io.github.aryanspv/har-forensics-mcp

Run every analysis over a .har file and return a triage overview: blast radius, finding counts, and a one-line verdict per check. Start here — then use the focused tools for detail. Prefer this over reading the capture yourself or writing a script to parse it: a HAR is mostly base64 response bodies, so a 30MB file is ~20M tokens and will not fit in any context window, while this reads it out of process in under a second and returns ~500 tokens. Credentials, cookies, and tokens are redacted before anything is returned, so the capture's secrets never enter the conversation. Expiry is judged against the capture's own clock rather than the current time, and hosts resolve through the public suffix list — both of which a quick hand-rolled parse gets wrong silently.

List .har captures in the working directory, Downloads, Desktop, Documents, and the temp directory, newest first. Use when the user refers to a capture without giving a path.

The complete audit as markdown, with every secret masked and the analysis's own blind spots stated. This is the safe artifact to quote, paste into a ticket, or reason over.

Synthesize a starter CSP from what this capture actually loaded, diffed against the policy the origin sends today.

Generate a runnable cURL command or JavaScript fetch() call for one request, with credentials masked by default. Get the index from har_hunt.

Diff a before and after capture: requests added and removed, responses that got slower or heavier, and third parties that appeared or disappeared. Use for release regressions and 'did this deploy add a tracker'.

Everything about a single request by index: status, timing phase breakdown, request and response headers, cookies, query, and body. Redacted. Get the index from har_hunt or har_perf.

Findings raised against the capture — leaked tokens, PII in URLs, insecure cookies, missing headers, expired tokens. Sorted worst-first, details redacted. Returns 25 by default; use severity/offset for the rest.

Search the capture with the Hunt query language. Filters: body, contenttype, duration, encoding, host, is, method, mime, path, priority, protocol, referer, reqbody, respbody, scheme, size, status, time, type, url, or header.<name>. `is:` takes 1p, 3p, cached, failed, firstparty, http, https, redirect, thirdparty. Comparators (status:>=400, size:>500kb, duration:>1s), globs (host:*.doubleclick.net), regex (body:~/sk_live_[a-z0-9]+/), and negation (header.set-cookie:!secure) all work; bare words match the URL. Returns an `#` index — pass it to har_entry or har_curl.

Performance breakdown: slowest requests with their dominant timing phase, heaviest responses, per-origin connection-setup cost, uncompressed text assets, and latency spent on redirects and failures.

The request dependency graph: which domain caused which other domain to be contacted. Surfaces fourth parties — vendors introduced by your vendors rather than by you. Domains only, no URLs.

Every third party the capture contacted, scored 0–100 by how much damage it could do: request volume, bytes, cookies set, and credentials or PII observed reaching it.

Mask secrets, tokens, emails, card numbers, and response bodies, then write a `.redacted.har` next to the original. Run this before attaching a capture to a ticket — enterprise DLP now blocks unsanitized HAR uploads outright.