TyrusRC/praetor

Praetor

Agentic DAST orchestrator for Burp Suite.

Renamed in v1.0 from burpsuite-swiss-knife-mcp to Praetor. The GitHub repo is now github.com/TyrusRC/praetor (old URLs redirect). Python package directory unchanged this release; binary names (praetor-mcp, praetor-burp-ext-1.0.0.jar) are new. Backwards-compatible script aliases retained for one release cycle.

Praetor is a Model Context Protocol (MCP) server that turns Claude Code (or any MCP-aware LLM client) into a Burp-native agentic pentester. It exposes Burp's HTTP capabilities, scanner, sitemap, proxy history, and Collaborator, plus a knowledge-driven probe engine (128+ matchers), SAST + secrets layer (opengrep / gitleaks / trufflehog / git-dumper / Noir), an 11-agent team, and a save-finding pipeline with persistent target memory. Every request routes through Burp, so every finding is replayable from the Burp UI and citable by Logger index.

Authorized Use

This is an offensive security tool. Use only on systems where you have explicit written permission to test (bug bounty scope, signed penetration test, red team contract, internal lab). The authors are not responsible for misuse.

Architecture

LLM client  <- stdio MCP -> Python MCP server  <- HTTP -> Java Burp extension  <- Montoya API -> Burp Suite

• The Java extension exposes a REST API on 127.0.0.1:8111 and tunnels HTTP traffic