Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Professional

Tools

  • Last updated: July 23, 2026

  • Read time: 2 Minutes

Burp AT has direct access to Burp's tools, with no extra setup or integrations to configure. It chooses which tools to use for each step based on what it finds as it works.

The tools

Burp AT's tooling is organized into groups. This lets it call only the part of a Burp tool it needs rather than the whole thing, and enables you to set fine-grained permissions over what Burp AT can do autonomously.

The tools are grouped as follows:

  • Scanning and auditing - crawl a site, audit requests for vulnerabilities, and pause or resume a scan, using Burp Scanner.

  • Scope and site map - add to or remove from scope, inspect the current scope, add site map entries, import API definitions, and list the issues found for a URL.

  • Requests and responses - send and replay requests, inspect requests and responses, search across your captured traffic, and compare two messages.

  • Issues - raise, inspect, edit, and delete scanner issues.

  • Custom scan checks - create, update, delete, and list custom scan checks.

  • Datasets - retrieve, search, and summarize Burp's data, such as proxy history, the site map, issues, and scan results.

  • Configuration - view, create, and edit named scan configurations.

  • Scripting - run custom or packaged skill scripts via Burp, update a saved script, and inspect a script's result.

  • Fuzzing - fuzz a request with Burp Intruder and manage payload lists.

  • Collaborator - generate Burp Collaborator payloads and poll or inspect interactions.

  • Utilities - encode, decode, or hash data, look up the Montoya API, and send messages to another Burp tool.

Controlling what Burp AT can use

Burp AT chooses which tools to use, but you control what each one is allowed to do. To manage this, go to Settings > Tools to open Tool settings, which has two tabs:

  • Enabled tools - turn individual tools on or off. Burp AT never uses a tool you've disabled, whatever autonomy mode it's in.

  • Manual mode - set each tool to Ask or Act. These per-tool permissions apply only when Burp AT is in Manual mode.

For more information on autonomy modes and how approvals work, see Configuring autonomy.