{
 "schema_version": 1,
 "generated": "2026-10-23",
 "id": "aaravshah1311-agent-2--authorized-web-security-scan",
 "repo": "aaravshah1311/Agent-2",
 "repo_url": "https://github.com/aaravshah1311/Agent-2",
 "repo_slug": "aaravshah1311-agent-2",
 "title": "Drive Burp or ZAP scans from the agent",
 "page_title": "How to drive Burp or ZAP scans from the agent with Agent 2",
 "summary": "Let the agent work through Burp Suite or OWASP ZAP on a target you are allowed to test.",
 "who": "A security tester with written authorization for a web application who wants help triaging proxy and scanner output.",
 "problem": "Running a proxy scanner by hand and summarizing its findings takes a lot of repetitive clicking and note taking.",
 "outcome": "A short list of findings from Burp or ZAP, gathered and summarized by the agent during an authorized test.",
 "steps": [
  "Install and open Burp Suite or OWASP ZAP on the same machine (inferred).",
  "Connect the matching MCP bridge: Burp Suite on :9876 over SSE, or OWASP ZAP on :8282 over streamable HTTP. Both bridges auto-connect off, so connect them yourself (inferred: exact connect steps).",
  "Run `python run.py --cli` or `python run.py --web` from the Agent 2 folder.",
  "Ask the agent to run its Burp or ZAP tools against the in-scope target and list findings by severity.",
  "Check each finding in the scanner's own interface before reporting it."
 ],
 "agent_prompt": "Use the Agent-2 repo at <path-to-agent2> with the Burp Suite MCP bridge to review <authorized-target-url> for issues. Expected output: a list of findings with severity and the request that produced each one. Verify that every finding is reproducible in Burp before you report it.",
 "agents": [
  "any"
 ],
 "difficulty": "Advanced",
 "time": "1 hour",
 "basis": "readme",
 "caveat": "The README names Burp and ZAP bridges but does not document the setup steps, so confirm the bridge is connected before trusting any agent result.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "python",
 "requirements": [
  "Python 3.9 or newer",
  "A free Gemini API key from aistudio.google.com/apikey",
  "A local project folder you want the agent to work in",
  "For the security use case: Burp Suite or OWASP ZAP installed, and written permission to test the target"
 ],
 "risk": "dual-use",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "remote-script",
   "notice": "The agent can run commands and send traffic through your scanners, so only test systems you have written authorization to test."
  }
 ],
 "best": false,
 "score": 0.8,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/aaravshah1311-agent-2/authorized-web-security-scan/",
 "md": "https://dedupedai.com/use-cases/aaravshah1311-agent-2/authorized-web-security-scan/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/aaravshah1311-agent-2--authorized-web-security-scan.json",
 "api_version": "v1"
}