Burp Suite — agentic threat model

Not certain from the listing — the extension acts as an MCP server for external AI clients, meaning the foundation model is determined by the connecting client. Threats include prompt injection on the client model leading to unauthorized tool execution.

Not certain from the listing — there is no mention of internal vector databases or RAG pipelines. However, the agent handles sensitive HTTP request/response history (proxy data) which could be leaked if exfiltrated.

The agent exposes highly sensitive tools (Burp scanner, repeater, proxy) via the Model Context Protocol (MCP). The primary threat is tool misuse, where an attacker manipulates the agent via prompt injection to scan unauthorized targets or replay malicious requests.

The MCP server runs locally or in a designated environment to interface with Burp Suite. If un-sandboxed, an attacker exploiting the agent could perform SSRF, local network scanning, or leverage Burp's capabilities to pivot into internal networks.

Not certain from the listing — while Burp Suite itself has extensive logging (Event log, Proxy history), it is unclear if the MCP extension implements specific guardrails, input validation, or LLM-specific observability to prevent malicious payloads.

The description explicitly notes that it 'demands careful scope control' because it can send arbitrary requests. Without strict network-level scoping or user-in-the-loop confirmation, the agent poses high compliance and authorization risks.

Not certain from the listing — there is no explicit mention of multi-agent orchestration, but as an MCP tool, it could be integrated into broader agentic workflows, risking cascading tool-execution chains.