{"name":"io.github.aryanspv/har-forensics-mcp","slug":"aryanspv-har-forensics-mcp","title":null,"description":"Tells you what leaked in a .har capture, who's on the page, and what to strip. No network calls.","url":"https://mcp.market/server/aryanspv-har-forensics-mcp","rating":null,"grade":"A","score":88,"certified":false,"status":"active","category":"other","tags":[],"presence":{"score":21,"stars":1,"forks":0,"downloads_week":44,"last_push_at":"2026-08-06T12:35:15.000Z","license":"NOASSERTION"},"uptime":null,"claimed":false,"transport":"npm","callable_via_gateway":false,"default_price_micros":0,"repository":"https://github.com/aryanspv/har-forensics-mcp","website":null,"version":"0.3.2","remotes":[],"packages":[{"registryType":"npm","identifier":"har-forensics-mcp","version":"0.3.2","transport":{"type":"stdio"}}],"tools":[{"name":"analyze_har","description":"","write_action":false,"price_micros":0,"input_schema":null},{"name":"find_captures","description":"List .har captures in the working directory, Downloads, Desktop, Documents, and the temp directory, newest first. Use when the user refers to a capture without giving a path.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_brief","description":"The complete audit as markdown, with every secret masked and the analysis's own blind spots stated. This is the safe artifact to quote, paste into a ticket, or reason over.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_csp","description":"Synthesize a starter CSP from what this capture actually loaded, diffed against the policy the origin sends today.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_curl","description":"Generate a runnable cURL command or JavaScript fetch() call for one request, with credentials masked by default. Get the index from har_hunt.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_diff","description":"Diff a before and after capture: requests added and removed, responses that got slower or heavier, and third parties that appeared or disappeared. Use for release regressions and 'did this deploy add a tracker'.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_entry","description":"Everything about a single request by index: status, timing phase breakdown, request and response headers, cookies, query, and body. Redacted. Get the index from har_hunt or har_perf.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_findings","description":"Findings raised against the capture — leaked tokens, PII in URLs, insecure cookies, missing headers, expired tokens. Sorted worst-first, details redacted. Returns 25 by default; use severity/offset for the rest.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_hunt","description":"Search the capture with the Hunt query language. Filters: …, or header.<name>. `is:` takes …. Comparators (status:>=400, size:>500kb, duration:>1s), globs (host:*.doubleclick.net), regex (body:~/sk_live_[a-z0-9]+/), and negation (header.set-cookie:!secure) all work; bare words match the URL. Returns an `#` index — pass it to har_entry or har_curl.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_perf","description":"Performance breakdown: slowest requests with their dominant timing phase, heaviest responses, per-origin connection-setup cost, uncompressed text assets, and latency spent on redirects and failures.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_provenance","description":"The request dependency graph: which domain caused which other domain to be contacted. Surfaces fourth parties — vendors introduced by your vendors rather than by you. Domains only, no URLs.","write_action":false,"price_micros":0,"input_schema":null},{"name":"har_vendors","description":"Every third party the capture contacted, scored 0–100 by how much damage it could do: request volume, bytes, cookies set, and credentials or PII observed reaching it.","write_action":false,"price_micros":0,"input_schema":null},{"name":"sanitize_har","description":"Mask secrets, tokens, emails, card numbers, and response bodies, then write a `.redacted.har` next to the original. Run this before attaching a capture to a ticket — enterprise DLP now blocks unsanitized HAR uploads outright.","write_action":false,"price_micros":0,"input_schema":null}],"scan":{"score":88,"grade":"A","scanned_at":"2026-09-24T05:04:43.304Z","report":{"scannerVersion":"0.1.9","scannedAt":"2026-09-24T05:04:43.301Z","components":{"code":{"score":25,"max":25,"notes":["2 source files scanned"]},"reliability":{"score":-1,"max":20,"notes":["no gateway calls yet and no remote to probe"]},"poisoning":{"score":-1,"max":15,"notes":["tools not inspected (local package is not executed); not counted"]},"auth":{"score":12,"max":15,"notes":["local package, no credentials required"]},"maintenance":{"score":12,"max":15,"notes":["last push 49 days ago"]},"identity":{"score":8,"max":10,"notes":["registry namespace matches repository owner","GitHub account older than a year"]}},"findings":[],"inputs":{"packages":[{"registryType":"npm","identifier":"har-forensics-mcp","version":"0.3.2","found":true,"license":"MIT","hasInstallScripts":false,"dependencyCount":2,"publishedAt":"2026-08-06T12:34:16.411Z","repositoryUrl":"git+https://github.com/aryanspv/har-forensics-mcp.git","weeklyDownloads":44}],"repo":{"found":true,"owner":"aryanspv","repo":"har-forensics-mcp","archived":false,"pushedAt":"2026-08-06T12:35:15Z","stars":1,"forks":0,"openIssues":0,"ownerType":"User","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/64528511?v=4","ownerCreatedAt":"2020-04-29T09:47:59Z","license":"NOASSERTION"},"icon":{"url":"https://avatars.githubusercontent.com/u/64528511?v=4&s=128","source":"github"},"presence":{"stars":1,"forks":0,"downloadsWeek":44,"license":"NOASSERTION","lastPushAt":"2026-08-06T12:35:15.000Z","score":21}}}},"grade_history":[],"reviews":[]}