Meta Zurp AI Toolkit Connects Burp Suite With AI Coding Agents for Bug Bounty Research

Meta has introduced Zurp, an open-source toolkit that connects Burp Suite workflows with AI coding agents for approved bug bounty research.

The project is designed for vetted researchers in Meta’s bug bounty program and brings several research functions into one place, reducing the need to switch between separate tools, logins, and tokens while testing Meta-owned targets.

Zurp works as a Java extension inside Burp Suite and also offers Model Context Protocol, or MCP, servers for AI agents. This design lets a researcher inspect web traffic in Burp Suite while using the same approved Meta APIs and access token through an AI coding assistant.

The tool is intended only for data and test assets linked to the researcher’s own authorized account, which is an important boundary for safe and legal security testing.

At the center of the project is the Meta View tab. It helps researchers understand identifiers found in captured requests and responses, including URLs, GraphQL doc_id values, object IDs, and operations.

Meta Zurp AI Toolkit

In practical terms, this can reduce the time needed to identify what an unfamiliar value represents when reviewing a large volume of Facebook, Instagram, or other Meta service traffic.

Zurp includes Meta Context, FBDL, CSRF handling, and SPARTA. Meta Context explains identifiers in a request. FBDL helps researchers create and manage test accounts and assets that are allowed for use in Meta’s testing environment.

SPARTA provides leads that may help researchers identify areas needing closer review, then queues proof-of-concept work into Burp Suite Organizer.

According to documentation in the Zurp GitHub repository, each capability can be used separately, although they can also work together in a single research workflow.

One of the more useful Burp Suite features is automated handling of anti-CSRF values. Security researchers often capture a valid request, move it into Burp Repeater, and find that it fails because short-lived values have changed.

Zurp can collect values such as fb_dtsg, lsd, and CSRF tokens from browsing traffic, then replace supported placeholders before a request is sent.

This may make authorized replay testing more stable while keeping values separated by host and logged-in account. The toolkit also supports an AI-assisted path through three separate MCP servers: meta-context, fbdl, and sparta.

A compatible MCP client, such as Claude Code or Muse Code, can use those services to inspect a captured request, identify known Meta values, or work with authorized test assets. The approach reflects a wider move toward human-led AI support in application security testing.

Cyber Security News recently covered AI-powered Burp Suite extensibility, where AI functions are being added around established testing workflows rather than replacing researcher review.

Researchers can install the prebuilt zurp.jar extension in Burp Suite through the Extensions menu, then add a Meta researcher token in Zurp settings.

The project requires Burp Suite 2024.7 or later. Building the extension from source requires Java 17, while the agent-side MCP services require Node.js 22.19.0 or newer.

Access remains restricted. Zurp uses the same allowlist model as Meta’s FBDL service, and users without eligible access receive HTTP 403 responses. According to the project documentation, tokens last 60 days.

Researchers should generate tokens while signed in to the correct enrolled bug bounty account, since a token created under another account can fail authorization checks.

The project is notable because it connects manual proxy-based testing, authorized test data, and AI agent workflows without removing the human researcher from the process.

Meta’s bug bounty program paid more than $2.3 million to researchers during 2024, with roughly 600 valid reports receiving rewards from nearly 10,000 submissions. For broader context on how Burp Suite supports web testing, readers can also review Cyber Security News’ guide to web security scanners.

Researchers can access the source code and installation guidance through the Zurp GitHub repository, while Meta’s FBDL eligibility criteria outline who may use the approved testing environment.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC