HAR-MCP

Capture any website's traffic and reverse-engineer its APIs. One prompt = full audit + API docs + code snippets.

What it does

An AI assistant connects to this MCP server and gets 20 tools to:

• Capture HAR from any URL via headless Chromium
• Audit performance, security headers, payloads, trackers, best practices
• Reverse-engineer APIs — discover hidden endpoints, extract auth, generate OpenAPI specs
• Generate code — Python, curl, JS snippets for every discovered endpoint
• Visualize — waterfall charts, audit reports, Swagger-like API docs

Setup

python3 -m venv .venv
source .venv/bin/activate
pip install playwright fastmcp pyyaml pytest
playwright install chromium

Run the server

python -m har_mcp.server
# Runs at http://localhost:8000/sse

Connect to your LLM

Add to your MCP config:

{
  "mcpServers": {
    "har-mcp": {
      "type": "sse",
      "url": "http://localhost:8000/sse"
    }
  }
}

All 20 MCP Tools

Capture

Tool	What it does
capture_har_tool	Capture HAR from a URL using headless browser

Performance & Security Audit

Tool	What it does
audit_website	One-shot full audit — capture + all analyses + HTML report
analyze_performance_tool	0-100 performance score with breakdown
find_slow_requests_tool	Find requests slower than threshold
find_failed_requests_tool	Find HTTP errors (4xx/5xx)
list_endpoints_tool	All endpoints with counts and avg duration
check_security_headers_tool	Missing CSP, HSTS, X-Frame-Options, etc.
find_large_payloads_tool	Find bloated responses
find_redirect_chains_tool	Detect redirect chains
find_third_party_requests_tool	Detect trackers and ad scripts
check_best_practices_tool	Caching, compression, render-blocking checks
compare_hars_tool	Compare two captures (before/after)
generate_waterfall_tool	HTML waterfall chart
generate_report_tool	Full HTML audit report

API Reverse Engineering

Tool	What it does
reverse_engineer_site	One-shot — capture + discover APIs + generate docs
discover_apis_tool	Find all hidden API endpoints from traffic
detect_auth_patterns_tool	Detect JWT, API keys, cookies, OAuth flows
generate_openapi_spec_tool	Generate OpenAPI 3.0 YAML (import into Postman/Swagger)
generate_code_snippets_tool	Python, curl, JS code for every endpoint
generate_api_docs_tool	Interactive Swagger-like HTML documentation

Example Prompts

The killer demos:

"Reverse-engineer the APIs for https://some-site.com"

Captures the site, discovers all API endpoints, detects auth patterns, generates an OpenAPI spec, code snippets, and interactive API docs.

"Audit https://some-site.com"

Full performance + security + best-practices audit with HTML report.

Specific questions:

"What APIs does this site use?" "Show me the auth patterns" "Generate a Swagger spec from this site" "Give me Python code to call their search API" "What trackers does this site have?" "Compare these two captures"

Run tests

pytest tests/ -v
# 53 passed

Project structure

har_mcp/
├── server.py          # MCP server — 20 tools over HTTP/SSE
├── capture.py         # Playwright HAR capture
├── analyzer.py        # Performance, security, best practices analysis
├── api_discovery.py   # API reverse engineering engine
├── visualizer.py      # Waterfall chart + audit report + API docs
├── models.py          # Data models
├── config.py          # Configuration
├── utils.py           # Helpers
tests/
├── sample.har         # Rich test fixture (19 entries with APIs, auth, GraphQL)
├── test_analyzer.py
├── test_api_discovery.py
├── test_capture.py
├── test_visualizer.py