burpai

Problem

LLMs are genuinely useful for security testing — explaining odd server behavior, suggesting payload variations, summarizing large responses. But the obvious workflow (copy request, paste into a chat window) can send client assessment data to a third party, which is disqualifying on many engagements.

Architecture decision

burpai is built on Burp Suite’s Montoya API in Java and supports provider choice. Local Ollama keeps model traffic on the analyst’s machine for confidentiality-sensitive work. Cloud providers are optional and should only be used when the engagement’s data-handling controls allow external processing.

The extension keeps AI assistance inside the testing workflow instead of forcing analysts to move requests and responses between Burp and a separate chat interface.

Outcome

The public, MIT-licensed repository and v1.9.0 release establish the shipped artifact. Source and release history: github.com/srinivasans13/burpai. User counts, workflow-time savings, and assessment outcomes remain impact evidence to measure rather than claims made here.