Skip to content

CHANGELOG.md

Latest commit

 

History

History
93 lines (64 loc) · 5.98 KB

CHANGELOG.md

File metadata and controls

93 lines (64 loc) · 5.98 KB
Raw

Changelog

2.0.0 - 2026-04-15

Major release: fix bug critici dove tool MCP fingevano di funzionare + nuovi tool BCheck/proxy/auth.

Breaking changes (behavioral)

  • proxy_match_replace: era no-op stub, ora applica regex match/replace runtime al traffico proxied via MatchReplaceInterceptor.
  • proxy_websocket_history: era stub vuoto, ora ritorna messaggi WebSocket reali da api.proxy().webSocketHistory().
  • collaborator_poll.payload_id: ora ritorna il local UUID generato da collaborator_generate (era interaction.id() raw, non correlato).
  • scanner.active_scan config_id: ora applicato al task tracking (era ignorato silenziosamente).
  • cookie_jar action=remove/clear: ora rimuove davvero i cookie (workaround via expiration ZonedDateTime past). Era no-op che ritornava "remove_requested".

Breaking changes (signature)

  • proxy_match_replace: nuova signature (action, pattern, replacement, location, scope_regex, rule_id). action ora REQUIRED (add, remove, toggle, list, clear).
  • proxy_websocket_history: aggiunto parametro opzionale direction (filtro CLIENT_TO_SERVER/SERVER_TO_CLIENT).
  • cookie_jar: aggiunto parametro name per remove specifico.
  • session_macro/session_rules: docstring aggiornata - ora dichiara esplicitamente "config-only, runtime execution deferred to v2.1".

Added

  • bcheck tool consolidato (azioni: load, load_file, list, validate) usa api.scanner().bChecks().importBCheck().
  • send_via_proxy tool: invia HTTP request VIA Burp proxy 127.0.0.1:8080 cosi' la request appare in proxy_history (a differenza di send_request che usa Montoya HTTP client e bypassa il proxy).
  • helper_login tool: login programmatico composite. Invia request via proxy, estrae token da Set-Cookie / response body regex, setta cookies in cookie jar.
  • audit_after_crawl tool: triggera la fase audit dopo che un active_scan crawl_first=true ha completato il crawl.
  • Endpoint POST /scanner/audit-after-crawl per chain manuale crawl -> audit.

Fixed

  • Scanner crawl_first=true: ora chiama api.scanner().startCrawl() poi startAudit separato (era doppia chiamata startAudit dimenticando il crawl).
  • Scanner issues: include evidence array con request/response in base64 + URL/method/status_code + flag in_scope. Era output minimale senza i payload effettivi.
  • Python client (client.py): retry transport-level 3x via httpx.AsyncHTTPTransport(retries=3), timeout per-call configurabile, propagazione body response negli errori HTTP (era solo status code).
  • BURP_DEBUG env var per logging request/response a stderr.
  • extension_list: ora ritorna info reali di BurpMCP self via api.extension().filename() + dichiara esplicitamente la limitazione Montoya (no installedExtensions() API).
  • Stringhe "placeholder"/"API does not support" rimosse o sostituite con limitazioni documentate dove l'API Montoya e' davvero mancante.

Deferred to v2.1

  • Session macros/rules runtime execution: implementazione MacroExecutor + RuleInterceptor rimandata. Rischio recursion loop (rule che triggera macro che invoca request che ri-triggera rule) richiede ThreadLocal bypass + thread-safety analysis approfondita. Per ora i tool sono CRUD config-only, docstring esplicito. Workaround per auth: usa helper_login.
  • project_config import/export: payload JSON troppo grande per essere utile via MCP context. Da valutare con paging selettivo.
  • load_extension: API api.extensions().loadExtension(Path, ExtensionType) non esiste in Montoya 2025.5.
  • Match/replace response-side: solo request-side in v2.0 (90% use case). Aggiungere RESPONSE_HEADER/RESPONSE_BODY location se serve.

Limiti documentati (non fixabili senza Montoya update)

  • extension_list enumeration: api.extension().installedExtensions() non esiste. Solo BurpMCP self info disponibile.
  • BCheck unload: nessuna unregisterBCheck API. BCheck caricati restano attivi fino a Burp reload.
  • Scanner speed presets: solo LEGACY_ACTIVE_AUDIT_CHECKS esposto. Speed/concurrency sono metadata-only.
  • Scanner rate_limit runtime: non wired (Audit.setMaxConcurrentRequests non esiste).
  • send_via_proxy localhost target: richiede NO_PROXY=localhost env var manuale (Burp processa tutto incluso self-loop).

Tool count

  • v1.0.0: 58 tool MCP
  • v2.0.0: 61 tool MCP (+4 new: bcheck, send_via_proxy, helper_login, audit_after_crawl; -1 removed: websocket_send stub)

Removed

  • websocket_send: era stub completo (Java handler + Python tool ritornavano placeholder senza fare nulla). Per WebSocket frames usare send_raw_request con costruzione manuale del frame, oppure attendere v2.1 per implementazione client WebSocket reale.

Files changed

Java extension:

  • New: proxy/MatchReplaceInterceptor.java, handlers/BCheckHandler.java
  • Modified: BurpMcpExtension.java, handlers/ProxyHandler.java, handlers/SessionHandler.java, handlers/ScannerHandler.java, handlers/CollaboratorHandler.java, handlers/ExtensionHandler.java, build.gradle

Python server:

  • New: tools/bcheck.py, tools/helpers.py, tests/conftest.py, tests/test_v2_fixes.py, tests/test_smoke_all_tools.py, tests/test_tool_signatures.py
  • Modified: client.py, config.py, server.py, tools/traffic.py, tools/session.py, tools/scanning.py, tools/testing.py, tools/collaborator.py, pyproject.toml

Docs: this CHANGELOG.md (new).

Verification checklist

After build + reload:

  1. Burp Output tab: [BurpMCP] API server started on 127.0.0.1:8089 + Extension loaded successfully
  2. pytest server/tests/ -v (with Burp live): all signature + smoke tests pass.
  3. mcp__burp__proxy_match_replace action=add ... + curl via proxy: traffic actually modified.
  4. Manual hunting session 10min: no tool returns fake "success" without effect.

Technical environment

  • Montoya API 2025.5
  • Java 21, Gradle
  • FastMCP stdio Python (mcp >= 1.0.0)
  • httpx >= 0.27.0 (transport retries)

1.0.0 - 2026-03-29

Initial release: 58 MCP tools, BurpMCP extension + Python server.