The Problem

Burp Suite's MCP extension is powerful — but its responses are enormous.
A single get_proxy_http_history call with 50 items returns 185 KB of raw HTTP wire format.
That's ~46,000 tokens. Per call. For data you mostly don't need.

At that rate, your context window fills up after a few exchanges, and you're restarting sessions before finishing the job.

The Solution

BTK sits between Claude Code and Burp, intercepting every response and compressing it before it reaches your context window.

Claude Code ──stdin──▶ BTK ──POST──▶ Burp MCP
                         ◀──SSE──────────────
                         │
                    normalize
                    lossless strip
                    group & summarize   ──▶ Claude Code
                    truncate bodies

No changes to your Burp setup. No changes to how Claude uses tools.
BTK is a drop-in replacement for the Burp MCP URL in your Claude config.

Benchmark

Real measurements. Same Burp instance. Same proxy history. Both sides measured directly.

Scanner issues achieve 823× because the grouper collapses repeated issue types into a single summary line.

How Compression Works

Three layers, all lossless at the information level:

1 — Lossless strip
Removes empty fields, null headers, redundant metadata. Nothing useful is lost.

2 — Grouper summary
GET /api/users appearing 50 times with status 200 becomes one line:

GET /api/users (x50) — 200:50

The full data is cached in a snapshot. Claude expands any path on demand with btk_detail.

3 — Body truncation
Response bodies over 2000 chars are trimmed. Binary responses (images, fonts) are replaced with [image/png, 4321B]. Configurable.

Synthetic Tools

BTK injects two extra tools into tools/list that Claude can use to navigate compressed data:

Usage with RTK

BTK pairs naturally with RTK (Real Token Killer) — the CLI proxy that compresses git, cargo, npm, and other dev tool output before it reaches your LLM.

Together they cover the two sides of a security workflow:

┌──────────────────────────────────────────────────────┐
│                  Claude Code session                  │
├──────────────────────┬───────────────────────────────┤
│    Dev operations    │      Burp operations           │
│  git, cargo, files   │  proxy history, scanner,       │
│                      │  repeater, collaborator        │
│       RTK            │          BTK                   │
│  60-90% savings      │      97-99% savings            │
└──────────────────────┴───────────────────────────────┘

A full pentest session — recon, active scanning, manual testing, reporting — without burning through your context window.

Installation

Arch Linux (AUR):

yay -S btk-bin

Via Cargo:

cargo install --git https://github.com/cbxcvl/BTK

Or build from source:

git clone https://github.com/cbxcvl/BTK
cd BTK
cargo build --release
./target/release/btk --help

Configuration

Claude Code (~/.claude/settings.json)

Replace your existing Burp MCP server entry:

{
  "mcpServers": {
    "burp": {
      "command": "/path/to/btk",
      "args": ["--burp-url", "http://127.0.0.1:9876"]
    }
  }
}

Options

--burp-url <URL>         Burp MCP endpoint (default: http://127.0.0.1:9876)
--body-max-chars <N>     Max response body chars before truncation (default: 2000)
--tools <names>          Comma-separated allowlist of Burp tools to expose
--tools-config <path>    TOML file with tool descriptions and allowlist

Optional TOML config

[tools]
allow = ["send_http1_request", "get_proxy_http_history", "get_scanner_issues"]

[tool.send_http1_request]
description = "My custom description"

What Claude Can Do With BTK

Every Burp tool works. Tested against a live Burp Pro instance:

Example Session

Claude: I'll check the proxy history for authentication endpoints.

[calls get_proxy_http_history(count=50)]

BTK proxy history snapshot ph_a3f8 (50 items):
  POST /api/login (x12) — 200:8, 401:4
  GET /api/profile (x30) — 200:28, 403:2
  POST /api/password-reset (x4) — 200:4
  GET /api/admin (x4) — 403:4
Use btk_detail(snapshot="ph_a3f8", path="<METHOD /path>") to expand.

Claude: I see 4 login attempts returning 401. Let me expand those.

[calls btk_detail(snapshot="ph_a3f8", path="POST /api/login")]

Returns: full request/response for the 4 failed logins, with headers and bodies.

Claude: The 401 responses don't have account lockout — username enumeration is possible.
        I'll send a test to Repeater.

[calls create_repeater_tab(...)]

Total context used for 50-item history analysis: ~4 KB instead of ~185 KB.

Architecture

src/
├── main.rs           — entry point, arg parsing
├── proxy.rs          — task orchestration (SSE + stdin tasks)
├── sse_task.rs       — SSE stream reader, compression pipeline
├── stdin_task.rs     — stdin reader, request forwarding
├── normalizer.rs     — Burp content[0].text → result.items
├── http_parse.rs     — raw HTTP wire format parser
├── lossless.rs       — field stripping (headers, cookies, empty fields)
├── grouper.rs        — history/scanner summary with snapshot cache
├── body_truncate.rs  — body size limiting, binary detection, HTML extraction
├── compressor.rs     — tool description compression for tools/list
├── synthetic.rs      — btk_detail / btk_next_page tool handlers
├── snapshot_cache.rs — in-memory TTL cache for compressed snapshots
└── config.rs         — CLI config, TOML loading

Requirements

• Rust 1.75+
• Burp Suite Pro with the MCP extension installed and running
• Claude Code

Acknowledgments

BTK exists because of RTK (Real Token Killer) by @rtk-ai.

Seeing RTK compress dev tool output before it hits the LLM made the solution obvious — the same idea needed to exist for Burp Suite. BTK is that extension.

License

MIT