Meta Releases Zurp Toolkit to Integrate AI Agents with Burp Suite for Bug Bounty Research
Meta’s new open-source Zurp tool connects Burp Suite with AI coding agents, streamlining workflows for vetted security researchers testing Meta-owned services.
Key points
- Zurp is an open-source Java extension for Burp Suite that integrates AI coding agents via Model Context Protocol servers.
- The toolkit includes features like Meta Context, FBDL, and SPARTA to help researchers manage test assets and identify identifiers.
- The tool is restricted to vetted researchers in Meta’s bug bounty program and limits access to authorized accounts only.
Meta has introduced Zurp, an open-source toolkit designed to connect Burp Suite workflows with AI coding agents for approved bug bounty research. According to Cyber Security News, the project aims to streamline security testing by consolidating multiple research functions into a single interface, reducing the friction of switching between separate tools, logins, and tokens.
The toolkit operates as a Java extension within Burp Suite and provides Model Context Protocol, or MCP, servers for AI agents. This architecture allows security researchers to inspect web traffic in Burp Suite while simultaneously using the same approved Meta APIs and access tokens through an AI coding assistant. The design ensures that researchers can leverage AI capabilities without breaking the authentication chain required for authorized testing.
Technical Capabilities and Workflow Integration
At the core of the project is the Meta View tab, which assists researchers in understanding identifiers found in captured requests and responses. According to the Zurp GitHub repository documentation, this feature helps decode URLs, GraphQL doc_id values, object IDs, and operations. This functionality reduces the time required to identify unfamiliar values when reviewing large volumes of traffic from Facebook, Instagram, or other Meta services.
Zurp includes several distinct capabilities: Meta Context, FBDL, CSRF handling, and SPARTA. Meta Context explains identifiers within a request, while FBDL helps researchers create and manage test accounts and assets allowed in Meta’s testing environment. SPARTA provides leads that may help identify areas needing closer review and queues proof-of-concept work into Burp Suite Organizer. Each capability can be used separately or combined in a single workflow.
Scope and Security Boundaries
The tool is intended strictly for data and test assets linked to the researcher’s own authorized account. This boundary is critical for ensuring safe and legal security testing within Meta’s bug bounty program. The project is designed specifically for vetted researchers, ensuring that the integration of AI agents does not compromise the integrity of the testing environment or expose unauthorized data.
Zurp also addresses the challenge of automated anti-CSRF handling, a common hurdle in security research. Researchers often find that captured requests fail in Burp Repeater because short-lived values have changed. Zurp collects values such as fb_dtsg, lsd, and CSRF tokens from browsing traffic and replaces supported placeholders before a request is sent. This makes authorized replay testing more stable while keeping values separated by host and logged-in account.
What should you do?
Security professionals and bug bounty hunters should review the Zurp GitHub repository to understand the toolkit’s capabilities and installation requirements. Researchers participating in Meta’s bug bounty program should verify that they meet the vetting criteria before using the tool. Organizations should monitor for similar integrations between popular security testing platforms and AI agents to stay ahead of evolving research methodologies.
What to do and how to stay safe: Meta
- Review the official Zurp GitHub repository to understand installation steps and supported features before attempting to use the toolkit.
- Verify your status as a vetted researcher in Meta’s bug bounty program to ensure you have the necessary authorization to use the tool.
- Monitor Meta’s bug bounty program guidelines for updates on acceptable testing methods and tool usage policies.
- Evaluate how AI-assisted security testing tools like Zurp might impact your organization’s vulnerability disclosure processes and response times.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the primary purpose of Meta’s Zurp toolkit?
Zurp connects Burp Suite workflows with AI coding agents to streamline bug bounty research for vetted security researchers.
Is Zurp available to the general public for unrestricted security testing?
No, the tool is designed specifically for vetted researchers in Meta’s bug bounty program and is limited to authorized accounts.
How does Zurp handle CSRF tokens during security testing?
Zurp collects CSRF tokens like fb_dtsg and lsd from browsing traffic and replaces placeholders in requests to ensure stable replay testing.
