Burp Suite deep testing (GUI + MCP)

When it applies

You're web/API testing an in-scope target (tradecraft-scope-roe; load web-testing-checklist or api-testing-checklist as the coverage map) and need the core manual-testing platform: intercept, modify/replay, targeted enumeration, OOB detection, or an active scan. Burp is name-dropped across many skills as "send it to Repeater" — this one is how to operate it, including agent-driven operation through an MCP extension so the AI can read proxy history and fire Intruder itself.

Why it works

Every request the browser makes flows through Burp's proxy into a searchable history; Repeater gives byte-exact replay, Intruder turns one request into a thousand enumerated variants, Collaborator provides OOB callbacks that prove blind bugs, and the MCP extensions expose all of it as tools — so an agent can triage hundreds of captured requests and only escalate the interesting ones.