BurpAI brings the power of multi-model AI to your security testing workflow. Analyze HTTP requests in real-time and identify vulnerabilities with enterprise-grade AI models.
✨ Features
Multi-Model AI
11 AI models with automatic failover. Switch between Kimi, DeepSeek, GLM, Qwen, LLaMA, and more.
Real-Time Analysis
Background threading—zero UI lag. Analyze requests instantly without blocking your workflow.
Smart Detection
Priority detection for P1/P2 vulnerabilities: RCE, IDOR, SQLi, Auth bypass, and more.
Native Repeater
Built-in request/response editing with Burp's native editors. Full control in one place.
Request History
Automatic tracking of 1000+ requests. Never lose context on your security tests.
Interactive Chat
Custom prompts for targeted analysis. Ask the AI security expert any question.
🚀 Quick Start
1. Get API Key
Sign up for DigitalOcean AI and create an API key.
2. Load Extension
Burp Suite → Extensions → Add → Select burpaai.py
3. Configure
Enter your DigitalOcean API key in the BurpAI tab → Click Save
4. Analyze
Load any request in Repeater → Click Analyze with AI → Review results
🧠 Supported Models
Automatic failover across 11 enterprise-grade AI models:
📋 Requirements
| Requirement | Details |
|---|---|
| Burp Suite | Pro or Community Edition (latest) |
| API Key | DigitalOcean AI (free tier available) |
| Java | 8+ (included with Burp) |
| Network | HTTPS outbound to AI API |
🛡️ Security First
BurpAI is built with security as a core principle:
✅ HTTPS-only API communication
✅ No telemetry or tracking
✅ Local-only data storage
✅ User-managed API keys
✅ Open-source for transparency
🐛 Report Security Vulnerabilities
Found an issue? Use GitHub Security Advisory to report privately.
📥 Download
Get the latest version from GitHub:
License: Apache 2.0 | Status: Production Ready