DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to drive Burp or ZAP scans from the agent with Agent 2

Let the agent work through Burp Suite or OWASP ZAP on a target you are allowed to test.

Authorization notice. Agent 2 is dual-use. Only use it on software, sites and systems you own or have explicit permission to test.

Remote script. The agent can run commands and send traffic through your scanners, so only test systems you have written authorization to test.

Who it is forA security tester with written authorization for a web application who wants help triaging proxy and scanner output.

The problemRunning a proxy scanner by hand and summarizing its findings takes a lot of repetitive clicking and note taking.

The outcomeA short list of findings from Burp or ZAP, gathered and summarized by the agent during an authorized test.

What you need first

  • Python 3.9 or newer
  • A free Gemini API key from aistudio.google.com/apikey
  • A local project folder you want the agent to work in
  • For the security use case: Burp Suite or OWASP ZAP installed, and written permission to test the target

Steps

  1. Install and open Burp Suite or OWASP ZAP on the same machine (inferred).
  2. Connect the matching MCP bridge: Burp Suite on :9876 over SSE, or OWASP ZAP on :8282 over streamable HTTP. Both bridges auto-connect off, so connect them yourself (inferred: exact connect steps).
  3. Run python run.py --cli or python run.py --web from the Agent 2 folder.
  4. Ask the agent to run its Burp or ZAP tools against the in-scope target and list findings by severity.
  5. Check each finding in the scanner's own interface before reporting it.

Prompt for your agent

Use the Agent-2 repo at <path-to-agent2> with the Burp Suite MCP bridge to review <authorized-target-url> for issues. Expected output: a list of findings with severity and the request that produced each one. Verify that every finding is reproducible in Burp before you report it.

Caveat. The README names Burp and ZAP bridges but does not document the setup steps, so confirm the bridge is connected before trusting any agent result.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page