Meta Zurp Toolkit Integrates AI Agents with Burp Suite for Bug Bounty Research
Meta has released Zurp, an open-source toolkit that connects Burp Suite with AI coding agents to streamline bug bounty research for vetted researchers.
Meta has introduced Zurp, an open-source toolkit designed to bridge the gap between Burp Suite's powerful web traffic analysis capabilities and the burgeoning potential of AI coding agents. This innovative tool is specifically tailored for vetted researchers participating in Meta's bug bounty program, aiming to consolidate multiple research functions into a single, cohesive workflow. By integrating directly into Burp Suite as a Java extension and supporting Model Context Protocol (MCP) servers for AI agents, Zurp allows researchers to inspect web traffic while simultaneously leveraging approved Meta APIs and access tokens through AI assistants.
The core functionality of Zurp revolves around enhancing the efficiency and effectiveness of security testing on Meta-owned targets. It is strictly intended for use with data and test assets associated with the researcher's own authorized account, ensuring that all testing remains within legal and ethical boundaries. A key feature is the 'Meta View' tab within Burp Suite, which assists researchers in deciphering identifiers found in captured requests and responses. This includes crucial elements like URLs, GraphQL doc_id values, object IDs, and operations, significantly reducing the time spent manually identifying unfamiliar values within large volumes of traffic from services like Facebook and Instagram.
Beyond identifier analysis, Zurp incorporates several other specialized modules. 'Meta Context' provides explanations for request identifiers, while 'FBDL' (Facebook Data Library) aids in the creation and management of test accounts and assets permitted within Meta's testing environment. The 'SPARTA' module offers leads for areas requiring closer scrutiny and can queue proof-of-concept work into Burp Suite's Organizer. While each capability can be used independently, they are designed to work synergistically within a unified research workflow.
A particularly valuable feature for security testers is Zurp's automated handling of anti-CSRF tokens. Security researchers often encounter issues where requests fail in tools like Burp Repeater due to the expiration of short-lived values. Zurp addresses this by collecting common anti-CSRF tokens such as fb_dtsg and lsd from browsing traffic and automatically replacing supported placeholders before a request is sent. This capability enhances the stability of authorized replay testing by ensuring that these critical values remain valid and are correctly separated by host and logged-in account.
The toolkit also extends its AI integration through three separate MCP servers: meta-context, fbdl, and sparta. Compatible MCP clients, including popular options like Claude Code and Muse Code, can utilize these services to analyze captured requests, identify known Meta-specific values, or interact with authorized test assets. This approach aligns with a broader industry trend of augmenting human-led security testing with AI support, rather than aiming to replace human expertise entirely.
Installation of the Zurp extension requires Burp Suite version 2024.7 or later. The prebuilt zurp.jar can be installed via Burp Suite's Extensions menu, followed by configuring a Meta researcher token in the Zurp settings. Building the extension from source necessitates Java 17, and the agent-side MCP services require Node.js 22.19.0 or newer. Access to Zurp is restricted, employing the same allowlist model as Meta's FBDL service, with unauthorized users receiving HTTP 403 responses. Tokens are valid for 60 days and must be generated under the correct enrolled bug bounty account to ensure proper authorization.
The significance of Zurp lies in its seamless integration of manual proxy-based testing, authorized test data management, and AI agent workflows, all while keeping the human researcher firmly in control. This holistic approach promises to accelerate the bug bounty process for Meta's program, which has historically rewarded researchers generously, paying out over $2.3 million in 2024 for approximately 600 valid reports. The open-source nature of Zurp, available via its GitHub repository, further encourages community engagement and development in this evolving area of security research.