PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Agentic Pentesting with MCP

caido.io | blog | #ai-security | #pentesting | #agentic-ai | #burp-suite | #mcp | #proxy | #caido | #ai-agents | #pentest
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Caido makes the case for proxy-backed MCP servers in agentic pentesting: routing agent HTTP through Caido, Burp or ZAP keeps traffic and findings reviewable in project history, with guardrails.
Published
Collected

Related coverage

tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
blog · caido.io
Caido v0.59.0
Caido v0.59.0 adds configurable AI providers, AI-generated Workflows, traffic Capture controls, Replay from cURL, and multi-instance Desktop support.
blog · caido.io
Caido v0.44.1
Caido v0.44.1 is here! This update brings a new variable store feature, SNI overrides, as well as important improvements to the plugin SDK for both backend and frontend development.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · about.gitlab.com
New MCP tools help platform teams scale automation safely
GitLab 19.4 expands the GitLab MCP server tool set so agents can run pipelines, open merge requests, and triage vulnerabilities, while writes, merges, and deletes still wait for a human reviewer.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
Back