Har Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Har Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Capture any website's traffic and reverse-engineer its APIs. One prompt = full audit + API docs + code snippets.
An AI assistant connects to this MCP server and gets 20 tools to:
python3 -m venv .venv
source .venv/bin/activate
pip install playwright fastmcp pyyaml pytest
playwright install chromiumpython -m har_mcp.server
# Runs at http://localhost:8000/sseAdd to your MCP config:
{
"mcpServers": {
"har-mcp": {
"type": "sse",
"url": "http://localhost:8000/sse"
}
}
}| Tool | What it does |
|---|---|
capture_har_tool | Capture HAR from a URL using headless browser |
| Tool | What it does |
|---|---|
audit_website | One-shot full audit — capture + all analyses + HTML report |
analyze_performance_tool | 0-100 performance score with breakdown |
find_slow_requests_tool | Find requests slower than threshold |
find_failed_requests_tool | Find HTTP errors (4xx/5xx) |
list_endpoints_tool | All endpoints with counts and avg duration |
check_security_headers_tool | Missing CSP, HSTS, X-Frame-Options, etc. |
find_large_payloads_tool | Find bloated responses |
find_redirect_chains_tool | Detect redirect chains |
find_third_party_requests_tool | Detect trackers and ad scripts |
check_best_practices_tool | Caching, compression, render-blocking checks |
compare_hars_tool | Compare two captures (before/after) |
generate_waterfall_tool | HTML waterfall chart |
generate_report_tool | Full HTML audit report |
| Tool | What it does |
|---|---|
reverse_engineer_site | One-shot — capture + discover APIs + generate docs |
discover_apis_tool | Find all hidden API endpoints from traffic |
detect_auth_patterns_tool | Detect JWT, API keys, cookies, OAuth flows |
generate_openapi_spec_tool | Generate OpenAPI 3.0 YAML (import into Postman/Swagger) |
generate_code_snippets_tool | Python, curl, JS code for every endpoint |
generate_api_docs_tool | Interactive Swagger-like HTML documentation |
The killer demos:
"Reverse-engineer the APIs for https://some-site.com"
Captures the site, discovers all API endpoints, detects auth patterns, generates an OpenAPI spec, code snippets, and interactive API docs.
"Audit https://some-site.com"
Full performance + security + best-practices audit with HTML report.
Specific questions:
"What APIs does this site use?" "Show me the auth patterns" "Generate a Swagger spec from this site" "Give me Python code to call their search API" "What trackers does this site have?" "Compare these two captures"
pytest tests/ -v
# 53 passedhar_mcp/
├── server.py # MCP server — 20 tools over HTTP/SSE
├── capture.py # Playwright HAR capture
├── analyzer.py # Performance, security, best practices analysis
├── api_discovery.py # API reverse engineering engine
├── visualizer.py # Waterfall chart + audit report + API docs
├── models.py # Data models
├── config.py # Configuration
├── utils.py # Helpers
tests/
├── sample.har # Rich test fixture (19 entries with APIs, auth, GraphQL)
├── test_analyzer.py
├── test_api_discovery.py
├── test_capture.py
├── test_visualizer.py~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.