the MIT license. AI access is configured separately.
Explore Bounty Prompt on GitHubYour next assessment
Choose the setup that fits your work.
Start with Pro for scanning and profile creation inside Burp Suite, with Server included. Start with Server for your standalone API and AI agent workflows.