Har Forensics MCP Server

har-forensics-mcp

Audit a .har capture from inside your editor. Third-party blast radius, leaked credentials, JWT forensics, CSP generation, and redaction — as MCP tools.

Reads a file from local disk, computes, writes to stdout. It makes no network calls, which is the point: a real capture holds live session cookies, Authorization headers, and sometimes card numbers.

Works with anything that speaks MCP over stdio — Cursor, Claude Code, Windsurf, Zed, VS Code Copilot.

Setup

Claude Code:

claude mcp add har-forensics -- npx -y har-forensics-mcp

Cursor — .cursor/mcp.json in the project, or ~/.cursor/mcp.json globally:

{
  "mcpServers": {
    "har-forensics": {
      "command": "npx",
      "args": ["-y", "har-forensics-mcp"]
    }
  }
}

Windsurf / Zed / VS Code Copilot take the same command + args shape in their own MCP config files.

Restart the editor, then point a tool at a capture:

Run analyze_har on ~/Downloads/checkout.har

Requires Node 20+. Nothing else — no clone, no build, no API key, no account.

Tools

Three properties it inherits from the web app

No network. The analyzers contain no fetch, and this transport does not add one. That invariant is the product — Cloudflare shipped a DLP profile in March 2026 that detects HAR files in HTTP traffic and lets admins block the upload outright, because unsanitized HARs are a known credential-exfiltration path.

Summaries, never dumps. Every tool returns a rendered conclusion, not raw entries. The captures this exists for run to tens of thousands of entries and hundreds of megabytes; handing an agent the entry list would blow its context and make it slower at a job the analyzers already did.

Redacted by default. har_brief and har_findings route through the same redactor the browser export uses, built from a single shared secret-pattern table. An agent reading a capture in an editor is more likely to paste a finding into a chat window than a human with a download folder.

What it will not do

• Overwrite anything. sanitize_har refuses to write over an existing target or the original capture.
• Read a file above 512 MB. Guarded rather than left to OOM.
• Judge time against your clock. A HAR is a historical artifact, so token expiry is measured against each entry's startedDateTime. Comparing to now marks every token in a week-old capture as expired and buries the one that was genuinely dead when the browser sent it.

Reading the code

This package ships one file, dist/server.js. It is deliberately not minified — the build treats it as something a human debugging an editor integration will read far more often than something a machine will parse for size — so it is the same code a build would produce, already built. There is no separate source repository to clone; the shipped file is the artifact to audit.

License

MIT. Bundled vendor data is generated from third-party-web — MIT, Copyright (c) 2017 Patrick Hulce, derived from HTTP Archive.