Documentation · MCP · v1.0.23

How Alphacode handles
MCP servers.

Model Context Protocol servers become first-class tools inside Alphacode. Discover them, register them, and let any agent call them with the same authorization and execution guarantees as built-ins. Burp Suite is the canonical example.

See the Burp walkthrough Register a server

Alphacodethe agent

MCP servere.g. Burp Suite

Targetyour app · in-scope

transport: stdio / HTTP protocol: JSON-RPC 2.0 auth: inherited

— what is MCP?

A standard pipe between agents and tools.

The Model Context Protocol (MCP) is an open standard for connecting AI agents to external tools. Instead of every assistant inventing its own plugin format, MCP defines one JSON-RPC contract any server can speak.

Tools

Functions the agent can call. Each tool declares a name, a JSON Schema for arguments, and a description. The agent decides when to invoke them based on the user's goal.

Resources

Structured data the server exposes — files, documents, proxy history, scope lists. The agent reads them like local files, but they live behind the MCP boundary.

Prompts

Reusable prompt templates the server offers for common workflows (e.g. "replay this request", "scan for IDORs"). Agents can prefill them or surface them as slash commands.

— how Alphacode handles MCP

Four primitives. One integration.

When you connect an MCP server, Alphacode does four things and then gets out of the way. The agent uses the tools exactly like it uses built-ins.

1. Spawn

Launches the server process (stdio) or connects to its HTTP endpoint, with the env vars and args you registered. Lifecycle is managed automatically.

2. Discover

Sends tools/list, resources/list, and prompts/list. Every tool the server exposes is introspected, typed, and registered as a first-class agent tool.

3. Authorize

Authorization context is inherited from your session. No separate prompt, no extra menu. If the target is in-scope, MCP-mediated calls are in-scope.

4. Execute

Each tool call is routed over JSON-RPC. Errors flow back as tool errors. Evidence is captured the same way as native tools, with secrets redacted.

— why it matters

Burp is powerful. The agent makes it composable.

Tools become part of the workflow.

Burp Suite already does request replay, scope management, and active scanning better than anything you can build in an afternoon. But by itself it doesn't reason. It waits for you to click.

When Burp is exposed through MCP, every one of its tools is available to an Alphacode reasoning loop. The agent can fetch proxy_history, mutate a request, replay it via Intruder-style insertion points, parse the response, and decide what to test next — all in a single chain.

The same is true for any MCP server. Filesystem, Git, browser, database, Grafana, Sentry, custom internal tools. Each one becomes a verb the agent can use.

No plugin surgeryMCP is a stable, versioned protocol. Servers upgrade independently of Alphacode.

Tool calls look like tool callsThe agent treats Burp's send_http1_request the same as bash, browser, or webfetch.

Evidence captured automaticallyRequest, response, status, headers, and timing are stored alongside native tool calls.

Failures surface as failuresProxy errors, scan errors, dropped connections — all come back as tool errors the agent can debug and retry.

— Burp Suite MCP walkthrough

From zero to first scan in five steps.

Burp Suite exposes an MCP server through its extensions API. The bridge speaks JSON-RPC over stdio, so registration is one config block. After that, every Burp capability is a tool call.

Run Burp

Start Burp Suite Pro or Community. Install the MCP extension from the BApp Store.

Register the server

Add an entry to mcp_config.json under your project folder.

mcp connect burp -- java -jar burp-mcp-bridge.jar

Tools appear

Alphacode introspects the server. Burp's tools show up alongside bash, browser, and friends.

Describe the goal

Tell the agent what to find. It picks the right Burp tool, mutates requests, parses responses, and reasons through results.

You say"probe staging.example.com for IDORs on the orders endpoint"

Agent plansset_scope then loop send_http1_request with mutated ids

Burp runsReplay through proxy, capture status/body/headers, flag anomalies

Agent decides401 to 403 escalation; chain create_scan; verify with auth-bypass probe

— registering a server

One file. Three transports.

MCP servers are declared in mcp_config.json. Alphacode loads it from the project folder, then from ~/.alphacode, merging the two.

$ cat mcp_config.json
{
  "mcpServers": {
    "burp": {
      "command": "java",
      "args": ["-jar", "/opt/burp/burp-mcp-bridge.jar"],
      "env": { "BURP_API_KEY": "***" }
    },
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/srv/repos"]
    },
    "remote": {
      "url": "http://localhost:8765/mcp"
    }
  }
}

— common Burp MCP tools

What Burp exposes.

Tools you'll see after mcp connect burp. The agent picks them just like built-ins.

Tool	What it does	Typical use
`send_http1_request`	Replay or forge a single HTTP/1 request through Burp's proxy.	Mutating headers, body, cookies, auth tokens.
`send_http2_request`	Same for HTTP/2.	Testing HPACK quirks and h2c downgrades.
`get_proxy_history`	Pull captured traffic from the proxy log.	Post-session analysis, finding missed endpoints.
`define_insertion_point`	Mark positions in a request for Intruder-style payloads.	Fuzzing a header value or JSON field.
`configure_payload_processing`	Encode, prefix, or transform payloads mid-attack.	WAF bypass, case folding, double URL encoding.
`create_scan`	Kick off an active vulnerability scan.	Broad coverage after manual recon.
`get_scan_status`	Poll scan progress and findings.	Wait for completion, then triage results.
`set_scope`	Push URL scope into Burp.	Tell Burp which targets are in-bounds for the audit.

— frequently asked

Questions, answered.

Does Alphacode add a second authorization layer for MCP tools?

No. MCP-mediated calls inherit your session's authorization. If the target is in-scope per your testing context, the agent can call any tool that operates on it.

What if Burp crashes mid-session?

The agent sees the tool error, retries with backoff, and surfaces the failure in the session log. You can mcp reload to restart the server without losing the session.

Can I run multiple MCP servers at once?

Yes. Register as many as you want in mcp_config.json. Their tools merge into one namespace, with names prefixed by the server (e.g. burp.send_http1_request) when collisions occur.

Do MCP servers see my secrets?

Only the ones you pass via env or that appear in tool arguments. The agent redacts known secret patterns (bearer tokens, API keys) in logs automatically.

Are MCP tool calls recorded for evidence?

Yes. Every call captures request, response, status, headers, and timing — same as built-in tools. Evidence is written to the session log under your working directory.

Connect a server. Then tell the agent what to find.

One config block turns Burp — or any MCP server — into tools the agent can compose. No new plugin format, no second authorization flow.

Install Alphacode Read the source

How Alphacode handlesMCP servers.