montoya

Burp Suite Pro extension (Montoya API): HTTP request-smuggling / desync hypothesis scanner with a framing-aware, oracle-free classifier and Burp Collaborator OOB (SSRF) detection.

Burp Suite MCP bridge for traffic triage, replay, bounded interception, rewrite automation, and evidence export.

Burp Suite (Montoya) extension: dedupe HTTP history into an AI-ready unique feed, tag attacker/victim by listener port, and ship the set to Claude Code for IDOR/BOLA testing.

Burp Suite extension (Kotlin/Montoya) that detects GraphQL endpoints and runs OWASP API Security Top 10 checks — passive detection, schema introspection/clairvoyance, and a Burp-style per-operation crawl/enumerate/scan. Proof-level, non-destructive.