MCP.Market

Har Forensics MCP server

by aryanspv·io.github.aryanspv/har-forensics-mcp·v0.3.2·1 stars
No reviews yet

Tells you what leaked in a .har capture, who's on the page, and what to strip. No network calls.

A88/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A88/100

full report

Adoption
New

1 stars44 downloads/wk

Reviews

Write one

Nobody has reviewed Har Forensics yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Har Forensics tools (13)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • analyze_har
  • find_captures

    List .har captures in the working directory, Downloads, Desktop, Documents, and the temp directory, newest first. Use when the user refers to a capture without giving a path.

  • har_brief

    The complete audit as markdown, with every secret masked and the analysis's own blind spots stated. This is the safe artifact to quote, paste into a ticket, or reason over.

  • har_csp

    Synthesize a starter CSP from what this capture actually loaded, diffed against the policy the origin sends today.

  • har_curl

    Generate a runnable cURL command or JavaScript fetch() call for one request, with credentials masked by default. Get the index from har_hunt.

  • har_diff

    Diff a before and after capture: requests added and removed, responses that got slower or heavier, and third parties that appeared or disappeared. Use for release regressions and 'did this deploy add a tracker'.

  • har_entry

    Everything about a single request by index: status, timing phase breakdown, request and response headers, cookies, query, and body. Redacted. Get the index from har_hunt or har_perf.

  • har_findings

    Findings raised against the capture — leaked tokens, PII in URLs, insecure cookies, missing headers, expired tokens. Sorted worst-first, details redacted. Returns 25 by default; use severity/offset for the rest.

  • har_hunt

    Search the capture with the Hunt query language. Filters: …, or header.<name>. `is:` takes …. Comparators (status:>=400, size:>500kb, duration:>1s), globs (host:*.doubleclick.net), regex (body:~/sk_live_[a-z0-9]+/), and negation (header.set-cookie:!secure) all work; bare words match the URL. Returns an `#` index — pass it to har_entry or har_curl.

  • har_perf

    Performance breakdown: slowest requests with their dominant timing phase, heaviest responses, per-origin connection-setup cost, uncompressed text assets, and latency spent on redirects and failures.

  • har_provenance

    The request dependency graph: which domain caused which other domain to be contacted. Surfaces fourth parties — vendors introduced by your vendors rather than by you. Domains only, no URLs.

  • har_vendors

    Every third party the capture contacted, scored 0–100 by how much damage it could do: request volume, bytes, cookies set, and credentials or PII observed reaching it.

  • sanitize_har

    Mask secrets, tokens, emails, card numbers, and response bodies, then write a `.redacted.har` next to the original. Run this before attaching a capture to a ticket — enterprise DLP now blocks unsanitized HAR uploads outright.

Public scan report

scanner v0.1.9 · 2026-09-24 · same rubric, same numbers if you re-run it

no findings
  • Code scan2 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 49 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Har Forensics compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
88/100
higher than 75% of 48,255 servers
Tools
13
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 65% of 28,688 servers
Downloads a week
44
more than 36% of 12,191 servers with a package

What its tools let an agent do: 13 read

Install Har Forensics in Claude Code, Cursor or VS Code

Runs npx -y har-forensics-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add har-forensics-mcp -- npx -y har-forensics-mcp
Add to Cursor

What the publisher says

From the Har Forensics repository's README, as published. We do not edit it. Read it on GitHub

har-forensics-mcp

Audit a .har capture from inside your editor. Other HAR tools show you a list of requests. This one answers the question you opened the file for: what leaked, who's on the page, and what to strip before you send it anywhere.

Reads a file from local disk, computes, writes to stdout. It makes no network calls, which is the point: a real capture holds live session cookies, Authorization headers, and sometimes card numbers.

Works with anything that speaks MCP over stdio — Cursor, Claude Code, Windsurf, Zed, VS Code Copilot.

Setup

Claude Code:

claude mcp add --scope user har-forensics -- npx -y har-forensics-mcp

--scope user registers it for every directory. Without it the server is scoped to whichever directory you ran the command in — which still reports success, and then the tools are silently absent everywhere else.

Cursor — .cursor/mcp.json in the project, or ~/.cursor/mcp.json globally:

{
  "mcpServers": {
    "har-forensics": {
      "command": "npx",
      "args": ["-y", "har-forensics-mcp"]
    }
  }
}

Windsurf / Zed / VS Code Copilot take the same command + args shape in their own MCP config files.

Restart the editor, then point a tool at a capture:

Run analyze_har on ~/Downloads/checkout.har

Requires Node 20+. Nothing else — no clone, no build, no API key, no account.

Tools

harhunt → harentry → har_curl is the loop: find the request, read it, replay it. Every tool that returns a list takes a limit and tells you the total, so nothing silently returns a first page as if it were the whole answer.

Every tool except sanitize_har is annotated readOnlyHint, and all of them are openWorldHint: false — the no-network guarantee below, in a form your client can read and act on rather than prose you have to take on trust.

Three properties it inherits from the web app

No network. The analyzers contain no fetch, and this transport does not add one. That invariant is the product — Cloudflare shipped a DLP profile in March 2026 that detects HAR files in HTTP traffic and lets admins block the upload outright, because unsanitized HARs are a known credential-exfiltration path.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Har Forensics: common questions

Is Har Forensics MCP server safe?
Yes, by our scan: it is graded A (88/100). Read the Har Forensics safety report
How do I install Har Forensics?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Har Forensics need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Har Forensics maintained?
The last commit was 90 days ago (2026-08-06). The latest release is v0.3.2.
What can I use instead of Har Forensics?
Servers from other publishers that do the same job: OneUptime MCP server.
How does Har Forensics compare with other MCP servers?
safety score 88/100 (higher than 75% of 48,255 servers); tools 13 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Har Forensics

Same job from other publishers: the closest match first, then the best rated.

  • OneUptime
    Manage incidents, alerts, monitors, status pages, on-call and telemetry in OneUptime.
    A