This release adds an MCP server for working with scans and issues from your preferred AI client, and makes Burp AI available to all Cloud customers.
Work with Burp Suite DAST from your AI client
Connect tools such as Claude Code, Claude Desktop, or Cursor to Burp Suite DAST using an API key. You can review sites, scans, and issues, start or cancel scans, update issue statuses, check agent capacity, and generate scan reports.
The MCP server is enabled by default, included with your subscription, and available for Cloud and self-hosted deployments. Your existing permissions still apply, and actions that make changes require confirmation.
For more information, see Connecting your AI client to the MCP server.
Turn on Burp AI for your Cloud deployment
Burp AI is no longer in limited access. If you use a Cloud deployment of Burp Suite DAST, you can now turn Burp AI on for your instance.
Burp AI stays off until you choose to use it. It stays disabled by default on every new site. You decide the sites Burp AI works on, and the issues it investigates. Turning it on and configuring it each need their own permission, so you can keep AI features to the people and sites you choose.
Once you turn it on, Burp AI investigates the issues that a scan finds, to check whether it can reproduce and exploit them. It adds its findings to the issue details, including an impact analysis and manual reproduction steps. This helps you prioritize and resolve issues faster. Burp AI can also record a login sequence for you, using credentials you provide.
Burp AI is only available on Cloud deployments of Burp Suite DAST.
For more information, see Burp AI.
To find out how PortSwigger handles the data that AI features send, see AI trust and data handling.
Map your identity provider's groups to Burp Suite DAST groups
You can now choose the SAML attribute that Burp Suite DAST uses to determine group membership, instead of being limited to a single fixed attribute. Administrators can also map each identity provider group explicitly to a local Burp Suite DAST group.
Burp Suite DAST uses these mappings instead of matching group names, so you no longer need to rename groups in your identity provider to match Burp Suite DAST. Existing groups continue to behave as they did before the upgrade. New groups are not matched until you set a mapping for them.
Renaming a group no longer changes the identity provider group that it matches. To change what a group matches, edit its mapping.
This applies to LDAP as well as SAML. For LDAP, the value that you map is the group's common name (CN).
For more information, see Creating local groups for SAML or LDAP.
Bug fixes
We've fixed the following bugs:
- Scans of GraphQL APIs configured through introspection could fail when the API returned a large introspection response.
- Deselecting an endpoint on the second or later page of a Postman collection's endpoint list returned you to the first page.