Zurp is now open source: bringing Meta's agentic research tooling to the community
October 1, 2026
Today we're open-sourcing Zurp, Meta Bug Bounty's research toolkit, at https://github.com/facebookincubator/Zurp. Zurp puts Meta-specific context and capabilities inside the proxy you already have open, Burp. And every one of those capabilities is also available to your AI agents.
We'll put it in researchers' hands first at our live hacking events in Buenos Aires and Japan this autumn. The client-side code is public today, so you can read it, fork it, and help shape what it becomes!
Why we built Zurp
Security research looks very different today than it did just a few years ago. Many of you now combine your own expertise with agents that explore targets, build test data, replay traffic, and keep evidence. But when you research Meta's products, you run into the same wall again and again. The context that makes a request make sense, like what an opaque ID refers to or which operation a GraphQL request actually runs, isn't visible from outside. Replaying a request often means fighting expired tokens first. Our own tooling, like FBDL, lives in a different place from the proxy where you do most of your work.
Burp Suite is where most web security research happens, so that's where we wanted our tooling to be. We already partner with PortSwigger to give researchers Burp Suite Professional licences and training. Zurp is the next step: instead of asking you to learn a new Meta-specific interface, we bring Meta's capabilities to you.
Partnerships
- We partnered with PortSwigger to give researchers Burp Suite Professional licences during our live hacking events. Burp Suite is where most web security research happens, so that's where we wanted our tooling to be.
- To enable cybersecurity research powered by Meta’s own models we partnered with Muse Spark and Spark Zero frontier research team, to provide unlimited LLM access during the event as well as guided resources on how to build cybersecurity research agentic systems in the meta ecosystem and context.
What Zurp is
- Meta Context: helps you understand what you're looking at. It resolves identifiers, URLs, and GraphQL operations in your traffic to what they actually represent, so you don't have to reverse-engineer them by hand.
- CSRF token handling: captures and refreshes the tokens Meta requests need, so a replayed request works instead of failing on a stale token.
- FBDL integration: lets you build and reach your FBDL test environments without leaving Burp.
- Research leads: for event participants, starting points you can explore for a given focused scope.
Built for agents from day one. You can research by hand, through an agent, or with both at once, and each piece can be used on its own in your own workflow. If you want to see that in practice, our guide Muse Code for Security Research walks through wiring Zurp’s MCP servers into a terminal coding agent alongside Burp, Ghidra and LLDB.
Why open source
- You should be able to see what you install. Our community is just that – a community, and nobody should have to load a closed binary into the tool they run their research on. With the code public, you can check exactly what it does.
- You can build it with us. Filing feedback on a closed tool is useful, but you can't send a fix. Open source turns feedback into contributions. We've seen this work already: the FBDL MCP integration started as a researcher's project, and we adopted it. We'd like Zurp to grow the same way.
- You can integrate this best in your own workflow and toolings. Zurp being open-sourced, you’re free to fork it and integrate it in your software and workflow of choice, not only Burp and Muse Code
The client is open. The Meta-side capabilities it connects to stay behind controlled access for trusted researchers, and we'll widen that access over time.
Testing it for real: Buenos Aires, then Japan
- Ekoparty, Buenos Aires, 5 October 2026. This is the first event where the whole toolkit runs together. A selected group of researchers will have access to these tools and the agent integrations against a focused scope, and our community ambassadors will help with onboarding and collect feedback.
Thanks to PortSwigger, every participant gets Burp Suite Professional for the event. We're also giving participants credits for Muse Spark, Meta's reasoning model, so running an agentic workflow costs nothing but your time. - TenguCon, Japan, 16 November 2026. Our second event. We'll take what we learn in Buenos Aires to a different researcher community, improve the experience, and work out which capabilities are ready for wider access.
After that, we want trusted researchers to be able to use these capabilities all year round, not just at conferences, with regular releases and ongoing feedback.
- Reports that include a FBDL run already earn a bonus.
- At these events, researchers who share the research trajectory can earn an additional bonus. Those trajectories show us how expert researchers actually work, and that's what we'll build the next generation of tooling from.
Get involved
- Read the code, and try it:https://github.com/facebookincubator/Zurp
- Tell us what's broken or missing: open an issue. It's a beta, so expect rough edges.
- Send a pull request: if a capability you need doesn't exist yet, we'd rather you build it with us than work around us.
- Found a security issue in Zurp itself? Report it through the Meta Bug Bounty program
Zurp is the first step toward something bigger: a research platform built by, with and for the community, where you and your agents can go from an idea to a reproducible finding faster, and we can go from that finding to a fix just as quickly. We'll see some of you in Buenos Aires and Japan.
Happy hacking,
The Meta Bug Bounty team