# Welcome This page provides an overview of BurpGPT Pro. BurpGPT Pro brings AI-assisted analysis directly into Burp Suite Professional. It integrates with [supported model providers](/getting-started/supported-model-providers), including Anthropic, Google AI Gemini, Mistral AI, OpenAI, Ollama, and OpenAI-compatible APIs. You can use the extension to analyse HTTP traffic with the AI scanner, manually send selected requests and responses for review, or ask follow-up questions from the `AI Chat` editor tab inside Burp's message editor. The extension is designed for security testing workflows where model output supports, but does not replace, manual validation. AI-generated findings can be incomplete or inaccurate, so always verify results before reporting them. {% hint style="info" %} Third-party model-provider usage costs are not included. Cloud provider API accounts, keys, quotas, and billing are managed separately with the selected provider. {% endhint %} Start with [Quick start](/getting-started/quick-start) for the shortest path to a working setup, or go directly to [Installation](/getting-started/installation) if you are loading the extension for the first time. # Quick start This page gives the shortest path from installation to a working BurpGPT Pro analysis. Use this checklist to confirm the extension is installed, connected to a model provider, and ready to analyse HTTP traffic. ## Before you start Make sure you have: * Burp Suite Professional 2026.4 or later. * The jar file. * Your licence details. * Either a cloud provider API key or a local/self-hosted provider endpoint. ## 1. Load the extension 1. Open Burp Suite Professional. 2. Go to `Extensions`. 3. Click `Add`. 4. Select the jar file. 5. Confirm that the `BurpGPT Pro` menu appears. For the full installation guide, see [Installation](/getting-started/installation). ## 2. Activate your licence Open `BurpGPT Pro -> Licence`, then activate your licence with the key from your purchase email. After activation, the `BurpGPT Pro` tab, scan action, and `AI Chat` editor are available in Burp Suite. For the full activation guide, see [Activate your licence](/getting-started/activate-your-licence). ## 3. Configure a model provider Go to `Provider settings`, then choose one provider path: * For hosted APIs, see [Use supported cloud-based model providers](/how-to/use-supported-cloud-based-model-providers). * For Ollama or self-hosted endpoints, see [Use supported local model providers](/how-to/use-supported-local-model-providers). Enter the provider, base URL, API key if required, model name, timeout, and request parameters. ## 4. Test the provider Click `Test request` before scanning or chatting. If the test fails, check Burp's `Logger` tab for the provider request and response. See [Test and validate model provider settings](/how-to/test-and-validate-model-provider-settings) for details. ## 5. Analyse traffic Choose the workflow that matches your task: * Use `AI scanner` for active scan checks. * Right-click a request and select `Extensions -> BurpGPT Pro -> Scan with AI (results in Target -> Site map)` for targeted manual analysis. * Open the `AI Chat` editor tab to ask follow-up questions about selected traffic. See [Analyse HTTP traffic](/how-to/analyse-http-traffic) and [Use AI Chat](/how-to/use-ai-chat) for the full workflows. ## 6. Review the output For scan-based workflows, the extension creates `Information`-level issues named *GPT-generated insights*. For chat workflows, responses appear in the `AI Chat` editor history. Always manually validate AI-generated results before relying on them in a security report. # Installation This page outlines the steps involved in installing BurpGPT Pro. ## Prerequisites Make sure you have: * [Burp Suite Professional](https://portswigger.net/burp/pro): Version 2026.4 or later. * Java: Version 24 or later if you run Burp Suite with an external Java runtime. {% hint style="warning" %} Version 3.0 requires Burp Suite Professional 2026.4 or later. {% endhint %} The v3.0 local-provider workflow uses Ollama or OpenAI-compatible APIs. The previous Python local server workflow is no longer required. ## Loading the extension into Burp Suite To install the extension: 1. Open Burp Suite and navigate to the `Extensions` tab. 2. Click on the `Add` button under the `Installed` section. 3. Browse to the jar file and click `Next`. 4. Confirm that the `BurpGPT Pro` menu appears. 5. [Activate your licence](/getting-started/activate-your-licence) to access the `BurpGPT Pro` tab, context-menu scan action, and `AI Chat` editor. # Activate your licence This page explains how to activate and refresh your BurpGPT Pro licence. BurpGPT Pro features are available after your licence is active. If the licence dialog does not open automatically after loading the extension, open it from `BurpGPT Pro -> Licence`. ## Activate a licence 1. Open `BurpGPT Pro -> Licence`. 2. Paste your licence key into the `Licence key` field. 3. Click `Activate`. 4. Confirm that `Status` changes to `Activated`. After activation, the `BurpGPT Pro` tab, context-menu scan action, and `AI Chat` editor are available in Burp Suite. ## Refresh licence status Use `Refresh` when you need to update the displayed licence status, validity dates, activation count, or licensed email. The licence dialog shows: * `Status`: Current licence state. * `Licensed to`: Email address associated with the licence. * `Order ID`: Order identifier for the licence. * `Activations`: Used and allowed activations. * `Expires`: Licence expiry date. If activation fails, see [What are the possible causes for an unsuccessful activation of my BurpGPT Pro?](/help-and-faq/faq/what-are-the-possible-causes-for-an-unsuccessful-activation-of-my-burpgpt-pro). # Supported model providers This page lists all compatible model providers, organised by type. Version 3.0 supports the following model providers. Choose a cloud-based provider when you want hosted model performance and already have an API account. Choose a local or self-hosted provider when you need traffic to stay on infrastructure you control, or when you want to use internal models. ## Cloud-based providers {% hint style="warning" %} Using these services involves transmitting data to their servers. Please review each provider’s privacy policy to understand how your data is handled. {% endhint %} * Anthropic — * Google AI Gemini — * Mistral AI — * OpenAI — ## Local and self-hosted providers {% hint style="info" %} For self-hosted or custom providers, the extension can use the standard OpenAI-compatible chat API schema. {% endhint %} * Ollama — * OpenAI-compatible API — use this for compatible local or self-hosted endpoints that expose a `/v1` chat API. After choosing a provider, configure it in `Provider settings` and run `Test request` before scanning or using `AI Chat`. # Use supported cloud-based model providers This page outlines the steps for using the integration with supported cloud-based AI model providers. {% hint style="warning" %} To use the APIs of supported cloud-based model providers, you must have an active account with sufficient credits or a subscription for API usage with the chosen provider. Note that account creation and credit management are handled externally and are outside the scope of this guide. {% endhint %} {% hint style="warning" %} Using this feature involves transmitting selected HTTP traffic, prompts, and chat messages to the selected provider’s servers. Review each provider’s privacy policy to understand its data handling and retention practices. If you handle sensitive information or require local processing, consider [using a local model option](/how-to/use-supported-local-model-providers) instead. {% endhint %} To configure and use a cloud-hosted model provider, follow these steps: 1. Go to the `Provider settings` tab. 2. Select a [cloud-hosted model provider](/getting-started/supported-model-providers#cloud-based-providers) from the `Model provider` dropdown. 3. Enter the API key for the selected provider in the `API key` field. Refer to the selected provider’s documentation for instructions on obtaining and managing your API key. 4. Keep the default `Base URL`, or override it if your provider account requires a custom endpoint. 5. In the `Model` field, type or select the exact model identifier supported by the chosen provider. 6. Use `Read timeout` to control how long the extension waits for a provider response. Set it to `0` for no timeout. 7. The `Request parameters` field accepts a JSON object with valid model parameters such as `temperature`, `top_p`, `stop`, and `max_tokens`. For details, see the selected provider’s documentation. 8. Click `Test request` before using the provider for scanning or `AI Chat`. The `AI scanner` tab controls the scan prompt and message role used for scan requests. Provider settings are shared by active scanning, manual scanning, provider tests, and `AI Chat`. # Use supported local model providers Version 3.0 supports local and self-hosted models through provider APIs rather than through the previous Python local server workflow. Use one of the following options: * [Ollama](/how-to/use-supported-local-model-providers/with-the-ollama-provider), when your model is served by Ollama. * [OpenAI-compatible API](/how-to/use-supported-local-model-providers/with-openai-compatible-api), when your local or self-hosted runtime exposes an OpenAI-compatible `/v1` API. {% hint style="info" %} Local and self-hosted providers keep HTTP traffic on infrastructure you control. The extension still sends the selected request, response, prompt, and chat messages to the endpoint you configure. {% endhint %} After configuring a local provider, run `Test request` from `Provider settings` before scanning traffic or using `AI Chat`. # With the Ollama provider This page outlines the steps involved in using the Ollama provider. {% hint style="warning" %} To use this feature, you must first [install Ollama](https://ollama.com/download) on your machine and ensure that the models you want to query are already downloaded and available locally. For detailed information on installing Ollama and managing models, please refer to the [official Ollama documentation](https://github.com/ollama/ollama/tree/main/docs). {% endhint %} To configure and use the Ollama model provider, follow these steps: 1. Go to the `Provider settings` tab. 2. Select `Ollama` from the `Model provider` dropdown. 3. (Optional) The `Base URL` field defaults to Ollama's address: `http://localhost:11434`. If your Ollama instance runs on a different host or port, update this field accordingly. 4. Leave the `API key` field blank unless your deployment requires one. 5. In the `Model` field, enter the name of a model already installed in your Ollama environment. To list available models, run: {% code fullWidth="false" %} ```powershell ollama list ``` {% endcode %} 6. (Optional) Adjust the JSON-formatted settings in the `Request parameters` field to fine-tune the model’s completion behaviour. Refer to the [detailed list of valid parameters and their accepted values](https://github.com/ollama/ollama/blob/main/docs/modelfile.md#valid-parameters-and-values) for more information. 7. Click `Test request` to validate the provider settings. 8. Set your scan prompt in the `AI scanner` tab, then either send requests for individual scans or enable processing for all active scans. # With an OpenAI-compatible API This page outlines the steps involved in using an OpenAI-compatible API provider. Use `OpenAI-compatible API` for local, self-hosted, or third-party runtimes that expose a chat API compatible with the OpenAI schema. To configure the provider: 1. Go to the `Provider settings` tab. 2. Select `OpenAI-compatible API` from the `Model provider` dropdown. 3. Enter the provider `Base URL`. This is usually the root API URL ending in `/v1`. 4. Enter an `API key` if your provider requires one. Leave it blank only if your endpoint does not require authentication. 5. In the `Model` field, enter the exact model identifier exposed by your provider. 6. Adjust the `Request parameters` JSON to match the parameters supported by your endpoint. 7. Click `Test request` to validate the settings before scanning traffic. {% hint style="warning" %} The extension does not validate provider-specific model names or parameter compatibility before sending the request. If the test request fails, check the provider response in Burp's `Logger` tab. {% endhint %} # Use the prompt library This page outlines the features provided by the prompt library. 1. Go to the `Prompt library` tab. 2. From there, you can access the following options: * [Add](#add-a-prompt-to-the-library): Save a new prompt to your library. * [Remove](#remove-prompt-s-from-the-library): Delete selected prompts from your library. * [Export](#export-the-prompt-library): Create an importable backup of all your saved prompts by exporting them. * [Import](#import-add-entries-to-the-prompt-library): Import previously exported prompts to your library. * [Send to](#send-a-prompt-to-the-current-settings): Send a prompt to the current settings. ## Add a prompt to the library To add a new entry to the prompt library, follow these steps: 1. Click on the `Add` button. 2. Populate the `Author`, `Category` and `Prompt` fields. 3. Confirm by clicking on the `OK` button. {% hint style="info" %} The prompt library automatically filters out duplicate entries, ensuring that you do not end up with multiple prompts for the same thing. {% endhint %} Prompts can include placeholders such as `{REQUEST}`, `{RESPONSE}`, and `{URL}` when they are used for scan analysis. See [Use placeholder reference](/how-to/use-placeholder-reference) for the supported placeholders. ## Remove prompt(s) from the library To remove one or multiple entries from the prompt library, follow these steps: 1. Select the entries you want to remove from the table. 2. Click on the `Remove` button. ## Export the prompt library To export the entire prompt library, follow these steps: 1. Click on the `Export` button. 2. Choose the destination location and give a `.json` extension to the exported file. {% hint style="warning" %} It's important to give the exported file a `.json` extension for it to be recognised as a JSON file. {% endhint %} With the pre-populated built-in examples present by default within the `Prompt library` tab, the resulting JSON file should contain the following entries: ```json [ { "id": "3ed5b678-c6fd-4a36-8365-1b3711e1ef7f", "author": "Alexandre Teyar", "category": "built-in_generic", "text": "Analyze the HTTP request and response below for potential security vulnerabilities, specifically focusing on OWASP top 10 vulnerabilities such as SQL injection, XSS, CSRF, and other common web application security threats.\n\nFormat your response as a bullet list with each point listing a vulnerability name and a brief description, in the format and exclude irrelevant information:\n\n- Vulnerability Name: Brief description of vulnerability\n\n=== Request ===\n{REQUEST}\n\n=== Response ===\n{RESPONSE}", "created": "2024-01-31T15:10:09.941425100Z" }, { "id": "f0f0b1f7-e9ea-40aa-93c6-6360d27e372d", "author": "Alexandre Teyar", "category": "built-in_biometric", "text": "Analyse the HTTP request and response below for potential security vulnerabilities related to the biometric authentication process.\n\nFormat your response as a bullet list with each point listing a vulnerability name and a brief description, in the format and exclude irrelevant information:\n\n- Vulnerability Name: Brief description of vulnerability\n\n=== Request ===\n{REQUEST}\n\n=== Response ===\n{RESPONSE}", "created": "2024-01-31T15:10:09.941425100Z" }, { "id": "b2f1e0e8-6f29-418f-a107-582f8d14a6c5", "author": "Alexandre Teyar", "category": "built-in_spa", "text": "Analyse the HTTP request and response below for potential security vulnerabilities specific to the framework.\n\nFormat your response as a bullet list with each point listing a vulnerability name and a brief description, in the format and exclude irrelevant information:\n\n- Vulnerability Name: Brief description of vulnerability\n\n=== Request ===\n{REQUEST}\n\n=== Response ===\n{RESPONSE}", "created": "2024-01-31T15:10:09.941425100Z" } ] ``` ## Import/Add entries to the prompt library To import new entries to the prompt library, follow these steps: 1. Click on the `Import` button. 2. Choose the JSON file created in the [Export the prompt library](#export-the-prompt-library) section. ## Send a prompt to the current settings To send a prompt to the current scanner settings, follow these steps: 1. Right-click on an entry from the table. 2. Choose `Send to 'Provider settings'`. # Use placeholder reference This page lists the placeholders available for scan prompts. Placeholders let scan prompts include specific parts of the HTTP request and response being analysed. The extension replaces supported placeholders before sending the final prompt to the configured model provider. Use placeholders in `AI scanner` prompt templates and prompt library entries that you send to the scanner settings. ## View supported placeholders To view the supported placeholders in Burp Suite: 1. Go to the `BurpGPT Pro` tab. 2. Select `Placeholder reference`. 3. Use the search field to find a placeholder by name or description. ## Supported placeholders | Placeholder | Value | | -------------------- | ---------------------------------------------------- | | `{REQUEST}` | The full scanned request. | | `{URL}` | The URL of the scanned request. | | `{METHOD}` | The HTTP request method used in the scanned request. | | `{REQUEST_HEADERS}` | The headers of the scanned request. | | `{REQUEST_BODY}` | The body of the scanned request. | | `{RESPONSE}` | The full scanned response. | | `{RESPONSE_HEADERS}` | The headers of the scanned response. | | `{RESPONSE_BODY}` | The body of the scanned response. | ## Example ``` Analyse the following HTTP exchange for security issues. Method: {METHOD} URL: {URL} Request: {REQUEST} Response: {RESPONSE} ``` Use narrower placeholders when you only need part of the traffic. For example, use `{REQUEST_HEADERS}` when you want the model to focus on authentication, cookies, or custom headers. # Analyse HTTP traffic This page outlines the methods available to analyse HTTP traffic. {% hint style="info" %} To aid troubleshooting and show where generated traffic is sent, all related requests and responses are logged and can be viewed in the [Burp Suite Logger](https://portswigger.net/burp/documentation/desktop/tools/logger). {% endhint %} ## Method 1: Automatic analysis via active scanning 1. Go to the `AI scanner` tab. 2. Configure the role and prompt template used for scan requests. 3. Confirm that `Test request` succeeds in `Provider settings`. 4. Click `Scan: On` to register the active scan check. 5. Send traffic to Burp's active scanner. The extension resolves placeholders such as `{REQUEST}` and `{RESPONSE}` before sending the prompt to the configured model provider. See [Use placeholder reference](/how-to/use-placeholder-reference) for the full list. ## Method 2: Targeted manual analysis 1. Right-click on any request or response in Burp Suite. 2. Navigate to `Extensions → BurpGPT Pro → Scan with AI (results in Target → Site map)`. {% hint style="warning" %} Using this approach, completion results will appear uniquely under the relevant entries in `Target → Site map`, as well as in the `All issues` section of Burp Suite. {% endhint %} ## Method 3: Interactive AI Chat Open any HTTP request editor tab that supports extension editors, then select `AI Chat`. You can ask follow-up questions about the selected traffic and choose whether to include the current request, response, or both with your next message. If analysis does not produce the expected output, see [Troubleshooting](/help-and-faq/troubleshooting). # Use AI Chat This page outlines how to use the AI Chat editor for selected HTTP traffic. `AI Chat` is available as an editor tab for HTTP requests after your licence is active. To use it: 1. Select a request in Burp Suite. 2. Open the message editor and choose the `AI Chat` tab. 3. Type your question. 4. Leave `Request`, `Response`, or both selected if you want that traffic included with your next message. 5. Click `Send`, or press `Ctrl+Enter`. The chat uses the active provider, model, and request parameters from `Provider settings`. Use `Clear` to reset the conversation history for the selected editor. {% hint style="info" %} After a request or response is included in a message, its toggle is cleared so the same traffic is not repeatedly sent with every follow-up. {% endhint %} # View GPT-generated results This page outlines the presentation and structure of GPT-generated results. After successfully processing HTTP requests and responses with any supported model, the extension generates a new `Information`-level issue for each processed request/response pair. This issue, titled *GPT-generated insights*, appears in distinct locations within Burp Suite depending on the processing method used. See [Analyse HTTP traffic](/how-to/analyse-http-traffic) for the available methods. The issue contains detailed information about the query sent to the selected model and the model’s response, as shown in the following screenshot.

GPT-generated insights.

`AI Chat` responses are shown directly in the editor chat history rather than being added as Burp issues. # Test and validate model provider settings This page outlines how to test your configured settings for a model provider, before using them for scans or AI Chat. After configuring the model settings in the `Provider settings` tab, click `Test request`. This sends a completion request to the selected model provider and displays the result in a dialog.
The same provider configuration is used by: * `AI scanner` * `Scan with AI (results in Target → Site map)` * `AI Chat` {% hint style="info" %} If a test fails, check Burp's `Logger` tab for the provider request and response. Provider-side errors such as invalid model names, unsupported parameters, rate limits, or insufficient credits are surfaced there. {% endhint %} For common fixes, see [Troubleshooting](/help-and-faq/troubleshooting). # FAQ This section answers common questions about BurpGPT Pro licensing, subscriptions, provider usage, local model privacy, and result accuracy. For setup or provider errors, see [Troubleshooting](/help-and-faq/troubleshooting). # Can BurpGPT Pro be used as a standalone application? This page addresses a frequently asked question. No. It is a Burp Suite Professional extension and cannot run as a standalone application. To use it, you need Burp Suite Professional installed and an active Burp Suite Professional licence. # Does the BurpGPT Pro licence cover usage of supported cloud-based model providers like OpenAI? This page addresses a frequently asked question. No. The extension integrates with external model providers such as OpenAI, but provider accounts, setup, quotas, and usage costs are managed separately with each provider. For a thorough grasp of related expenses, review the pricing policies of each provider, such as: * * * * * # Does the BurpGPT Pro local LLM feature share any data with OpenAI or any third party? This page addresses a frequently asked question. If you use Ollama or an OpenAI-compatible API hosted on infrastructure you control, the extension sends selected prompts, chat messages, HTTP requests, and HTTP responses only to the endpoint configured in `Provider settings`. If that endpoint is local, the traffic stays local. If you configure a remote self-hosted endpoint, the selected data is sent to that remote endpoint. Local-provider traffic is not sent to OpenAI unless you explicitly configure OpenAI or another remote OpenAI-compatible service as the provider. # How can I cancel my subscription? This page addresses a frequently asked question. To cancel your subscription, follow these steps: 1. Locate the initial email titled "Your BurpGPT Pro Activation Information". 2. Click on the "Manage Subscription" button in the email to be redirected to the [Stripe Customer Portal](https://billing.stripe.com/p/login/3cs4gkff48YDf7y144). 3. Alternatively, you can directly visit the [Stripe Customer Portal](https://billing.stripe.com/p/login/3cs4gkff48YDf7y144). 4. Log in using the email address associated with your subscription. 5. From there, you can manage and cancel your subscription. # How to purchase and manage licenses as a reseller? This page addresses a frequently asked question. **If you are a software reseller, here is some key information you should know:** * Licenses can be purchased in batches at . * Once payment is completed, a **welcome pack** will be sent to the email address used at checkout. This pack includes: * A link to download the software (a JAR file), **valid for 10 days**. * Invoice details. * A link to manage the subscription (e.g., re-download the invoice or cancel the yearly auto-renewal). The license operates on a **rollout basis**, meaning it will automatically renew each year using the original payment method, unless explicitly cancelled. Detailed cancellation instructions can be found here: . You have two options for purchasing on behalf of your clients: 1. Purchase the licenses using your own email at checkout, then forward the welcome pack and related information to the end client. 2. Use the end client’s email at checkout, in which case they will receive the welcome pack directly. # Can BurpGPT Pro produce false positive results? This page addresses a frequently asked question. Software designed to automate processes often yields false positives, especially in the case of Large Language Models (LLMs). The output quality of these models heavily depends on the quality of the prompts given and the supporting data provided. In cybersecurity workflows, the extension can help automate parts of security assessment. However, it should not be treated as a standalone solution for comprehensive security audits. Users must triage and validate the generated results to ensure they are accurate and relevant. # What are the possible causes for an unsuccessful activation of my BurpGPT Pro? This page addresses a frequently asked question. There are several potential reasons for issues with the licensing system: * **Network / Security Configuration:** Certain network setups or security systems may prevent connection to the licensing system. Ensure that **HTTP/HTTPS traffic to and from `burpgpt.app` and `burpgpt.netlify.app`** is allowed. If necessary, try adjusting your network or security settings to allow this traffic. * **Activation limit reached:** A single licence can only be activated on the allowed number of devices. The licence dialog shows the current activation count. * **Clock Synchronization:** Time-related activation issues might be due to system clock discrepancies. Wait a few hours before seeking further support. * **Corrupted Download:** A corrupted .jar file download can cause licensing errors. Re-download the file to resolve these issues. * **Java Version Compatibility:** Ensure your system meets the Java requirements listed in the [Prerequisites](/getting-started/installation#prerequisites) to avoid compatibility issues with the licensing system. # What is the limit for device activations with a single BurpGPT Pro license? This page addresses a frequently asked question. A single licence allows activation on **a maximum of three (3) devices**. If you require activation on more than three devices, you must obtain a new licence. # Troubleshooting This page helps resolve common BurpGPT Pro setup and provider issues. Start with the simplest check that matches the symptom. The extension logs provider requests and responses in Burp's `Logger` tab, which is usually the fastest way to identify configuration problems. ## The extension loads, but Pro features are not visible Check that: * You are using Burp Suite Professional 2026.4 or later. * Your licence is active. * Burp Suite was restarted after loading or updating the extension. If activation fails, see [What are the possible causes for an unsuccessful activation of my BurpGPT Pro?](/help-and-faq/faq/what-are-the-possible-causes-for-an-unsuccessful-activation-of-my-burpgpt-pro). For the activation steps, see [Activate your licence](/getting-started/activate-your-licence). ## `Test request` fails Check the provider response in Burp's `Logger` tab, then verify: * The selected provider matches the endpoint you configured. * The `Base URL` is correct. * The `API key` is present when the provider requires one. * The `Model` value is an exact model identifier supported by the provider. * `Request parameters` is valid JSON and only contains parameters supported by that provider. * Your provider account has enough credits, quota, or local resources to answer the request. For the full validation flow, see [Test and validate model provider settings](/how-to/test-and-validate-model-provider-settings). ## Local provider requests do not connect For Ollama, confirm that Ollama is running and that the model appears in: ```powershell ollama list ``` If Ollama is running on another host or port, update `Base URL` in `Provider settings`. For OpenAI-compatible APIs, confirm that the configured `Base URL` usually ends in `/v1` and that the endpoint supports chat completion requests. ## Scans do not produce results Check that: * `Test request` succeeds with the active provider. * The `AI scanner` prompt includes the placeholders you expect, such as `{REQUEST}` and `{RESPONSE}`. * The `Scan: On` toggle is enabled before sending traffic to Burp's active scanner. * For targeted analysis, you used `Extensions -> BurpGPT Pro -> Scan with AI (results in Target -> Site map)`. Scan-based results appear as `Information`-level issues named *GPT-generated insights*. ## `AI Chat` does not include the expected traffic In the `AI Chat` editor, keep `Request`, `Response`, or both selected before sending the message. After selected traffic is sent once, the extension clears the toggle so follow-up messages do not repeatedly include the same data. # Changelog This page summarises changes across BurpGPT Pro releases. ## 3.0 (12/05/2026) {% hint style="info" %} BurpGPT Pro 3.0 introduces a redesigned interface, unified provider configuration, local/self-hosted provider support through standard APIs, and an interactive `AI Chat` workflow. {% endhint %} ### Added * Added the `AI Chat` request editor tab for follow-up questions about selected HTTP traffic. * Added `Request` and `Response` context toggles in `AI Chat`. * Added `OpenAI-compatible API` as a provider option for local, self-hosted, and compatible third-party endpoints. * Added a dedicated licence dialog showing activation status, validity dates, activation count, and licensed email. * Added `Test request` to validate the active provider configuration before scanning or chatting. ### Changed * Redesigned the user interface to provide a more modern, consistent, and streamlined experience. * Unified model configuration under the `Provider settings` tab. * Moved scan-specific role and prompt configuration to the `AI scanner` tab. * Active scan registration is now controlled by the `Scan: Off` / `Scan: On` toggle in `AI scanner`. * Replaced the previous Python/Hugging Face local server workflow with Ollama and OpenAI-compatible provider integrations. ### Compatibility * Raised the minimum supported Burp Suite Professional version to `2026.4`. ### Removed * Removed unused Watsonx and OpenAI official SDK dependencies from the bundled extension. ## 2.0 (07/08/2025) {% hint style="info" %} BurpGPT Pro 2.0 expanded provider support and introduced a refreshed configuration workflow. {% endhint %} ### Added * Added out-of-the-box support for Anthropic, Google AI Gemini, Mistral AI, OpenAI, and local/custom providers. * Added adjustable timeout controls for provider requests. * Added fine-grained `Request parameters` for provider-specific model options. * Added in-app tooltips and contextual usage hints. ### Changed * Streamlined the user interface for provider setup and scanning. * Centralised configuration in `Provider settings`. * Simplified scan control with the `Scan: Off` / `Scan: On` toggle. * Unified contextual scan actions so requests and responses use the current provider configuration. ## 1.1 (13/02/2025) ### Added * Added a `Report Bug` menu item to the BurpGPT Pro menu. ### Changed * Replaced the `About` view with an `About` menu item that opens a compact version dialog. * Standardised layout margins across the extension. * Improved prompt library interactions, including disabled states for unavailable actions and a larger `Add prompt` dialog. ### Fixed * Improved error handling and general stability. ## 1.0.2 (26/01/2025) ### Added * Added documentation and release-note links to the BurpGPT Pro menu. ### Changed * Updated the required Python binary version for the legacy local LLM workflow to `3.12.6`. ### Fixed * Fixed duplicate requests when using `Send to `. * Included general bug fixes and performance improvements. ## 1.0.1 (19/09/2024) ### Changed * Removed a confusing Swing component warning from the user-facing output. * Added a Burp Suite version check with an upgrade prompt when required. ### Fixed * Fixed missing query strings in requests sent to `LLM_PROVIDER`. * Included general bug fixes and performance improvements. ## 1.0 (20/08/2024) ### Added * Added direct request handling through Burp Suite for selected LLM providers. * Added Burp `Logger` visibility for provider requests and responses. * Added Burp `Dashboard` tasks for context-menu provider actions. * Added editable `model` and `role` fields. * Added copy and cut support for `API endpoint` and `API key` fields. * Added prompt text wrapping. * Added `Roles` and `Max New Tokens` controls for the legacy local LLM workflow. * Added prompt library context-menu actions for copying selected rows as JSON and copying cell values. * Added export support for legacy local server logs. ### Changed * Sent Azure/OpenAI API requests over `HTTP/2`. * Improved extension performance and stability. * Improved legacy local LLM request handling and processing speed. * Displayed legacy local server output in Burp Suite's `Raw Editor`. * Refreshed navigation tabs, icons, prompt dialogs, status colours, and `About` view layout. * Standardised button labels. ### Fixed * Improved logging and exception handling. * Included general bug fixes and performance improvements. ## 0.4.8 (30/05/2024) ### Added * Added support for the `gpt4-turbo` and `gpt4-o` models. * Added a documentation link to the `About` view. ### Fixed * Included general bug fixes and performance improvements. ## 0.4.7 (01/04/2024) ### Added * Added an `Anonymise report` option to hide the `API endpoint` and `API key` in generated GPT insight issues. * Added a clear validation warning to generated issue background text. ### Changed * Increased the default `Request timeout (seconds)` value from `10` to `30`. * Allowed `Max prompt length` set to `0` to disable prompt truncation. * Reorganised the `Azure/OpenAI API` and `Local LLM` settings layout. * Standardised wording for Burp Suite context-menu actions. ### Fixed * Fixed an issue with the `Request timeout (seconds)` slider introduced in `0.4.6`. * Included general bug fixes and performance improvements. ## 0.4.6 (04/03/2024) ### Added * Added a `Request timeout (seconds)` slider for provider calls. * Added tooltips to `Browse` buttons in the legacy local model settings. ### Changed * Improved table space in the `Prompt` and `Placeholder` tabs. * Standardised `Prompt library` context-menu wording. ### Fixed * Fixed `Prompt library` context-menu actions using the `Author` column instead of the selected prompt text. * Included general bug fixes and performance improvements. ## 0.4.5 (22/02/2024) ### Added * Added `#`, `Author`, and `Created` columns to the prompt library. * Added a show/hide toggle for `API endpoint` and `API key` fields. * Added a tooltip for the settings icon. ### Changed * Sorted the prompt table by `Category` by default. * Updated the prompt library layout. * Aligned table behaviour with current Burp Suite table controls for column visibility and sorting. ### Fixed * Fixed issues related to the extension persistence store. * Included general bug fixes and performance improvements. ## 0.4.4 (29/01/2024) ### Added * Added visual feedback for legacy local model downloads and related provider activity. * Added a `Python path` field for environments with restricted system `PATH` access. ### Changed * Updated the tab name from `OpenAI API` to `Azure/OpenAI API`. * Simplified the call-to-action colour scheme. * Enabled auto-scrolling in the legacy server debug view. * Reworked the legacy local model server view. ### Fixed * Fixed Azure OpenAI Services integration issues. * Included general bug fixes and performance improvements. ## 0.4.3 (16/01/2024) ### Changed * Updated OpenAI defaults from the completions API to the chat completions API. * Removed deprecated OpenAI models from the model list. * Improved settings persistence across versions. * Reduced bundle size by removing unused legacy local model dependencies. ### Fixed * Included general bug fixes and performance improvements. ## 0.4.2 (07/01/2024) ### Added * Added arbitrary endpoint support for the `API endpoint` field. * Added prompt library context-menu actions for sending prompts to provider views. * Added logging updates for newer Montoya API behaviour. ### Changed * Added `Settings` menus with `Restore defaults` to provider views. * Switched to Font Awesome icons. * Improved icon hover states. * Removed the `Docking` button after Burp Suite added native tab docking support. ### Fixed * Included general bug fixes and performance improvements. ## 0.4.1 (05/06/2023) ### Fixed * Included general bug fixes and performance improvements. ## 0.4 (02/06/2023) ### Added * Added settings persistence for `OpenAI API` and `Local LLM` views. * Added a `Reset` button for restoring default field values. ### Changed * Improved cross-platform compatibility, particularly on macOS. * Unified the extension user interface. ### Fixed * Included general bug fixes and performance improvements. ## 0.3 (25/05/2023) ### Added * Added built-in example prompts to the `Prompt library`. * Added compatibility for `text-davinci-002`, `text-davinci-003`, `text-ada-001`, `text-babbage-001`, and `text-curie-001`. * Added tooltips for key fields. ### Changed * Improved cross-platform compatibility, particularly on macOS. * Improved legacy local server start and stop behaviour. * Improved extension unload handling. * Refined settings persistence. * Removed the `Apply` button and applied setting changes automatically. * Unified the extension user interface. ### Fixed * Fixed a bug that prevented licence activation issues from being displayed. * Included general bug fixes and performance improvements. ## 0.2.2 (22/05/2023) ### Changed * Improved logging for troubleshooting. ### Fixed * Fixed a UI bug where the `Parameter #` field remained enabled when text was entered in the `LLM directory` field. * Included general bug fixes and performance improvements. ## 0.2.1 (19/05/2023) ### Changed * Reduced the jar size by removing bundled Python dependencies. ### Fixed * Fixed Python compatibility issues affecting the legacy local LLM workflow. ## 0.2 (16/05/2023) ### Added * Added a `Dock` button for switching between floating and suite tabs. ### Changed * Improved legacy local model processing performance. * Improved application stability and reliability through broader exception handling. ### Fixed * Fixed a visual issue that caused the prompt text field to collapse with larger font sizes. ## 0.1.1 (11/05/2023) ### Fixed * Included bug fixes and performance improvements. ## 0.1 (07/05/2023) ### Added * Initial BurpGPT Pro release. # Roadmap This page outlines features scheduled for implementation in future releases. Please note that this list is not exhaustive. * [x] Implement the `Settings` menu with `Restore defaults` option in the `Prompt library` view. * [x] Document Azure OpenAI services integration. * [x] Add OpenAI-compatible provider support. * [x] Add an interactive AI Chat editor for selected HTTP traffic. * [ ] Replace the `Role` and `Prompt` fields with a single `Messages` JSON field under `Provider settings` to support multi-message input for compatible models.