Meta Zurp AI Toolkit Integrates Burp Suite with AI Agents for Bug Bounty Research

Key Takeaways

• Meta has released Zurp, an open-source toolkit designed to streamline bug bounty research for its approved security researchers.
• Zurp integrates Burp Suite with AI coding agents, centralizing various research functions and reducing the need for multiple tools.
• The toolkit helps researchers understand identifiers in web traffic, manage test accounts and assets, and automate anti-CSRF token handling.
• Access to Zurp is restricted to vetted researchers participating in Meta’s bug bounty program, utilizing an allowlist model similar to Meta’s FBDL service.
• The initiative reflects a growing trend of integrating AI support into application security testing while maintaining human oversight.

Meta has unveiled Zurp, an innovative open-source toolkit that seamlessly integrates Burp Suite workflows with AI coding agents. This new offering is specifically designed to enhance the efficiency of bug bounty research for authorized participants in Meta’s program.

The project aims to consolidate various research functionalities into a single platform, thereby minimizing the necessity for researchers to juggle disparate tools, logins, and authentication tokens when assessing Meta-owned digital assets.

How Zurp Functions

Zurp operates as a Java extension within Burp Suite, augmented by Model Context Protocol (MCP) servers for AI agents. This architecture enables researchers to analyze web traffic within Burp Suite while simultaneously leveraging approved Meta APIs and access tokens through an AI coding assistant.

Crucially, the tool is intended exclusively for data and test assets associated with the researcher’s authenticated account, establishing a clear boundary for secure and compliant security assessments.

A core component of Zurp is the “Meta View” tab. This feature assists researchers in deciphering identifiers present in captured requests and responses, including URLs, GraphQL doc_id values, object IDs, and operational parameters. Practically, this can significantly reduce the time required to understand the meaning of unfamiliar values when sifting through extensive volumes of traffic from Facebook, Instagram, or other Meta services.

Key Capabilities

Zurp’s comprehensive feature set includes Meta Context, FBDL integration, automated CSRF handling, and SPARTA. Meta Context is designed to clarify identifiers within a request. FBDL facilitates the creation and management of test accounts and assets specifically authorized for use within Meta’s testing environment. SPARTA, on the other hand, generates leads that can guide researchers to areas requiring more thorough investigation, subsequently queuing proof-of-concept tasks into Burp Suite Organizer.

As per the documentation in the Zurp GitHub repository, each of these capabilities can be utilized independently or combined within a unified research workflow.

One particularly valuable feature for Burp Suite users is the automated management of anti-CSRF values. It is common for security researchers to capture a valid request, move it to Burp Repeater, only to find it fails due to the expiration or alteration of short-lived tokens. Zurp addresses this by collecting values such as fb_dtsg, lsd, and CSRF tokens from browsing traffic and then automatically replacing supported placeholders before a request is dispatched. This functionality enhances the stability of authorized replay testing, maintaining value separation by host and logged-in account.

The toolkit also supports an AI-driven pathway via three distinct MCP servers: meta-context, fbdl, and sparta. A compatible MCP client, such as Claude Code or Muse Code, can leverage these services to examine captured requests, identify known Meta values, or interact with authorized test assets. This approach underscores a broader industry trend towards human-centric AI support in application security testing, where AI augments established testing workflows rather than replacing human review entirely.

Installation and Access

Researchers can install the prebuilt zurp.jar extension within Burp Suite via the Extensions menu, subsequently configuring a Meta researcher token in Zurp settings. The project mandates Burp Suite 2024.7 or a newer version. Compiling the extension from its source code requires Java 17, while the agent-side MCP services necessitate Node.js 22.19.0 or a later release.

Access to Zurp remains restricted. The toolkit employs an allowlist model, mirroring Meta’s FBDL service, meaning users without eligible access will encounter HTTP 403 responses. According to the project documentation, authentication tokens are valid for 60 days. Researchers must ensure tokens are generated while logged into the correct enrolled bug bounty account, as tokens created under an unauthorized account will fail authorization checks.

Zurp stands out for its successful integration of manual proxy-based testing, authorized test data, and AI agent workflows, all while keeping the human researcher firmly in control. In 2024, Meta’s bug bounty program awarded over $2.3 million to researchers, with approximately 600 valid reports receiving rewards from nearly 10,000 submissions.

Researchers can access the source code and installation instructions through the Zurp GitHub repository, and Meta’s FBDL eligibility criteria detail the requirements for using the approved testing environment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.