MCP 服务器

har-forensics-mcp

Audits HAR captures locally with MCP tools for triage, findings, vendor blast radius, CSP generation, and sanitization—no network calls, redacted by default.

README

har-forensics-mcp

Audit a .har capture from inside your editor. Third-party blast radius, leaked credentials, JWT forensics, CSP generation, and redaction — as MCP tools.

Reads a file from local disk, computes, writes to stdout. It makes no network calls, which is the point: a real capture holds live session cookies, Authorization headers, and sometimes card numbers.

Works with anything that speaks MCP over stdio — Cursor, Claude Code, Windsurf, Zed, VS Code Copilot.

Setup

Claude Code:

claude mcp add har-forensics -- npx -y har-forensics-mcp

Cursor — .cursor/mcp.json in the project, or ~/.cursor/mcp.json globally:

{
  "mcpServers": {
    "har-forensics": {
      "command": "npx",
      "args": ["-y", "har-forensics-mcp"]
    }
  }
}

Windsurf / Zed / VS Code Copilot take the same command + args shape in their own MCP config files.

Restart the editor, then point a tool at a capture:

Run analyze_har on ~/Downloads/checkout.har

Requires Node 20+. Nothing else — no clone, no build, no API key, no account.

Tools

Tool	Answers
`analyze_har`	"What's in this capture?" — triage overview, one verdict per check. Start here.
`har_brief`	The full audit as redacted markdown. The artifact to quote or paste.
`har_findings`	Findings, filterable by severity.
`har_vendors`	Every third party, scored 0–100 by blast radius, with an HTTP Archive scrutiny tier.
`har_csp`	A starter Content-Security-Policy synthesized from observed traffic.
`har_hunt`	Query requests — `is:thirdparty`, `status:404`, `type:script`, `host:…`.
`sanitize_har`	Write a `.redacted.har` safe to attach to a ticket.

Three properties it inherits from the web app

No network. The analyzers contain no fetch, and this transport does not add one. That invariant is the product — Cloudflare shipped a DLP profile in March 2026 that detects HAR files in HTTP traffic and lets admins block the upload outright, because unsanitized HARs are a known credential-exfiltration path.

Summaries, never dumps. Every tool returns a rendered conclusion, not raw entries. The captures this exists for run to tens of thousands of entries and hundreds of megabytes; handing an agent the entry list would blow its context and make it slower at a job the analyzers already did.

Redacted by default. har_brief and har_findings route through the same redactor the browser export uses, built from a single shared secret-pattern table. An agent reading a capture in an editor is more likely to paste a finding into a chat window than a human with a download folder.

What it will not do

Overwrite anything. sanitize_har refuses to write over an existing target or the original capture.
Read a file above 512 MB. Guarded rather than left to OOM.
Judge time against your clock. A HAR is a historical artifact, so token expiry is measured against each entry's startedDateTime. Comparing to now marks every token in a week-old capture as expired and buries the one that was genuinely dead when the browser sent it.

Reading the code

This package ships one file, dist/server.js. It is deliberately not minified — the build treats it as something a human debugging an editor integration will read far more often than something a machine will parse for size — so it is the same code a build would produce, already built. There is no separate source repository to clone; the shipped file is the artifact to audit.