diff --git a/Autorize.py b/Autorize.py
index 1f452f1..212b156 100644
--- a/Autorize.py
+++ b/Autorize.py
@@ -26,10 +26,12 @@ def registerExtenderCallbacks(self, callbacks):
 
         initiator.implement_all()
 
-        initiator.init_ui() 
-        
+        initiator.init_ui()
+
+        initiator.init_mcp()
+
         initiator.print_welcome_message()
-        
+
         return
 
     #
@@ -48,5 +50,8 @@ def processProxyMessage(self, messageIsRequest, message):
     # implement IExtensionStateListener
     #
     def extensionUnloaded(self):
+        mcp = getattr(self, 'mcp', None)
+        if mcp is not None:
+            mcp.stop()
         self.executor.shutdown()
         print "Autorize extension unloaded."
diff --git a/BappManifest.bmf b/BappManifest.bmf
index 8df98e3..3e3c422 100644
--- a/BappManifest.bmf
+++ b/BappManifest.bmf
@@ -2,8 +2,8 @@ Uuid: f9bbac8c4acf4aefa4d7dc92a991af2f
 ExtensionType: 2
 Name: Autorize
 RepoName: autorize
-ScreenVersion: 1.9.1
-SerialVersion: 33
+ScreenVersion: 1.9.4
+SerialVersion: 36
 MinPlatformVersion: 2
 ProOnly: False
 Author:  Barak Tawily, AppSec Labs
diff --git a/README.md b/README.md
index 9093bff..5549cc5 100644
--- a/README.md
+++ b/README.md
@@ -25,6 +25,7 @@ The extension is written in Jython by **Barak Tawily**, an application security
   - Burp Repeater
 - Flexible interception filtering (scope, whitelist, blacklist, regex)
 - Visual enforcement status indicators for rapid triage
+- **Built-in MCP server** for AI-agent integration (see below)
 
 ---
 
@@ -191,6 +192,42 @@ This allows you to customize the right panel to show only the comparisons you ca
 
 The visibility selection dynamically adjusts the panel layout, giving more vertical space to the remaining viewers.
 
+---
+## MCP Server (AI agent integration)
+
+Autorize can expose its findings and configuration to an AI agent (e.g. Claude) through a built-in **MCP (Model Context Protocol) server**, in the same spirit as PortSwigger's own Burp MCP server. This lets an agent list and triage authorization findings, inspect a specific result's request/response variants, stand up low-privileged users, drive scanning, and pivot a finding into Repeater — without clicking through the UI.
+
+### Enabling it
+
+1. Open the **Configuration → MCP Server** tab (a sub-tab alongside Interception Filters / Table Filter / Save/Restore).
+2. Set a **Port** (default `9877`) and tick **Enable MCP Server**.
+3. A per-session **bearer token** is generated and shown in the Token field. Use **Copy Token** to grab it, or **Regenerate Token** to roll it.
+
+The server binds to **127.0.0.1 only** and requires the bearer token on **every** request, because the results table can contain live session cookies and `Authorization` headers. The token lives in memory only — it is never written to disk and is deliberately **excluded** from Save/Restore state files (only the enabled flag and port are persisted).
+
+> The server is implemented on `java.net.ServerSocket` (part of `java.base`), so it works on Burp's bundled/trimmed JRE with no extra modules required.
+
+### Connecting
+
+The endpoint speaks MCP over JSON-RPC 2.0 (Streamable HTTP, non-streaming) at `POST http://127.0.0.1:<port>/mcp`. Point any MCP client at it and send the token as `Authorization: Bearer <token>`. Quick check with `curl`:
+
+```bash
+TOKEN=<paste-from-tab>
+curl -s http://127.0.0.1:9877/mcp \
+  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
+  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
+```
+
+### Available tools
+
+- **Status / control:** `autorize_status`, `autorize_start`, `autorize_stop`, `autorize_clear_results`
+- **Findings:** `autorize_list_results`, `autorize_list_results_regex`, `autorize_get_result`, `autorize_send_to_repeater`
+- **Users:** `autorize_list_users`, `autorize_add_user` (one or many at once), `autorize_update_user`, `autorize_remove_user`, `autorize_get_last_headers` (the source behind the *Fetch Cookies/Authorization header* buttons — `autorize_update_user` can pull from it directly via `fetch_from_last_request`)
+- **Detectors & filters:** `autorize_get_filter_options`, `autorize_get_interception_filters` / `autorize_set_interception_filters`, `autorize_get_unauth_detector` / `autorize_set_unauth_detector` (per-user enforcement detectors and match/replace rules are configured through `autorize_add_user` / `autorize_update_user`, with all filter/rule types supported)
+- **Config & state:** `autorize_get_config`, `autorize_set_config`, `autorize_export` (HTML/CSV), `autorize_save_state`, `autorize_restore_state`
+
+Call `autorize_get_filter_options` first to retrieve the exact type strings accepted by the enforcement-detector, match/replace, and interception-filter tools.
+
 ---
 ## Limitations & Notes
 
diff --git a/gui/configuration_tab.py b/gui/configuration_tab.py
index 5cbd0ae..37cdf17 100644
--- a/gui/configuration_tab.py
+++ b/gui/configuration_tab.py
@@ -16,6 +16,18 @@
 from table import UpdateTableEDT
 
 
+def set_running(extender, running):
+    """Turn Autorize scanning on/off. Shared by the GUI toggle and MCP tools."""
+    if running:
+        extender.startButton.setText("Autorize is on")
+        extender.startButton.setSelected(True)
+        extender.intercept = 1
+    else:
+        extender.startButton.setText("Autorize is off")
+        extender.startButton.setSelected(False)
+        extender.intercept = 0
+
+
 class ClearTableRunnable(Runnable):
     """Runs on executor so EDT never blocks on _lock."""
     def __init__(self, extender):
@@ -206,14 +218,7 @@ def draw(self):
         self._extender._cfg_splitpane.setLeftComponent(self.config_pnl)
 
     def startOrStop(self, event):
-        if self._extender.startButton.getText() == "Autorize is off":
-            self._extender.startButton.setText("Autorize is on")
-            self._extender.startButton.setSelected(True)
-            self._extender.intercept = 1
-        else:
-            self._extender.startButton.setText("Autorize is off")
-            self._extender.startButton.setSelected(False)
-            self._extender.intercept = 0
+        set_running(self._extender, self._extender.startButton.getText() == "Autorize is off")
     
     def clearTable(self, event):
         # Run on executor so the EDT never blocks on _lock (avoids UI freeze)
diff --git a/gui/export.py b/gui/export.py
index e02ef5f..8ffbb38 100644
--- a/gui/export.py
+++ b/gui/export.py
@@ -246,42 +246,7 @@ def restoreStateAction(self, event):
         self.save_restore.restoreState()
 
     def shouldIncludeRow(self, logEntry, enforcementStatusFilter):
-        should_include = False
-        
-        if enforcementStatusFilter == "All Statuses":
-            should_include = True
-        elif enforcementStatusFilter == "As table filter":
-            if hasattr(self._extender, 'showBypassed') and hasattr(self._extender, 'showIsEnforced') and hasattr(self._extender, 'showEnforced'):
-                # Check unauthenticated status
-                unauth_status = logEntry._enfocementStatusUnauthorized
-                if ((self._extender.showBypassed.isSelected() and self.BYPASSSED_STR == unauth_status) or
-                    (self._extender.showIsEnforced.isSelected() and self.IS_ENFORCED_STR == unauth_status) or
-                    (self._extender.showEnforced.isSelected() and self.ENFORCED_STR == unauth_status) or
-                    ("Disabled" == unauth_status)):
-                    should_include = True
-                
-                for user_id in logEntry.get_all_users():
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data:
-                        user_status = user_data['enforcementStatus']
-                        if ((self._extender.showBypassed.isSelected() and self.BYPASSSED_STR == user_status) or
-                            (self._extender.showIsEnforced.isSelected() and self.IS_ENFORCED_STR == user_status) or
-                            (self._extender.showEnforced.isSelected() and self.ENFORCED_STR == user_status)):
-                            should_include = True
-                            break
-            else:
-                should_include = True
-        else:
-            if enforcementStatusFilter == logEntry._enfocementStatusUnauthorized:
-                should_include = True
-            else:
-                for user_id in logEntry.get_all_users():
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data and enforcementStatusFilter == user_data['enforcementStatus']:
-                        should_include = True
-                        break
-        
-        return should_include
+        return _should_include_row(self._extender, logEntry, enforcementStatusFilter)
 
     def exportToHTML(self):
         parentFrame = JFrame()
@@ -289,21 +254,92 @@ def exportToHTML(self):
         fileChooser.setSelectedFile(File("AutorizeReport.html"))
         fileChooser.setDialogTitle("Save Autorize Report")
         userSelection = fileChooser.showSaveDialog(parentFrame)
-        if userSelection == JFileChooser.APPROVE_OPTION:
-            fileToSave = fileChooser.getSelectedFile()
+        if userSelection != JFileChooser.APPROVE_OPTION:
+            return
+        fileToSave = fileChooser.getSelectedFile()
 
-        enforcementStatusFilter = self.exportES.getSelectedItem()
+        htmlContent = build_html_report(self._extender,
+                                        self.exportES.getSelectedItem(),
+                                        self.removeDuplicates.isSelected())
+        f = open(fileToSave.getAbsolutePath(), 'w')
+        f.writelines(htmlContent)
+        f.close()
 
-        header_html = "<thead><tr><th width=\"3%\">ID</th><th width=\"5%\">Method</th><th width=\"30%\">URL</th><th width=\"7%\">Original length</th><th width=\"7%\">Unauth length</th><th width=\"10%\">Unauth Status</th>"
-        
-        if hasattr(self._extender, 'userTab') and self._extender.userTab:
-            for user_id in sorted(self._extender.userTab.user_tabs.keys()):
-                user_name = self._extender.userTab.user_tabs[user_id]['user_name']
-                header_html += "<th width=\"7%\">{} Len</th><th width=\"10%\">{} Status</th>".format(user_name, user_name)
-        
-        header_html += "</tr></thead>"
-        
-        htmlContent = """<html><title>Autorize Report by Barak Tawily</title>
+    def exportToCSV(self):
+        parentFrame = JFrame()
+        fileChooser = JFileChooser()
+        fileChooser.setSelectedFile(File("AutorizeReport.csv"))
+        fileChooser.setDialogTitle("Save Autorize Report")
+        userSelection = fileChooser.showSaveDialog(parentFrame)
+        if userSelection != JFileChooser.APPROVE_OPTION:
+            return
+        fileToSave = fileChooser.getSelectedFile()
+
+        csvContent = build_csv_report(self._extender,
+                                      self.exportES.getSelectedItem(),
+                                      self.removeDuplicates.isSelected())
+        f = open(fileToSave.getAbsolutePath(), 'w')
+        f.writelines(csvContent)
+        f.close()
+
+
+def _should_include_row(extender, logEntry, enforcementStatusFilter):
+    BYPASSSED_STR = extender.BYPASSSED_STR
+    ENFORCED_STR = extender.ENFORCED_STR
+    IS_ENFORCED_STR = extender.IS_ENFORCED_STR
+    should_include = False
+
+    if enforcementStatusFilter == "All Statuses":
+        should_include = True
+    elif enforcementStatusFilter == "As table filter":
+        if hasattr(extender, 'showBypassed') and hasattr(extender, 'showIsEnforced') and hasattr(extender, 'showEnforced'):
+            unauth_status = logEntry._enfocementStatusUnauthorized
+            if ((extender.showBypassed.isSelected() and BYPASSSED_STR == unauth_status) or
+                (extender.showIsEnforced.isSelected() and IS_ENFORCED_STR == unauth_status) or
+                (extender.showEnforced.isSelected() and ENFORCED_STR == unauth_status) or
+                ("Disabled" == unauth_status)):
+                should_include = True
+
+            for user_id in logEntry.get_all_users():
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data:
+                    user_status = user_data['enforcementStatus']
+                    if ((extender.showBypassed.isSelected() and BYPASSSED_STR == user_status) or
+                        (extender.showIsEnforced.isSelected() and IS_ENFORCED_STR == user_status) or
+                        (extender.showEnforced.isSelected() and ENFORCED_STR == user_status)):
+                        should_include = True
+                        break
+        else:
+            should_include = True
+    else:
+        if enforcementStatusFilter == logEntry._enfocementStatusUnauthorized:
+            should_include = True
+        else:
+            for user_id in logEntry.get_all_users():
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data and enforcementStatusFilter == user_data['enforcementStatus']:
+                    should_include = True
+                    break
+
+    return should_include
+
+
+def build_html_report(extender, enforcementStatusFilter, removeDuplicates):
+    BYPASSSED_STR = extender.BYPASSSED_STR
+    ENFORCED_STR = extender.ENFORCED_STR
+    IS_ENFORCED_STR = extender.IS_ENFORCED_STR
+    log = extender._log
+
+    header_html = "<thead><tr><th width=\"3%\">ID</th><th width=\"5%\">Method</th><th width=\"30%\">URL</th><th width=\"7%\">Original length</th><th width=\"7%\">Unauth length</th><th width=\"10%\">Unauth Status</th>"
+
+    if hasattr(extender, 'userTab') and extender.userTab:
+        for user_id in sorted(extender.userTab.user_tabs.keys()):
+            user_name = extender.userTab.user_tabs[user_id]['user_name']
+            header_html += "<th width=\"7%\">{} Len</th><th width=\"10%\">{} Status</th>".format(user_name, user_name)
+
+    header_html += "</tr></thead>"
+
+    htmlContent = """<html><title>Autorize Report by Barak Tawily</title>
         <style>
         .datagrid table { border-collapse: collapse; text-align: left; width: 100%; }
             .datagrid {font: normal 12px/150% Arial, Helvetica, sans-serif; background: #fff; overflow: hidden; border: 1px solid #006699; -webkit-border-radius: 3px; -moz-border-radius: 3px; border-radius: 3px; }
@@ -331,141 +367,128 @@ def exportToHTML(self):
         <h1>Autorize Report<h1>
         <div class="datagrid"><table>""" + header_html + """
         <tbody>"""
-        
-        unique_HTML_lines = set()
-        for i in range(0, self._log.size()):
-            logEntry = self._log.get(i)
-            
-            if self.removeDuplicates.isSelected():
-                user_statuses = []
-                for user_id in sorted(logEntry.get_all_users()):
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data:
-                        user_statuses.append(user_data['enforcementStatus'])
-                
-                lineData = "\t%s\t%s\t%s\t%s" % (logEntry._method, logEntry._url, 
-                                                logEntry._enfocementStatusUnauthorized, 
-                                                "\t".join(user_statuses))
-                if lineData in unique_HTML_lines:
-                    continue
-                else:
-                    unique_HTML_lines.add(lineData)
 
-            if not self.shouldIncludeRow(logEntry, enforcementStatusFilter):
+    unique_HTML_lines = set()
+    for i in range(0, log.size()):
+        logEntry = log.get(i)
+
+        if removeDuplicates:
+            user_statuses = []
+            for user_id in sorted(logEntry.get_all_users()):
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data:
+                    user_statuses.append(user_data['enforcementStatus'])
+
+            lineData = "\t%s\t%s\t%s\t%s" % (logEntry._method, logEntry._url,
+                                            logEntry._enfocementStatusUnauthorized,
+                                            "\t".join(user_statuses))
+            if lineData in unique_HTML_lines:
                 continue
+            else:
+                unique_HTML_lines.add(lineData)
+
+        if not _should_include_row(extender, logEntry, enforcementStatusFilter):
+            continue
+
+        row_html = "<tr><td>%d</td><td>%s</td><td><a href=\"%s\">%s</a></td>" % (
+            logEntry._id, logEntry._method, logEntry._url, logEntry._url)
+
+        orig_len = len(logEntry._originalrequestResponse.getResponse()) if logEntry._originalrequestResponse else 0
+        row_html += "<td>%d</td>" % orig_len
+
+        unauth_len = 0
+        if logEntry._unauthorizedRequestResponse:
+            unauth_len = len(logEntry._unauthorizedRequestResponse.getResponse())
+
+        unauth_color = ""
+        if logEntry._enfocementStatusUnauthorized == BYPASSSED_STR:
+            unauth_color = "red"
+        elif logEntry._enfocementStatusUnauthorized == IS_ENFORCED_STR:
+            unauth_color = "yellow"
+        elif logEntry._enfocementStatusUnauthorized == ENFORCED_STR:
+            unauth_color = "LawnGreen"
+
+        row_html += "<td>%d</td><td bgcolor=\"%s\">%s</td>" % (unauth_len, unauth_color, logEntry._enfocementStatusUnauthorized)
+
+        if hasattr(extender, 'userTab') and extender.userTab:
+            for user_id in sorted(extender.userTab.user_tabs.keys()):
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data and user_data['requestResponse']:
+                    user_len = len(user_data['requestResponse'].getResponse())
+                    user_status = user_data['enforcementStatus']
+
+                    user_color = ""
+                    if user_status == BYPASSSED_STR:
+                        user_color = "red"
+                    elif user_status == IS_ENFORCED_STR:
+                        user_color = "yellow"
+                    elif user_status == ENFORCED_STR:
+                        user_color = "LawnGreen"
+
+                    row_html += "<td>%d</td><td bgcolor=\"%s\">%s</td>" % (user_len, user_color, user_status)
+                else:
+                    row_html += "<td>0</td><td>N/A</td>"
 
-            row_html = "<tr><td>%d</td><td>%s</td><td><a href=\"%s\">%s</a></td>" % (
-                logEntry._id, logEntry._method, logEntry._url, logEntry._url)
-
-            orig_len = len(logEntry._originalrequestResponse.getResponse()) if logEntry._originalrequestResponse else 0
-            row_html += "<td>%d</td>" % orig_len
-            
-            unauth_len = 0
-            if logEntry._unauthorizedRequestResponse:
-                unauth_len = len(logEntry._unauthorizedRequestResponse.getResponse())
-            
-            unauth_color = ""
-            if logEntry._enfocementStatusUnauthorized == self.BYPASSSED_STR:
-                unauth_color = "red"
-            elif logEntry._enfocementStatusUnauthorized == self.IS_ENFORCED_STR:
-                unauth_color = "yellow"
-            elif logEntry._enfocementStatusUnauthorized == self.ENFORCED_STR:
-                unauth_color = "LawnGreen"
-            
-            row_html += "<td>%d</td><td bgcolor=\"%s\">%s</td>" % (unauth_len, unauth_color, logEntry._enfocementStatusUnauthorized)
-            
-            # User data
-            if hasattr(self._extender, 'userTab') and self._extender.userTab:
-                for user_id in sorted(self._extender.userTab.user_tabs.keys()):
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data and user_data['requestResponse']:
-                        user_len = len(user_data['requestResponse'].getResponse())
-                        user_status = user_data['enforcementStatus']
-                        
-                        user_color = ""
-                        if user_status == self.BYPASSSED_STR:
-                            user_color = "red"
-                        elif user_status == self.IS_ENFORCED_STR:
-                            user_color = "yellow"
-                        elif user_status == self.ENFORCED_STR:
-                            user_color = "LawnGreen"
-                        
-                        row_html += "<td>%d</td><td bgcolor=\"%s\">%s</td>" % (user_len, user_color, user_status)
-                    else:
-                        row_html += "<td>0</td><td>N/A</td>"
-            
-            row_html += "</tr>"
-            htmlContent += row_html
-
-        htmlContent += "</tbody></table></div></body></html>"
-        f = open(fileToSave.getAbsolutePath(), 'w')
-        f.writelines(htmlContent)
-        f.close()
-        
-    def exportToCSV(self):
-        parentFrame = JFrame()
-        fileChooser = JFileChooser()
-        fileChooser.setSelectedFile(File("AutorizeReport.csv"))
-        fileChooser.setDialogTitle("Save Autorize Report")
-        userSelection = fileChooser.showSaveDialog(parentFrame)
-        if userSelection == JFileChooser.APPROVE_OPTION:
-            fileToSave = fileChooser.getSelectedFile()
+        row_html += "</tr>"
+        htmlContent += row_html
 
-        enforcementStatusFilter = self.exportES.getSelectedItem()
-        
-        csvContent = "ID,Method,URL,Original Length,Unauth Length,Unauth Status"
-        
-        if hasattr(self._extender, 'userTab') and self._extender.userTab:
-            for user_id in sorted(self._extender.userTab.user_tabs.keys()):
-                user_name = self._extender.userTab.user_tabs[user_id]['user_name']
-                csvContent += ",{} Length,{} Status".format(user_name, user_name)
-        
-        csvContent += "\n"
-
-        unique_CSV_lines = set()
-        for i in range(0, self._log.size()):
-            logEntry = self._log.get(i)
-            
-            if self.removeDuplicates.isSelected():
-                user_statuses = []
-                for user_id in sorted(logEntry.get_all_users()):
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data:
-                        user_statuses.append(user_data['enforcementStatus'])
-                
-                lineData = ",{},{},{},{}".format(logEntry._method, logEntry._url, 
-                                                logEntry._enfocementStatusUnauthorized, 
-                                                ",".join(user_statuses))
-                if lineData in unique_CSV_lines:
-                    continue
-                else:
-                    unique_CSV_lines.add(lineData)
+    htmlContent += "</tbody></table></div></body></html>"
+    return htmlContent
+
+
+def build_csv_report(extender, enforcementStatusFilter, removeDuplicates):
+    log = extender._log
+
+    csvContent = "ID,Method,URL,Original Length,Unauth Length,Unauth Status"
+
+    if hasattr(extender, 'userTab') and extender.userTab:
+        for user_id in sorted(extender.userTab.user_tabs.keys()):
+            user_name = extender.userTab.user_tabs[user_id]['user_name']
+            csvContent += ",{} Length,{} Status".format(user_name, user_name)
+
+    csvContent += "\n"
+
+    unique_CSV_lines = set()
+    for i in range(0, log.size()):
+        logEntry = log.get(i)
+
+        if removeDuplicates:
+            user_statuses = []
+            for user_id in sorted(logEntry.get_all_users()):
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data:
+                    user_statuses.append(user_data['enforcementStatus'])
 
-            if not self.shouldIncludeRow(logEntry, enforcementStatusFilter):
+            lineData = ",{},{},{},{}".format(logEntry._method, logEntry._url,
+                                            logEntry._enfocementStatusUnauthorized,
+                                            ",".join(user_statuses))
+            if lineData in unique_CSV_lines:
                 continue
+            else:
+                unique_CSV_lines.add(lineData)
 
-            orig_len = len(logEntry._originalrequestResponse.getResponse()) if logEntry._originalrequestResponse else 0
-            unauth_len = len(logEntry._unauthorizedRequestResponse.getResponse()) if logEntry._unauthorizedRequestResponse else 0
-            
-            url_safe = '"{}"'.format(str(logEntry._url).replace('"', '""'))
-            
-            csv_row = '{},{},{},{},{},"{}"'.format(
-                logEntry._id, logEntry._method, url_safe, orig_len, unauth_len, logEntry._enfocementStatusUnauthorized)
-            
-            # User data
-            if hasattr(self._extender, 'userTab') and self._extender.userTab:
-                for user_id in sorted(self._extender.userTab.user_tabs.keys()):
-                    user_data = logEntry.get_user_enforcement(user_id)
-                    if user_data and user_data['requestResponse']:
-                        user_len = len(user_data['requestResponse'].getResponse())
-                        user_status = user_data['enforcementStatus']
-                        csv_row += ',{},"{}"'.format(user_len, user_status)
-                    else:
-                        csv_row += ',0,"N/A"'
-            
-            csv_row += "\n"
-            csvContent += csv_row
+        if not _should_include_row(extender, logEntry, enforcementStatusFilter):
+            continue
 
-        f = open(fileToSave.getAbsolutePath(), 'w')
-        f.writelines(csvContent)
-        f.close()
\ No newline at end of file
+        orig_len = len(logEntry._originalrequestResponse.getResponse()) if logEntry._originalrequestResponse else 0
+        unauth_len = len(logEntry._unauthorizedRequestResponse.getResponse()) if logEntry._unauthorizedRequestResponse else 0
+
+        url_safe = '"{}"'.format(str(logEntry._url).replace('"', '""'))
+
+        csv_row = '{},{},{},{},{},"{}"'.format(
+            logEntry._id, logEntry._method, url_safe, orig_len, unauth_len, logEntry._enfocementStatusUnauthorized)
+
+        if hasattr(extender, 'userTab') and extender.userTab:
+            for user_id in sorted(extender.userTab.user_tabs.keys()):
+                user_data = logEntry.get_user_enforcement(user_id)
+                if user_data and user_data['requestResponse']:
+                    user_len = len(user_data['requestResponse'].getResponse())
+                    user_status = user_data['enforcementStatus']
+                    csv_row += ',{},"{}"'.format(user_len, user_status)
+                else:
+                    csv_row += ',0,"N/A"'
+
+        csv_row += "\n"
+        csvContent += csv_row
+
+    return csvContent
\ No newline at end of file
diff --git a/gui/mcp_tab.py b/gui/mcp_tab.py
new file mode 100644
index 0000000..d01e3ee
--- /dev/null
+++ b/gui/mcp_tab.py
@@ -0,0 +1,83 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from javax.swing import JPanel
+from javax.swing import JLabel
+from javax.swing import JButton
+from javax.swing import JCheckBox
+from javax.swing import JTextField
+from javax.swing import BoxLayout
+from java.awt import FlowLayout
+from java.awt import Component
+from java.awt import Toolkit
+from java.awt.datatransfer import StringSelection
+
+
+class MCPServerTab():
+    def __init__(self, extender):
+        self._extender = extender
+
+    def draw(self):
+        """ init the MCP Server tab """
+        ext = self._extender
+
+        ext.mcpEnabled = JCheckBox("Enable MCP Server", actionPerformed=self.toggle)
+
+        ext.mcpPortField = JTextField("9877", 6)
+
+        ext.mcpTokenField = JTextField("", 40)
+        ext.mcpTokenField.setEditable(False)
+
+        self.regenButton = JButton("Regenerate Token", actionPerformed=self.regenerate)
+        self.copyButton = JButton("Copy Token", actionPerformed=self.copy_token)
+
+        ext.mcpStatusLabel = JLabel("Stopped")
+
+        info = JLabel("Loopback-only (127.0.0.1) MCP endpoint at POST /mcp. "
+                      "Every request requires the header:  Authorization: Bearer <token>")
+
+        pnl = JPanel()
+        pnl.setLayout(BoxLayout(pnl, BoxLayout.Y_AXIS))
+
+        def row(*components):
+            r = JPanel(FlowLayout(FlowLayout.LEFT))
+            r.setAlignmentX(Component.LEFT_ALIGNMENT)
+            for c in components:
+                r.add(c)
+            pnl.add(r)
+            return r
+
+        row(ext.mcpEnabled)
+        row(JLabel("Port:"), ext.mcpPortField)
+        row(JLabel("Token:"), ext.mcpTokenField, self.regenButton, self.copyButton)
+        row(JLabel("Status:"), ext.mcpStatusLabel)
+        row(info)
+
+        ext.mcpPnl = pnl
+
+    def toggle(self, event):
+        ext = self._extender
+        mcp = getattr(ext, 'mcp', None)
+        if ext.mcpEnabled.isSelected():
+            try:
+                port = int(ext.mcpPortField.getText().strip())
+            except (ValueError, AttributeError):
+                ext.mcpStatusLabel.setText("Invalid port")
+                ext.mcpEnabled.setSelected(False)
+                return
+            if mcp is not None:
+                mcp.start(port)
+        else:
+            if mcp is not None:
+                mcp.stop()
+
+    def regenerate(self, event):
+        mcp = getattr(self._extender, 'mcp', None)
+        if mcp is not None:
+            mcp.regenerate_token()
+
+    def copy_token(self, event):
+        token = self._extender.mcpTokenField.getText()
+        if token:
+            clipboard = Toolkit.getDefaultToolkit().getSystemClipboard()
+            clipboard.setContents(StringSelection(token), None)
diff --git a/gui/save_restore.py b/gui/save_restore.py
index 197460b..8f9da4b 100644
--- a/gui/save_restore.py
+++ b/gui/save_restore.py
@@ -22,6 +22,15 @@
         maxInt = int(maxInt/10)
         decrement = True
 
+class _PathFile():
+    """Minimal shim so restore_state_from_path can reuse the file-chooser body."""
+    def __init__(self, path):
+        self._path = path
+
+    def getAbsolutePath(self):
+        return self._path
+
+
 class SaveRestore():
     def __init__(self, extender):
         self._extender = extender
@@ -45,7 +54,10 @@ def saveState(self):
 
         if userSelection == JFileChooser.APPROVE_OPTION:
             exportFile = fileChooser.getSelectedFile()
-            with open(exportFile.getAbsolutePath(), 'wb') as csvfile:
+            self.save_state_to_path(exportFile.getAbsolutePath())
+
+    def save_state_to_path(self, path):
+            with open(path, 'wb') as csvfile:
                 csvwriter = csv.writer(csvfile, delimiter='\t', quotechar='|', quoting=csv.QUOTE_MINIMAL)
 
                 # Configuration
@@ -83,6 +95,15 @@ def saveState(self):
                 tempRow = ["CheckBoxes", json.dumps(d)]
                 csvwriter.writerow(tempRow)
 
+                # MCP server config (enabled flag + port only; the bearer token is
+                # in-memory only and is deliberately never persisted/exported).
+                if hasattr(self._extender, 'mcpEnabled') and hasattr(self._extender, 'mcpPortField'):
+                    mcp_cfg = {
+                        "enabled": self._extender.mcpEnabled.isSelected(),
+                        "port": self._extender.mcpPortField.getText(),
+                    }
+                    csvwriter.writerow(["MCPConfig", json.dumps(mcp_cfg)])
+
                 # Request/response list
                 for i in range(0, self._extender._log.size()):
                     logEntry = self._extender._log.get(i)
@@ -141,7 +162,12 @@ def restoreState(self):
 
         if userSelection == JFileChooser.APPROVE_OPTION:
             importFile = fileChooser.getSelectedFile()
-            
+            self.restore_state_from_path(importFile.getAbsolutePath())
+
+    def restore_state_from_path(self, path):
+        if True:
+            importFile = _PathFile(path)
+
             self._extender._log.clear()
             self._extender.tableModel.fireTableDataChanged()
             
@@ -210,6 +236,29 @@ def restoreState(self):
                             getattr(self._extender, k).setSelected(d[k])
                         continue
 
+                    if row[0] == "MCPConfig":
+                        try:
+                            mcp_cfg = json.loads(row[1])
+                            if hasattr(self._extender, 'mcpPortField') and mcp_cfg.get("port"):
+                                self._extender.mcpPortField.setText(str(mcp_cfg["port"]))
+                            mcp = getattr(self._extender, 'mcp', None)
+                            want_enabled = bool(mcp_cfg.get("enabled"))
+                            if hasattr(self._extender, 'mcpEnabled'):
+                                self._extender.mcpEnabled.setSelected(want_enabled)
+                            if mcp is not None:
+                                if want_enabled:
+                                    try:
+                                        port = int(self._extender.mcpPortField.getText().strip())
+                                    except (ValueError, AttributeError):
+                                        port = None
+                                    if port is not None:
+                                        mcp.start(port)
+                                else:
+                                    mcp.stop()
+                        except Exception:
+                            pass
+                        continue
+
                     if row[0] == "RemoveDuplicates":
                         isSelected = json.loads(row[1])
                         try:
diff --git a/gui/user_tab.py b/gui/user_tab.py
index 36e5d30..7521faa 100644
--- a/gui/user_tab.py
+++ b/gui/user_tab.py
@@ -176,37 +176,68 @@ def add_user(self):
 
         self.refreshTableStructure()
 
-    def remove_user(self):
+    def remove_user(self, user_id=None):
         if self.userTabs.getTabCount() <= 1:
             JOptionPane.showMessageDialog(None, "Cannot remove the last user!", "Warning", JOptionPane.WARNING_MESSAGE)
             return
-        
-        selected_index = self.userTabs.getSelectedIndex()
 
-        if selected_index >= 0:
+        # When no explicit user_id is given (GUI button), operate on the selected tab.
+        if user_id is None:
+            selected_index = self.userTabs.getSelectedIndex()
+            if selected_index < 0:
+                return
             selected_panel = self.userTabs.getComponentAt(selected_index)
-
-            user_id_to_remove = None
-            user_name_to_remove = None
-
-            for user_id, user_data in self.user_tabs.items():
+            for uid, user_data in self.user_tabs.items():
                 if user_data['panel'] == selected_panel:
-                    user_id_to_remove = user_id
-                    user_name_to_remove = user_data['user_name']
+                    user_id = uid
                     break
 
-            if user_id_to_remove and user_name_to_remove:
-                if user_name_to_remove in self.user_names:
-                    self.user_names.remove(user_name_to_remove)
+        if user_id is None or user_id not in self.user_tabs:
+            return
 
-                del self.user_tabs[user_id_to_remove]
+        user_data = self.user_tabs[user_id]
+        user_name_to_remove = user_data['user_name']
+        tab_index = self.userTabs.indexOfComponent(user_data['panel'])
 
-                self.userTabs.removeTabAt(selected_index)
+        if user_name_to_remove in self.user_names:
+            self.user_names.remove(user_name_to_remove)
 
-                if hasattr(self._extender, 'tabs_instance') and self._extender.tabs_instance:
-                    self._extender.tabs_instance.removeUserViewerTabs(user_id_to_remove)
+        del self.user_tabs[user_id]
 
-                self.refreshTableStructure()
+        if tab_index >= 0:
+            self.userTabs.removeTabAt(tab_index)
+
+        if hasattr(self._extender, 'tabs_instance') and self._extender.tabs_instance:
+            self._extender.tabs_instance.removeUserViewerTabs(user_id)
+
+        self.refreshTableStructure()
+
+    def set_user_name(self, user_id, new_name):
+        """Programmatically rename a user (used by the MCP tools). Returns the
+        unique name actually assigned, or None if the rename was rejected."""
+        if user_id not in self.user_tabs or not new_name or not new_name.strip():
+            return None
+
+        user_data = self.user_tabs[user_id]
+        old_name = user_data['user_name']
+        if old_name in self.user_names:
+            self.user_names.remove(old_name)
+
+        unique_name = self.get_unique_name(new_name.strip())
+        self.user_names.append(unique_name)
+
+        tab_index = self.userTabs.indexOfComponent(user_data['panel'])
+        if tab_index >= 0:
+            self.userTabs.setTitleAt(tab_index, unique_name)
+
+        user_data['header_label'].setText(unique_name)
+        user_data['user_name'] = unique_name
+
+        if hasattr(self._extender, 'tabs_instance') and self._extender.tabs_instance:
+            self._extender.tabs_instance.renameUserViewerTabs(user_id, unique_name)
+
+        self.refreshTableStructure()
+        return unique_name
 
     def reset_user(self):
         self.userTabs.removeAll()
diff --git a/helpers/initiator.py b/helpers/initiator.py
index 32b8add..163f161 100644
--- a/helpers/initiator.py
+++ b/helpers/initiator.py
@@ -4,6 +4,7 @@
 from gui.enforcement_detector import EnforcementDetectors
 from gui.interception_filters import InterceptionFilters
 from gui.configuration_tab import ConfigurationTab
+from gui.mcp_tab import MCPServerTab
 from gui.match_replace import MatchReplace
 from gui.tabs import Tabs, ITabImpl
 from gui.table import TableFilter
@@ -45,6 +46,7 @@ def draw_all(self):
     
         export = Export(self._extender)
         export.draw()
+        self._extender.save_restore_instance = export.save_restore
 
         match_replace = MatchReplace(self._extender)
         match_replace.draw()
@@ -54,6 +56,11 @@ def draw_all(self):
 
         cfg_tab = ConfigurationTab(self._extender)
         cfg_tab.draw()
+        self._extender.configuration_tab_instance = cfg_tab
+
+        mcp_tab = MCPServerTab(self._extender)
+        mcp_tab.draw()
+        self._extender.filtersTabs.addTab("MCP Server", self._extender.mcpPnl)
 
         user_tab = UserTab(self._extender)
         user_tab.draw()
@@ -81,6 +88,18 @@ def init_ui(self):
         self._extender._callbacks.customizeUiComponent(self._extender.tabs)
         self._extender._callbacks.customizeUiComponent(self._extender.filtersTabs)
 
+    def init_mcp(self):
+        try:
+            # Eagerly import the request-handling modules so any load-time error
+            # surfaces now (at extension load) rather than on the first request.
+            from mcp import protocol as _protocol  # noqa: F401 (imports tools + edt)
+            from mcp.server import McpServer
+            self._extender.mcp = McpServer(self._extender)
+            self._extender.mcp.load_settings_and_maybe_autostart()
+        except Exception as e:
+            self._extender.mcp = None
+            print("[Autorize MCP] failed to initialize: %s" % e)
+
     def print_welcome_message(self):
         print("""Thank you for installing Autorize v{} extension
 Created by Barak Tawily
diff --git a/mcp/__init__.py b/mcp/__init__.py
new file mode 100644
index 0000000..20924ed
--- /dev/null
+++ b/mcp/__init__.py
@@ -0,0 +1,6 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Autorize embedded MCP (Model Context Protocol) server package.
+# Exposes Autorize's findings and configuration as MCP tools over a
+# loopback-only, token-authenticated HTTP JSON-RPC endpoint.
diff --git a/mcp/edt.py b/mcp/edt.py
new file mode 100644
index 0000000..2511067
--- /dev/null
+++ b/mcp/edt.py
@@ -0,0 +1,56 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Concurrency helpers for the MCP layer.
+#
+# Two categories of Autorize state, each with exactly one access rule:
+#   1. _log / LogEntry / IHttpRequestResponse data  -> snapshot_log() (brief lock)
+#   2. any Swing-backed state (JCheckBox/JTextArea/DefaultListModel/JTabbedPane,
+#      userTab.*, EDModel, MRModel, IFModel, ...)   -> run_on_edt()
+#
+# MCP handler threads are never the EDT, so run_on_edt() always dispatches via
+# invokeAndWait. Never call run_on_edt() while holding extender._lock.
+
+from javax.swing import SwingUtilities
+from java.lang import Runnable
+
+
+class _EDTCall(Runnable):
+    def __init__(self, fn):
+        self.fn = fn
+        self.result = None
+        self.exception = None
+
+    def run(self):
+        try:
+            self.result = self.fn()
+        except Exception as e:
+            self.exception = e
+
+
+def run_on_edt(fn):
+    """Run fn() synchronously on the Swing EDT and return its result.
+
+    Required for any read or write of Swing-backed Autorize state.
+    """
+    if SwingUtilities.isEventDispatchThread():
+        return fn()
+    call = _EDTCall(fn)
+    SwingUtilities.invokeAndWait(call)
+    if call.exception is not None:
+        raise call.exception
+    return call.result
+
+
+def snapshot_log(extender):
+    """Take a quick, lock-protected snapshot of LogEntry references.
+
+    Mirrors the lock discipline in authorization.checkAuthorizationAllUsers and
+    gui.configuration_tab.ClearTableRunnable. No slow work is done under the lock;
+    callers format/serialize the returned entries outside of it.
+    """
+    extender._lock.acquire()
+    try:
+        return list(extender._log.toArray())
+    finally:
+        extender._lock.release()
diff --git a/mcp/protocol.py b/mcp/protocol.py
new file mode 100644
index 0000000..5b0ac46
--- /dev/null
+++ b/mcp/protocol.py
@@ -0,0 +1,83 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Minimal MCP over JSON-RPC 2.0 (Streamable HTTP transport, non-streaming).
+# Supports: initialize, notifications/initialized, ping, tools/list, tools/call.
+# Stateless (no Mcp-Session-Id), no SSE, no batching.
+
+import json
+
+from mcp import tools as tools_module
+
+PROTOCOL_VERSION = "2025-06-18"
+
+
+def _error(msg_id, code, message):
+    return {"jsonrpc": "2.0", "id": msg_id, "error": {"code": code, "message": message}}
+
+
+def _result(msg_id, result):
+    return {"jsonrpc": "2.0", "id": msg_id, "result": result}
+
+
+def handle_request(server, body_text):
+    """Return (http_status, response_text). An empty response_text means no body."""
+    if not body_text:
+        return (400, json.dumps(_error(None, -32600, "empty request")))
+
+    try:
+        payload = json.loads(body_text)
+    except Exception:
+        return (400, json.dumps(_error(None, -32700, "parse error")))
+
+    if isinstance(payload, list):
+        return (400, json.dumps(_error(None, -32600, "batch requests are not supported")))
+    if not isinstance(payload, dict):
+        return (400, json.dumps(_error(None, -32600, "invalid request")))
+
+    method = payload.get("method")
+    msg_id = payload.get("id")
+    params = payload.get("params") or {}
+
+    if method == "notifications/initialized":
+        return (202, "")
+
+    if method is None:
+        return (400, json.dumps(_error(msg_id, -32600, "missing method")))
+
+    if method == "initialize":
+        result = {
+            "protocolVersion": PROTOCOL_VERSION,
+            "capabilities": {"tools": {}},
+            "serverInfo": {"name": "autorize-mcp",
+                           "version": getattr(server.extender, 'version', '')},
+        }
+        return (200, json.dumps(_result(msg_id, result)))
+
+    if method == "ping":
+        return (200, json.dumps(_result(msg_id, {})))
+
+    if method == "tools/list":
+        return (200, json.dumps(_result(msg_id, {"tools": tools_module.list_tools()})))
+
+    if method == "tools/call":
+        name = params.get("name")
+        arguments = params.get("arguments") or {}
+        handler = tools_module.get_handler(name)
+        if handler is None:
+            result = {"content": [{"type": "text", "text": "Unknown tool: %s" % name}],
+                      "isError": True}
+            return (200, json.dumps(_result(msg_id, result)))
+        try:
+            result_obj = handler(server, arguments)
+            result = {"content": [{"type": "text", "text": json.dumps(result_obj)}],
+                      "isError": False}
+        except Exception as e:
+            result = {"content": [{"type": "text", "text": "Error: %s" % str(e)}],
+                      "isError": True}
+        return (200, json.dumps(_result(msg_id, result)))
+
+    # Unknown notification (no id) -> accept silently; unknown request -> error.
+    if msg_id is None:
+        return (202, "")
+    return (200, json.dumps(_error(msg_id, -32601, "method not found: %s" % method)))
diff --git a/mcp/server.py b/mcp/server.py
new file mode 100644
index 0000000..5cca889
--- /dev/null
+++ b/mcp/server.py
@@ -0,0 +1,271 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# Loopback-only, token-authenticated HTTP JSON-RPC endpoint that speaks MCP.
+#
+# Implemented directly on java.net.ServerSocket (java.base) rather than
+# com.sun.net.httpserver, because Burp's bundled/trimmed JRE does not include
+# the jdk.httpserver module.
+#
+# Security model: the results table can hold live session cookies / Authorization
+# headers, so the server binds to 127.0.0.1 only and requires a bearer token
+# (generated with SecureRandom at start, held in memory only, never persisted).
+
+import jarray
+
+from java.net import ServerSocket, InetAddress
+from java.util.concurrent import Executors
+from java.security import SecureRandom, MessageDigest
+from java.io import ByteArrayOutputStream, BufferedInputStream
+from java.lang import String as JString
+from java.lang import Thread as JThread
+from java.lang import Runnable
+
+DEFAULT_PORT = 9877
+
+_REASONS = {
+    200: "OK", 202: "Accepted", 400: "Bad Request", 401: "Unauthorized",
+    404: "Not Found", 405: "Method Not Allowed", 500: "Internal Server Error",
+}
+
+
+def _generate_token():
+    raw = jarray.zeros(32, 'b')
+    SecureRandom().nextBytes(raw)
+    return ''.join('%02x' % (b & 0xff) for b in raw)
+
+
+def _tokens_equal(a, b):
+    if a is None or b is None:
+        return False
+    return MessageDigest.isEqual(JString(a).getBytes("UTF-8"), JString(b).getBytes("UTF-8"))
+
+
+def _read_line(ins):
+    """Read one CRLF/LF-terminated line, returned as a python str (no line ending)."""
+    buf = ByteArrayOutputStream()
+    while True:
+        b = ins.read()
+        if b == -1:
+            break
+        if b == 0x0a:  # \n
+            break
+        if b != 0x0d:  # skip \r
+            buf.write(b)
+    return str(buf.toString("UTF-8"))
+
+
+class _AcceptRunnable(Runnable):
+    def __init__(self, server):
+        self._server = server
+
+    def run(self):
+        self._server._accept_loop()
+
+
+class _ClientRunnable(Runnable):
+    def __init__(self, server, sock):
+        self._server = server
+        self._sock = sock
+
+    def run(self):
+        self._server._handle_socket(self._sock)
+
+
+class McpServer:
+    def __init__(self, extender):
+        self.extender = extender
+        self.port = DEFAULT_PORT
+        self.token = None
+        self._serversocket = None
+        self._executor = None
+        self._accept_thread = None
+        self._stopping = False
+        self._unauthorized_count = 0
+
+    # -- lifecycle ---------------------------------------------------------
+
+    def load_settings_and_maybe_autostart(self):
+        self._set_status("Stopped")
+        print("[Autorize MCP] server available (disabled by default).")
+
+    def start(self, port=None):
+        if self._serversocket is not None:
+            self.stop()
+        if port is None:
+            port = self.port or DEFAULT_PORT
+        self.port = port
+        self.token = _generate_token()
+        try:
+            self._serversocket = ServerSocket(port, 50, InetAddress.getByName("127.0.0.1"))
+            self._stopping = False
+            self._executor = Executors.newFixedThreadPool(4)
+            t = JThread(_AcceptRunnable(self))
+            t.setDaemon(True)
+            t.setName("Autorize-MCP-accept")
+            t.start()
+            self._accept_thread = t
+        except Exception as e:
+            self.token = None
+            self._teardown_sockets()
+            self._set_status("Error: %s" % e)
+            self._set_enabled_checkbox(False)
+            print("[Autorize MCP] failed to start on 127.0.0.1:%s: %s" % (port, e))
+            return
+        self._set_token_field(self.token)
+        self._set_status("Running on 127.0.0.1:%d" % port)
+        print("[Autorize MCP] server started on 127.0.0.1:%d" % port)
+
+    def stop(self):
+        self._stopping = True
+        self._teardown_sockets()
+        self.token = None
+        self._set_token_field("")
+        self._set_status("Stopped")
+        print("[Autorize MCP] server stopped")
+
+    def _teardown_sockets(self):
+        if self._serversocket is not None:
+            try:
+                self._serversocket.close()  # unblocks accept()
+            except Exception:
+                pass
+            self._serversocket = None
+        if self._executor is not None:
+            try:
+                self._executor.shutdownNow()
+            except Exception:
+                pass
+            self._executor = None
+        self._accept_thread = None
+
+    def regenerate_token(self):
+        if self._serversocket is None:
+            return
+        self.token = _generate_token()
+        self._set_token_field(self.token)
+        print("[Autorize MCP] token regenerated")
+
+    def is_running(self):
+        return self._serversocket is not None
+
+    # -- request handling --------------------------------------------------
+
+    def _accept_loop(self):
+        while not self._stopping:
+            try:
+                sock = self._serversocket.accept()
+            except Exception:
+                break  # socket closed on stop()
+            try:
+                self._executor.submit(_ClientRunnable(self, sock))
+            except Exception:
+                try:
+                    sock.close()
+                except Exception:
+                    pass
+
+    def _handle_socket(self, sock):
+        try:
+            ins = BufferedInputStream(sock.getInputStream())
+            outs = sock.getOutputStream()
+
+            request_line = _read_line(ins)
+            if not request_line:
+                return
+            parts = request_line.split(" ")
+            method = parts[0] if len(parts) > 0 else ""
+            path = parts[1] if len(parts) > 1 else ""
+
+            headers = {}
+            while True:
+                line = _read_line(ins)
+                if line == "":
+                    break
+                idx = line.find(":")
+                if idx > 0:
+                    headers[line[:idx].strip().lower()] = line[idx + 1:].strip()
+
+            # Honor Expect: 100-continue (curl uses it for larger bodies).
+            if headers.get("expect", "").lower() == "100-continue":
+                outs.write(JString("HTTP/1.1 100 Continue\r\n\r\n").getBytes("UTF-8"))
+                outs.flush()
+
+            content_length = 0
+            try:
+                content_length = int(headers.get("content-length", "0"))
+            except ValueError:
+                content_length = 0
+
+            body_text = ""
+            if content_length > 0:
+                body = jarray.zeros(content_length, 'b')
+                read = 0
+                while read < content_length:
+                    n = ins.read(body, read, content_length - read)
+                    if n == -1:
+                        break
+                    read += n
+                body_text = self.extender._helpers.bytesToString(body)
+
+            if path.split("?")[0] != "/mcp":
+                self._write(outs, 404, '{"error":"not found"}')
+                return
+            if method != "POST":
+                self._write(outs, 405, '{"error":"method not allowed"}')
+                return
+
+            auth = headers.get("authorization")
+            provided = None
+            if auth and auth.startswith("Bearer "):
+                provided = auth[7:].strip()
+            if not _tokens_equal(provided, self.token):
+                self._unauthorized_count += 1
+                self._write(outs, 401,
+                            '{"jsonrpc":"2.0","id":null,"error":{"code":-32001,"message":"unauthorized"}}')
+                return
+
+            from mcp.protocol import handle_request
+            status, resp_text = handle_request(self, body_text)
+            self._write(outs, status, resp_text)
+        except Exception as e:
+            print("[Autorize MCP] request error: %s" % e)
+        finally:
+            try:
+                sock.close()
+            except Exception:
+                pass
+
+    def _write(self, outs, status, text):
+        reason = _REASONS.get(status, "OK")
+        if text:
+            body = JString(text).getBytes("UTF-8")
+            length = len(body)
+        else:
+            body = None
+            length = 0
+        head = ("HTTP/1.1 %d %s\r\n"
+                "Content-Type: application/json\r\n"
+                "Content-Length: %d\r\n"
+                "Connection: close\r\n\r\n") % (status, reason, length)
+        outs.write(JString(head).getBytes("UTF-8"))
+        if body is not None:
+            outs.write(body)
+        outs.flush()
+
+    # -- UI helpers (safe if widgets not yet built) ------------------------
+
+    def _set_status(self, text):
+        label = getattr(self.extender, 'mcpStatusLabel', None)
+        if label is not None:
+            label.setText(text)
+
+    def _set_token_field(self, text):
+        field = getattr(self.extender, 'mcpTokenField', None)
+        if field is not None:
+            field.setText(text)
+
+    def _set_enabled_checkbox(self, selected):
+        box = getattr(self.extender, 'mcpEnabled', None)
+        if box is not None:
+            box.setSelected(selected)
diff --git a/mcp/tools.py b/mcp/tools.py
new file mode 100644
index 0000000..c2188f2
--- /dev/null
+++ b/mcp/tools.py
@@ -0,0 +1,895 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+# MCP tool registry for Autorize. Each tool is (name, description, inputSchema,
+# handler). Handlers receive (server, arguments) and return a JSON-serializable
+# object; the protocol layer wraps that into an MCP tools/call result.
+
+import re
+
+from mcp.edt import run_on_edt, snapshot_log
+
+
+# ---------------------------------------------------------------------------
+# Option vocabularies (kept in sync with the GUI combo boxes)
+# ---------------------------------------------------------------------------
+
+# gui/enforcement_detector.py EDStrings (per-user and unauthenticated detector)
+ENFORCEMENT_DETECTOR_TYPES = [
+    "Headers (simple string): (enforced message headers contain)",
+    "Headers NOT (simple string): (enforced message headers NOT contain)",
+    "Headers (regex): (enforced message headers contain)",
+    "Headers NOT (regex): (enforced message headers NOT contain)",
+    "Body (simple string): (enforced message body contains)",
+    "Body NOT (simple string): (enforced message body NOT contains)",
+    "Body (regex): (enforced message body contains)",
+    "Body NOT (regex): (enforced message body NOT contains)",
+    "Full response (simple string): (enforced message contains)",
+    "Full response NOT (simple string): (enforced message NOT contains)",
+    "Full response (regex): (enforced message contains)",
+    "Full response NOT (regex): (enforced message NOT contains)",
+    "Full response length: (of enforced response)",
+    "Full response NOT length: (of enforced response)",
+    "Status code equals: (numbers only)",
+    "Status code NOT equals: (numbers only)",
+]
+
+# gui/match_replace.py MRStrings
+MATCH_REPLACE_TYPES = [
+    "Headers (simple string):",
+    "Headers (regex):",
+    "Body (simple string):",
+    "Body (regex):",
+    "Path (simple string):",
+    "Path (regex):",
+]
+
+# gui/interception_filters.py IFStrings
+INTERCEPTION_FILTER_TYPES = [
+    "Scope items only: (Content is not required)",
+    "URL Contains (simple string): ",
+    "URL Contains (regex): ",
+    "URL Not Contains (simple string): ",
+    "URL Not Contains (regex): ",
+    "Request Body contains (simple string): ",
+    "Request Body contains (regex): ",
+    "Request Body NOT contains (simple string): ",
+    "Request Body Not contains (regex): ",
+    "Response Body contains (simple string): ",
+    "Response Body contains (regex): ",
+    "Response Body NOT contains (simple string): ",
+    "Response Body Not contains (regex): ",
+    "Request headers contain: ",
+    "Request headers don't contain: ",
+    "Response headers contain: ",
+    "Response headers don't contain: ",
+    "Only HTTP methods (newline separated): ",
+    "Ignore HTTP methods (newline separated): ",
+    "Ignore spider requests: (Content is not required)",
+    "Ignore proxy requests: (Content is not required)",
+    "Ignore target requests: (Content is not required)",
+    "Ignore OPTIONS requests: (Content is not required)",
+    "Drop proxy listener ports: (Separated by comma)",
+]
+
+AND_OR_OPTIONS = ["And", "Or"]
+
+
+# ---------------------------------------------------------------------------
+# Small helpers
+# ---------------------------------------------------------------------------
+
+def _status_map(extender):
+    return {
+        "bypassed": extender.BYPASSSED_STR,
+        "enforced": extender.ENFORCED_STR,
+        "ambiguous": extender.IS_ENFORCED_STR,
+        "disabled": "Disabled",
+    }
+
+
+def _resp_length(extender, requestResponse):
+    if requestResponse is None or requestResponse.getResponse() is None:
+        return 0
+    response = requestResponse.getResponse()
+    try:
+        return len(response) - extender._helpers.analyzeResponse(response).getBodyOffset()
+    except Exception:
+        return len(response)
+
+
+def _msg_text(extender, requestResponse, which):
+    if requestResponse is None:
+        return None
+    data = requestResponse.getRequest() if which == "request" else requestResponse.getResponse()
+    if data is None:
+        return None
+    return extender._helpers.bytesToString(data)
+
+
+def _user_id_name_map(extender):
+    return run_on_edt(
+        lambda: dict((uid, ud['user_name']) for uid, ud in extender.userTab.user_tabs.items()))
+
+
+def _model_to_str_list(model):
+    return [str(model.getElementAt(i)) for i in range(model.getSize())]
+
+
+def _build_filter_entry(item):
+    """Accept a raw string (stored verbatim) or a {type, content} object and
+    return the canonical stored string used by addFilterHelper: 'Title: content'.
+    """
+    if isinstance(item, (str, unicode)):
+        return item
+    if isinstance(item, dict):
+        ftype = item.get("type", "")
+        content = item.get("content", "")
+        title = ftype.split(":")[0].strip()
+        return title + ": " + content
+    raise ValueError("filter entry must be a string or {type, content} object")
+
+
+# ---------------------------------------------------------------------------
+# Status / lifecycle
+# ---------------------------------------------------------------------------
+
+def _status(server, args):
+    ext = server.extender
+    count = len(snapshot_log(ext))
+    users = run_on_edt(
+        lambda: [{"id": uid, "name": ud['user_name']}
+                 for uid, ud in sorted(ext.userTab.user_tabs.items())])
+    return {
+        "enabled": bool(ext.intercept),
+        "result_count": count,
+        "mcp_port": server.port,
+        "users": users,
+    }
+
+
+def _start(server, args):
+    from gui.configuration_tab import set_running
+    run_on_edt(lambda: set_running(server.extender, True))
+    return {"enabled": True}
+
+
+def _stop(server, args):
+    from gui.configuration_tab import set_running
+    run_on_edt(lambda: set_running(server.extender, False))
+    return {"enabled": False}
+
+
+def _clear_results(server, args):
+    from gui.configuration_tab import ClearTableRunnable
+    from java.util.concurrent import TimeUnit
+    ext = server.extender
+    before = len(snapshot_log(ext))
+    future = ext.executor.submit(ClearTableRunnable(ext))
+    future.get(10, TimeUnit.SECONDS)
+    return {"cleared": before}
+
+
+# ---------------------------------------------------------------------------
+# Results
+# ---------------------------------------------------------------------------
+
+def _list_results(server, args, use_regex=False):
+    ext = server.extender
+    status_filter = (args.get("status") or "all").lower()
+    user_filter = args.get("user")
+    method_filter = args.get("method")
+    url_contains = args.get("url_contains")
+    url_regex = args.get("url_regex")
+    offset = int(args.get("offset", 0))
+    count = int(args.get("count", 50))
+    if offset < 0:
+        offset = 0
+    if count < 1:
+        count = 1
+    if count > 500:
+        count = 500
+
+    target_status = None
+    if status_filter != "all":
+        target_status = _status_map(ext).get(status_filter)
+        if target_status is None:
+            raise ValueError("invalid status: %s" % status_filter)
+
+    compiled = None
+    if use_regex and url_regex:
+        compiled = re.compile(url_regex, re.IGNORECASE)
+
+    id_name = _user_id_name_map(ext)
+    entries = snapshot_log(ext)
+
+    items = []
+    for le in entries:
+        url = le._url.toString()
+        method = str(le._method)
+        if method_filter and method_filter.upper() != method.upper():
+            continue
+        if url_contains and url_contains not in url:
+            continue
+        if compiled is not None and compiled.search(url) is None:
+            continue
+
+        user_verdicts = {}
+        for uid, ud in le._userEnforcements.items():
+            name = id_name.get(uid, "user_%s" % uid)
+            user_verdicts[name] = {
+                "length": _resp_length(ext, ud.get('requestResponse')),
+                "status": ud.get('enforcementStatus'),
+            }
+
+        unauth = None
+        if le._unauthorizedRequestResponse is not None:
+            unauth = {
+                "length": _resp_length(ext, le._unauthorizedRequestResponse),
+                "status": le._enfocementStatusUnauthorized,
+            }
+
+        if user_filter is not None:
+            if user_filter not in user_verdicts:
+                continue
+            if target_status is not None and user_verdicts[user_filter]["status"] != target_status:
+                continue
+        elif target_status is not None:
+            statuses = [le._enfocementStatusUnauthorized]
+            statuses.extend(v["status"] for v in user_verdicts.values())
+            if target_status not in statuses:
+                continue
+
+        items.append({
+            "id": le._id,
+            "method": method,
+            "url": url,
+            "orig_length": _resp_length(ext, le._originalrequestResponse),
+            "unauthenticated": unauth,
+            "users": user_verdicts,
+        })
+
+    total = len(items)
+    page = items[offset:offset + count]
+    return {"total": total, "offset": offset, "count": len(page), "items": page}
+
+
+def _list_results_regex(server, args):
+    return _list_results(server, args, use_regex=True)
+
+
+def _get_result(server, args):
+    ext = server.extender
+    rid = args.get("id")
+    if rid is None:
+        raise ValueError("id is required")
+    id_name = _user_id_name_map(ext)
+    entries = snapshot_log(ext)
+    le = None
+    for e in entries:
+        if e._id == rid:
+            le = e
+            break
+    if le is None:
+        raise ValueError("result id not found: %s" % rid)
+
+    users = {}
+    for uid, ud in le._userEnforcements.items():
+        name = id_name.get(uid, "user_%s" % uid)
+        rr = ud.get('requestResponse')
+        users[name] = {
+            "request": _msg_text(ext, rr, "request"),
+            "response": _msg_text(ext, rr, "response"),
+            "status": ud.get('enforcementStatus'),
+        }
+
+    unauth = None
+    if le._unauthorizedRequestResponse is not None:
+        unauth = {
+            "request": _msg_text(ext, le._unauthorizedRequestResponse, "request"),
+            "response": _msg_text(ext, le._unauthorizedRequestResponse, "response"),
+            "status": le._enfocementStatusUnauthorized,
+        }
+
+    return {
+        "id": le._id,
+        "method": str(le._method),
+        "url": le._url.toString(),
+        "original": {
+            "request": _msg_text(ext, le._originalrequestResponse, "request"),
+            "response": _msg_text(ext, le._originalrequestResponse, "response"),
+        },
+        "unauthenticated": unauth,
+        "users": users,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Users
+# ---------------------------------------------------------------------------
+
+def _read_user(ext, uid):
+    ud = ext.userTab.user_tabs[uid]
+    mr = ud['mr_instance']
+    rules = []
+    for i in range(mr.MRModel.getSize()):
+        key = mr.MRModel.getElementAt(i)
+        rd = mr.badProgrammerMRModel.get(key)
+        if rd:
+            rules.append({"type": rd['type'], "match": rd['match'], "replace": rd['replace']})
+    ed = ud['ed_instance']
+    return {
+        "id": uid,
+        "name": ud['user_name'],
+        "headers_text": ud['headers_instance'].replaceString.getText(),
+        "match_replace_rules": rules,
+        "enforcement_detector": {
+            "filters": _model_to_str_list(ed.EDModel),
+            "and_or": ed.AndOrType.getSelectedItem(),
+        },
+    }
+
+
+def _list_users(server, args):
+    ext = server.extender
+    return {"users": run_on_edt(
+        lambda: [_read_user(ext, uid) for uid in sorted(ext.userTab.user_tabs.keys())])}
+
+
+def _get_last_headers(server, args):
+    ext = server.extender
+    return {
+        "cookies": getattr(ext, 'lastCookiesHeader', "") or "",
+        "authorization": getattr(ext, 'lastAuthorizationHeader', "") or "",
+    }
+
+
+def _apply_user_config(ext, uid, cfg):
+    """Apply a user config dict to user `uid`. MUST run on the EDT."""
+    ud = ext.userTab.user_tabs.get(uid)
+    if ud is None:
+        raise ValueError("user not found: %s" % uid)
+
+    if cfg.get("name"):
+        ext.userTab.set_user_name(uid, cfg["name"])
+
+    fetch = cfg.get("fetch_from_last_request")
+    if fetch == "cookies":
+        val = getattr(ext, 'lastCookiesHeader', "") or ""
+        if val:
+            ud['headers_instance'].replaceString.setText(val)
+    elif fetch == "authorization":
+        val = getattr(ext, 'lastAuthorizationHeader', "") or ""
+        if val:
+            ud['headers_instance'].replaceString.setText(val)
+    elif "headers_text" in cfg:
+        ud['headers_instance'].replaceString.setText(cfg["headers_text"] or "")
+
+    if "match_replace_rules" in cfg:
+        mr = ud['mr_instance']
+        mr.MRModel.clear()
+        mr.badProgrammerMRModel.clear()
+        for rule in (cfg["match_replace_rules"] or []):
+            rtype = rule.get("type")
+            match = rule.get("match", "")
+            replace = rule.get("replace", "")
+            key = rtype + " " + match + "->" + replace
+            regex_match = None
+            if rtype and "(regex)" in rtype:
+                try:
+                    regex_match = re.compile(match)
+                except re.error:
+                    regex_match = None
+            mr.badProgrammerMRModel[key] = {
+                "match": match, "regexMatch": regex_match, "replace": replace, "type": rtype}
+            mr.MRModel.addElement(key)
+
+    if "enforcement_detector" in cfg:
+        ed_cfg = cfg["enforcement_detector"] or {}
+        ed = ud['ed_instance']
+        if "filters" in ed_cfg:
+            ed.EDModel.clear()
+            for item in (ed_cfg["filters"] or []):
+                ed.EDModel.addElement(_build_filter_entry(item))
+        if ed_cfg.get("and_or"):
+            ed.AndOrType.setSelectedItem(ed_cfg["and_or"])
+
+
+def _add_user(server, args):
+    ext = server.extender
+    users_cfg = args.get("users")
+    if users_cfg is None:
+        single = {}
+        for k in ("name", "headers_text", "fetch_from_last_request",
+                  "match_replace_rules", "enforcement_detector"):
+            if k in args:
+                single[k] = args[k]
+        users_cfg = [single]
+    if not isinstance(users_cfg, list):
+        raise ValueError("users must be an array")
+
+    def build():
+        created = []
+        for cfg in users_cfg:
+            ext.userTab.add_user()
+            uid = ext.userTab.user_count
+            _apply_user_config(ext, uid, cfg or {})
+            created.append({"id": uid, "name": ext.userTab.user_tabs[uid]['user_name']})
+        return created
+
+    return {"created": run_on_edt(build)}
+
+
+def _update_user(server, args):
+    ext = server.extender
+    uid = args.get("user_id")
+    if uid is None:
+        raise ValueError("user_id is required")
+    uid = int(uid)
+
+    def build():
+        if uid not in ext.userTab.user_tabs:
+            raise ValueError("user not found: %s" % uid)
+        _apply_user_config(ext, uid, args)
+        return _read_user(ext, uid)
+
+    return run_on_edt(build)
+
+
+def _remove_user(server, args):
+    ext = server.extender
+    uid = args.get("user_id")
+    if uid is None:
+        raise ValueError("user_id is required")
+    uid = int(uid)
+
+    def build():
+        if uid not in ext.userTab.user_tabs:
+            return {"removed": False}
+        ext.userTab.remove_user(uid)
+        return {"removed": uid not in ext.userTab.user_tabs}
+
+    return run_on_edt(build)
+
+
+# ---------------------------------------------------------------------------
+# Configuration
+# ---------------------------------------------------------------------------
+
+def _get_config(server, args):
+    ext = server.extender
+
+    def build():
+        return {
+            "running": bool(ext.intercept),
+            "ignore_304_204": ext.ignore304.isSelected(),
+            "prevent_304": ext.prevent304.isSelected(),
+            "intercept_from_repeater": ext.interceptRequestsfromRepeater.isSelected(),
+            "check_unauthenticated": ext.doUnauthorizedRequest.isSelected(),
+            "replace_query_params": ext.replaceQueryParam.isSelected(),
+            "auto_scroll": ext.autoScroll.isSelected(),
+            "table_filter": {
+                "show_bypassed": ext.showBypassed.isSelected(),
+                "show_is_enforced": ext.showIsEnforced.isSelected(),
+                "show_enforced": ext.showEnforced.isSelected(),
+            },
+        }
+
+    return run_on_edt(build)
+
+
+def _set_config(server, args):
+    ext = server.extender
+    from gui.configuration_tab import set_running
+
+    def build():
+        if "running" in args:
+            set_running(ext, bool(args["running"]))
+        if "ignore_304_204" in args:
+            ext.ignore304.setSelected(bool(args["ignore_304_204"]))
+        if "prevent_304" in args:
+            ext.prevent304.setSelected(bool(args["prevent_304"]))
+        if "intercept_from_repeater" in args:
+            ext.interceptRequestsfromRepeater.setSelected(bool(args["intercept_from_repeater"]))
+        if "check_unauthenticated" in args:
+            ext.doUnauthorizedRequest.setSelected(bool(args["check_unauthenticated"]))
+        if "auto_scroll" in args:
+            ext.autoScroll.setSelected(bool(args["auto_scroll"]))
+        if "replace_query_params" in args:
+            ext.replaceQueryParam.setSelected(bool(args["replace_query_params"]))
+            # setSelected does not fire actionPerformed; replicate the button's side effect.
+            if getattr(ext, 'configuration_tab_instance', None):
+                ext.configuration_tab_instance.replaceQueryHanlder(None)
+        tf = args.get("table_filter") or {}
+        if "show_bypassed" in tf:
+            ext.showBypassed.setSelected(bool(tf["show_bypassed"]))
+        if "show_is_enforced" in tf:
+            ext.showIsEnforced.setSelected(bool(tf["show_is_enforced"]))
+        if "show_enforced" in tf:
+            ext.showEnforced.setSelected(bool(tf["show_enforced"]))
+        return None
+
+    run_on_edt(build)
+    return _get_config(server, args)
+
+
+def _get_filter_options(server, args):
+    return {
+        "enforcement_detector_types": ENFORCEMENT_DETECTOR_TYPES,
+        "match_replace_types": MATCH_REPLACE_TYPES,
+        "interception_filter_types": INTERCEPTION_FILTER_TYPES,
+        "and_or_options": AND_OR_OPTIONS,
+        "status_values": ["all", "bypassed", "enforced", "ambiguous", "disabled"],
+    }
+
+
+# ---------------------------------------------------------------------------
+# Interception filters (global)
+# ---------------------------------------------------------------------------
+
+def _get_interception_filters(server, args):
+    ext = server.extender
+    return {"filters": run_on_edt(lambda: _model_to_str_list(ext.IFModel))}
+
+
+def _set_interception_filters(server, args):
+    ext = server.extender
+    filters = args.get("filters")
+    if filters is None:
+        raise ValueError("filters is required (array of strings or {type, content})")
+    if not isinstance(filters, list):
+        raise ValueError("filters must be an array")
+    entries = [_build_filter_entry(f) for f in filters]
+
+    def build():
+        ext.IFModel.clear()
+        for e in entries:
+            ext.IFModel.addElement(e)
+        return _model_to_str_list(ext.IFModel)
+
+    return {"filters": run_on_edt(build)}
+
+
+# ---------------------------------------------------------------------------
+# Unauthenticated enforcement detector (global)
+# ---------------------------------------------------------------------------
+
+def _get_unauth_detector(server, args):
+    ext = server.extender
+
+    def build():
+        return {
+            "filters": _model_to_str_list(ext.EDModelUnauth),
+            "and_or": ext.AndOrTypeUnauth.getSelectedItem(),
+        }
+
+    return run_on_edt(build)
+
+
+def _set_unauth_detector(server, args):
+    ext = server.extender
+
+    def build():
+        if "filters" in args:
+            ext.EDModelUnauth.clear()
+            for item in (args["filters"] or []):
+                ext.EDModelUnauth.addElement(_build_filter_entry(item))
+        if args.get("and_or"):
+            ext.AndOrTypeUnauth.setSelectedItem(args["and_or"])
+        return {
+            "filters": _model_to_str_list(ext.EDModelUnauth),
+            "and_or": ext.AndOrTypeUnauth.getSelectedItem(),
+        }
+
+    return run_on_edt(build)
+
+
+# ---------------------------------------------------------------------------
+# Export & state
+# ---------------------------------------------------------------------------
+
+def _export(server, args):
+    ext = server.extender
+    fmt = (args.get("format") or "html").lower()
+    status_filter = args.get("status_filter", "All Statuses")
+    remove_dups = bool(args.get("remove_duplicates", True))
+    from gui.export import build_html_report, build_csv_report
+
+    def build():
+        ext._lock.acquire()
+        try:
+            if fmt == "csv":
+                return build_csv_report(ext, status_filter, remove_dups)
+            return build_html_report(ext, status_filter, remove_dups)
+        finally:
+            ext._lock.release()
+
+    content = run_on_edt(build)
+    return {"format": fmt, "content": content}
+
+
+def _save_state(server, args):
+    ext = server.extender
+    path = args.get("path")
+    if not path:
+        raise ValueError("path is required")
+
+    def build():
+        ext.save_restore_instance.save_state_to_path(path)
+        return {"saved": True, "path": path}
+
+    return run_on_edt(build)
+
+
+def _restore_state(server, args):
+    ext = server.extender
+    path = args.get("path")
+    if not path:
+        raise ValueError("path is required")
+
+    def build():
+        ext.save_restore_instance.restore_state_from_path(path)
+        return {"restored": True, "path": path, "result_count": ext._log.size()}
+
+    return run_on_edt(build)
+
+
+def _send_to_repeater(server, args):
+    ext = server.extender
+    rid = args.get("id")
+    if rid is None:
+        raise ValueError("id is required")
+    variant = args.get("variant", "original")
+    entries = snapshot_log(ext)
+    le = None
+    for e in entries:
+        if e._id == rid:
+            le = e
+            break
+    if le is None:
+        raise ValueError("result id not found: %s" % rid)
+
+    if variant == "original":
+        rr = le._originalrequestResponse
+    elif variant == "unauthenticated":
+        rr = le._unauthorizedRequestResponse
+    else:
+        name_to_id = run_on_edt(
+            lambda: dict((ud['user_name'], uid) for uid, ud in ext.userTab.user_tabs.items()))
+        uid = name_to_id.get(variant)
+        if uid is None:
+            raise ValueError("unknown variant/user: %s" % variant)
+        ud = le.get_user_enforcement(uid)
+        rr = ud['requestResponse'] if ud else None
+
+    if rr is None:
+        raise ValueError("no request/response available for variant: %s" % variant)
+
+    svc = rr.getHttpService()
+    secure = svc.getProtocol() == "https"
+    ext._callbacks.sendToRepeater(svc.getHost(), svc.getPort(), secure, rr.getRequest(), "Autorize (MCP)")
+    return {"sent": True, "variant": variant}
+
+
+# ---------------------------------------------------------------------------
+# Registry
+# ---------------------------------------------------------------------------
+
+_FILTER_ENTRY_SCHEMA = {
+    "oneOf": [
+        {"type": "string"},
+        {"type": "object", "properties": {
+            "type": {"type": "string"}, "content": {"type": "string"}}},
+    ]
+}
+
+_MR_RULE_SCHEMA = {
+    "type": "object",
+    "properties": {
+        "type": {"type": "string", "enum": MATCH_REPLACE_TYPES},
+        "match": {"type": "string"},
+        "replace": {"type": "string"},
+    },
+    "required": ["type", "match", "replace"],
+}
+
+_ED_SCHEMA = {
+    "type": "object",
+    "properties": {
+        "filters": {"type": "array", "items": _FILTER_ENTRY_SCHEMA,
+                    "description": "Each entry is a raw 'Title: content' string, or {type, content} "
+                                   "where type is one of the enforcement_detector_types."},
+        "and_or": {"type": "string", "enum": AND_OR_OPTIONS},
+    },
+}
+
+TOOLS = [
+    ("autorize_status",
+     "Get Autorize status: whether scanning is on, number of results, MCP port, and configured users.",
+     {"type": "object", "properties": {}},
+     _status),
+
+    ("autorize_start",
+     "Turn Autorize scanning on (equivalent to the 'Autorize is off/on' toggle).",
+     {"type": "object", "properties": {}},
+     _start),
+
+    ("autorize_stop",
+     "Turn Autorize scanning off.",
+     {"type": "object", "properties": {}},
+     _stop),
+
+    ("autorize_clear_results",
+     "Clear the Autorize results table. Returns how many rows were removed.",
+     {"type": "object", "properties": {}},
+     _clear_results),
+
+    ("autorize_list_results",
+     "List Autorize results (paginated). Each item includes per-user and unauthenticated "
+     "verdicts and response lengths. Filter by status, user name, HTTP method, or URL substring.",
+     {"type": "object", "properties": {
+         "status": {"type": "string", "enum": ["all", "bypassed", "enforced", "ambiguous", "disabled"],
+                    "default": "all"},
+         "user": {"type": "string", "description": "Restrict to one low-priv user's verdict, by name."},
+         "method": {"type": "string"},
+         "url_contains": {"type": "string"},
+         "offset": {"type": "integer", "default": 0, "minimum": 0},
+         "count": {"type": "integer", "default": 50, "minimum": 1, "maximum": 500}}},
+     _list_results),
+
+    ("autorize_list_results_regex",
+     "Like autorize_list_results but matches the URL against a case-insensitive regex (url_regex).",
+     {"type": "object", "properties": {
+         "status": {"type": "string", "enum": ["all", "bypassed", "enforced", "ambiguous", "disabled"],
+                    "default": "all"},
+         "user": {"type": "string"},
+         "method": {"type": "string"},
+         "url_regex": {"type": "string"},
+         "offset": {"type": "integer", "default": 0, "minimum": 0},
+         "count": {"type": "integer", "default": 50, "minimum": 1, "maximum": 500}}},
+     _list_results_regex),
+
+    ("autorize_get_result",
+     "Get full detail for one result by id: original, unauthenticated, and every per-user "
+     "request/response pair plus its verdict.",
+     {"type": "object", "properties": {"id": {"type": "integer"}}, "required": ["id"]},
+     _get_result),
+
+    ("autorize_list_users",
+     "List configured low-priv users with their headers text, match/replace rules, and enforcement detector.",
+     {"type": "object", "properties": {}},
+     _list_users),
+
+    ("autorize_add_user",
+     "Create one or more low-priv users. Pass a single user's fields, or a 'users' array to create "
+     "several at once. Each may set name, headers_text (or fetch_from_last_request), match_replace_rules, "
+     "and enforcement_detector.",
+     {"type": "object", "properties": {
+         "name": {"type": "string"},
+         "headers_text": {"type": "string"},
+         "fetch_from_last_request": {"type": "string", "enum": ["cookies", "authorization"]},
+         "match_replace_rules": {"type": "array", "items": _MR_RULE_SCHEMA},
+         "enforcement_detector": _ED_SCHEMA,
+         "users": {"type": "array", "items": {"type": "object", "properties": {
+             "name": {"type": "string"},
+             "headers_text": {"type": "string"},
+             "fetch_from_last_request": {"type": "string", "enum": ["cookies", "authorization"]},
+             "match_replace_rules": {"type": "array", "items": _MR_RULE_SCHEMA},
+             "enforcement_detector": _ED_SCHEMA}}}}},
+     _add_user),
+
+    ("autorize_get_last_headers",
+     "Read the last-captured Cookie and Authorization header values (the source used by the GUI's "
+     "'Fetch Cookies header' / 'Fetch Authorization header' buttons).",
+     {"type": "object", "properties": {}},
+     _get_last_headers),
+
+    ("autorize_update_user",
+     "Update a low-priv user's configuration. Set headers_text directly, or populate it from the last "
+     "captured request via fetch_from_last_request ('cookies'|'authorization'). match_replace_rules and "
+     "enforcement_detector, when provided, REPLACE the existing sets (all types supported).",
+     {"type": "object", "properties": {
+         "user_id": {"type": "integer"},
+         "name": {"type": "string"},
+         "headers_text": {"type": "string"},
+         "fetch_from_last_request": {"type": "string", "enum": ["cookies", "authorization"]},
+         "match_replace_rules": {"type": "array", "items": _MR_RULE_SCHEMA},
+         "enforcement_detector": _ED_SCHEMA}, "required": ["user_id"]},
+     _update_user),
+
+    ("autorize_remove_user",
+     "Remove a low-priv user by id (the last remaining user cannot be removed).",
+     {"type": "object", "properties": {"user_id": {"type": "integer"}}, "required": ["user_id"]},
+     _remove_user),
+
+    ("autorize_get_config",
+     "Read Autorize's general configuration checkboxes and the table filter state.",
+     {"type": "object", "properties": {}},
+     _get_config),
+
+    ("autorize_set_config",
+     "Update Autorize's general configuration. Only provided keys are changed.",
+     {"type": "object", "properties": {
+         "running": {"type": "boolean"},
+         "ignore_304_204": {"type": "boolean"},
+         "prevent_304": {"type": "boolean"},
+         "intercept_from_repeater": {"type": "boolean"},
+         "check_unauthenticated": {"type": "boolean"},
+         "replace_query_params": {"type": "boolean"},
+         "auto_scroll": {"type": "boolean"},
+         "table_filter": {"type": "object", "properties": {
+             "show_bypassed": {"type": "boolean"},
+             "show_is_enforced": {"type": "boolean"},
+             "show_enforced": {"type": "boolean"}}}}},
+     _set_config),
+
+    ("autorize_get_filter_options",
+     "List the valid type strings for enforcement detectors, match/replace rules, and interception "
+     "filters, plus and/or and status values. Use these when constructing filter entries.",
+     {"type": "object", "properties": {}},
+     _get_filter_options),
+
+    ("autorize_get_interception_filters",
+     "Get the global interception filters (the scope/URL/method/etc. rules that gate what Autorize tests).",
+     {"type": "object", "properties": {}},
+     _get_interception_filters),
+
+    ("autorize_set_interception_filters",
+     "Replace the global interception filters. Each entry is a raw 'Title: content' string, or "
+     "{type, content} where type is one of the interception_filter_types.",
+     {"type": "object", "properties": {
+         "filters": {"type": "array", "items": _FILTER_ENTRY_SCHEMA}}, "required": ["filters"]},
+     _set_interception_filters),
+
+    ("autorize_get_unauth_detector",
+     "Get the global unauthenticated enforcement detector (filters + And/Or).",
+     {"type": "object", "properties": {}},
+     _get_unauth_detector),
+
+    ("autorize_set_unauth_detector",
+     "Update the global unauthenticated enforcement detector. filters (when provided) REPLACES the set; "
+     "all enforcement_detector_types are supported.",
+     {"type": "object", "properties": {
+         "filters": {"type": "array", "items": _FILTER_ENTRY_SCHEMA},
+         "and_or": {"type": "string", "enum": AND_OR_OPTIONS}}},
+     _set_unauth_detector),
+
+    ("autorize_export",
+     "Export the results table as an HTML or CSV report string.",
+     {"type": "object", "properties": {
+         "format": {"type": "string", "enum": ["html", "csv"], "default": "html"},
+         "status_filter": {"type": "string",
+                           "description": "One of 'All Statuses', 'As table filter', or an exact status string.",
+                           "default": "All Statuses"},
+         "remove_duplicates": {"type": "boolean", "default": True}}},
+     _export),
+
+    ("autorize_save_state",
+     "Save the full Autorize state (users, filters, detectors, checkboxes, and all captured results) to "
+     "a file at the given absolute path.",
+     {"type": "object", "properties": {"path": {"type": "string"}}, "required": ["path"]},
+     _save_state),
+
+    ("autorize_restore_state",
+     "Restore Autorize state from a file previously written by autorize_save_state (or the GUI Save button).",
+     {"type": "object", "properties": {"path": {"type": "string"}}, "required": ["path"]},
+     _restore_state),
+
+    ("autorize_send_to_repeater",
+     "Send a result's request into Burp Repeater. variant is 'original', 'unauthenticated', or a user name.",
+     {"type": "object", "properties": {
+         "id": {"type": "integer"},
+         "variant": {"type": "string", "default": "original"}}, "required": ["id"]},
+     _send_to_repeater),
+]
+
+_HANDLERS = dict((name, handler) for (name, _desc, _schema, handler) in TOOLS)
+
+
+def list_tools():
+    return [{"name": name, "description": desc, "inputSchema": schema}
+            for (name, desc, schema, _handler) in TOOLS]
+
+
+def get_handler(name):
+    return _HANDLERS.get(name)