Install
Build Cursor Agent and load it into Burp Suite.
Source: github.com/zamdevio/burp-cursor-agent · Docs site: burp-cursor-agent.pages.dev
Requirements
| Requirement | Notes |
|---|---|
| JDK 21 | Needed to build with the included Gradle wrapper |
| Burp Suite | Community or Professional (Montoya extensions) |
| Cursor Agent CLI | The agent binary, authenticated (agent login) |
Pick a launch profile
| Burp host | Recommended profile | Notes |
|---|---|---|
| Linux / macOS | Native | agent on the same OS as Burp |
Windows + agent in WSL | WSL | Most common Windows setup |
Windows + Windows-native agent | Native (Windows) | No WSL bridge |
| Burp inside WSL | Native | Treat as Linux — do not nest another WSL profile |
Details, cwd, and resume: launch.md.
Build
From the repository root:
bash
./gradlew test shadowJarOr the helper that runs the same gate:
bash
scripts/checkLoadable artifact:
text
build/libs/burp-cursor-agent-0.1.0-all.jarHelpers (scripts/)
| Script | What it does |
|---|---|
scripts/check | ./gradlew test shadowJar (build gate) |
scripts/jar-path | Print the shadow JAR path (fails if missing) |
scripts/probe-agent | Resolve agent on PATH |
scripts/test / scripts/clean | Test only / clean |
Full list: scripts/README.md.
Load into Burp
Extensions → Installed → Add
Extension type: Java
Select
build/libs/burp-cursor-agent-0.1.0-all.jarExtension class:
textio.zamdevio.burpai.BurpaiExtensionConfirm the Suite tab Cursor Agent appears.
Do not auto-reload Burp unless you mean to — unloading the extension stops Agent processes and can interrupt in-flight chats.
First-run checklist
- CLI login — In the same environment that will run
agent acp(native shell or WSL), runagent login(or your usual Cursor Agent auth flow) and confirmagentworks. - Launch profile — Open Cursor Agent → Settings → General, pick the profile for your host (table above), and confirm Launch preview.
- Working directory — Session cwd defaults to
$HOME/BurpSuitewhen that folder exists, otherwise$HOME. Override in Settings if you hunt from a project tree. - Permissions — Default Ask is safest for first use (permissions.md).
- MCP — Prefer linking Cursor’s Burp MCP rather than reinventing tools (mcp.md).
Verify
- Open Cursor Agent.
- Start a chat (title starts as General Chat until the first prompt or Agent title takes over).
- Send a short prompt (for example:
Reply with: pong). - You should see streaming text and a live status (Starting → Streaming → Ready).
If nothing starts, see troubleshooting.md.
Next
- Chats and forks → sessions.md
- Launch / WSL / resume → launch.md
- Tool approvals → permissions.md
- MCP → mcp.md
- Docs map → README.md
- Source / issues → GitHub
- Hosted docs → burp-cursor-agent.pages.dev