# Burp Suite MCP — WSL Setup (direct, no REST)

BURP_MCP_SETUP.md

Burp Suite MCP — WSL Setup (direct, no REST)

Why this works

WSL2 has a separate network stack from Windows. Burp's MCP server binds to Windows 127.0.0.1:9876 and rejects non-loopback connections (403). The fix is to run the Burp MCP proxy JAR natively on Windows via cmd.exe, so its outbound connection uses Windows loopback. Stdio is bridged back to Claude Code in WSL through cmd.exe.

Reference: https://medium.com/@suyogpatil1810/burp-suite-mcp-server-wont-connect-from-wsl-here-s-the-fix-nobody-talks-about-1a5fdd9994e7

Prereqs

• Burp Suite running on Windows; MCP tab → Enabled (Started MCP server on 127.0.0.1:9876).
• Java 21+ on Windows PATH (cmd.exe /c "java --version" works).
• mcp-proxy.jar at a Windows path. This project uses E:\Burp-mcp\mcp-proxy.jar.

Active config — .mcp.json

{
  "mcpServers": {
    "burp": {
      "command": "cmd.exe",
      "args": ["/c", "java -jar E:\\Burp-mcp\\mcp-proxy.jar --sse-url http://127.0.0.1:9876"]
    }
  }
}

Verify manually

cd /tmp && (printf '%s\n' \
  '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"v","version":"1"}}}' \
  '{"jsonrpc":"2.0","method":"notifications/initialized"}' \
  '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 3) \
  | timeout 7 cmd.exe /c "java -jar E:\Burp-mcp\mcp-proxy.jar --sse-url http://127.0.0.1:9876"

Expect serverInfo: burp-suite v1.1.2 and 24 tools.

Activate in Claude Code

Restart the session (or /mcp → reconnect burp). Tools appear as mcp__burp__send_http1_request, mcp__burp__get_proxy_http_history, etc.

What was removed

• Old Node REST client moved to mcp/burp-mcp-client.disabled.rest/ (used BURP_API_URL=http://172.27.192.1:1337). Not used anymore.

Troubleshooting

• Connection refused from WSL on 127.0.0.1:9876 is expected — Burp is on Windows.
• Do not use netsh portproxy or the host IP — Burp's MCP rejects non-loopback (403).
• If cmd.exe warns "UNC paths are not supported", it's harmless; the JAR still launches.