Hartrace
About
Hartrace is an MCP server for analyzing HTTP traffic captures (HAR files). Its distinguishing feature is value provenance tracing: given any token, cookie, ID, or payload field, it reconstructs where the value was produced (which response set it) and where it was consumed (which…
Details
- License
- MIT
Explore
- Provenance tracing — trace_value follows any value across the capture (responses → requests), reporting JSON paths for body fields. Works on tokens, cookies, ids, headers, and payload fields alike, not just cookies.
- Search toolkit — full regex search across URLs, headers, and request/response bodies; header finder; URL/endpoint finder; query-parameter extraction.
- Inspection — per-request and per-response retrieval with base64 + gzip/deflate decoding, nested-JSON unwrapping, binary detection, and size caps.
- Lifecycle maps — cookie_map and token_map summarize how cookies and high-entropy secrets flow through a session.
- Diffing — compare two captures by (method, url, ordinal) so repeated calls to the same endpoint align.
- Loading — from a local path or an http(s) URL (with SSRF protection and a size cap).
- Safe by construction — every list/search tool paginates with server-clamped limits; secrets are redacted in inspection output; no tool raises to the transport (errors are returned as structured values).
---
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
HartraceCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
Requires Python 3.10+.
pipx install hartrace
uvx hartrace
Add the server to claude_desktop_config.json:
{
"mcpServers": {
"hartrace": {
"command": "uvx",
"args": ["hartrace"]
}
}
}
Or, running from source:
{
"mcpServers": {
"hartrace": {
"command": "python",
"args": ["/absolute/path/to/hartrace/har_mcp.py"]
}
}
}
``
Restart Claude Desktop, then talk to it naturally:
> "Load
~/captures/login.har and tell me where the CSRF token comes from."
> "Which requests reuse the session cookie?"
> "Diff before.har and after.har` — what's new?"hartrace exposes 19 tools. Refer to a loaded capture by the name returned from load_har.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"hartrace": {
"hartrace": {
"command": "python",
"args": [
"/absolute/path/to/hartrace/har_mcp.py"
]
}
}
}
}McpServers
{
"hartrace": {
"command": "python",
"args": [
"/absolute/path/to/hartrace/har_mcp.py"
]
}
}
An MCP server for analyzing HTTP traffic captures (HAR files) — built so an AI agent can answer questions about a capture without reading the raw JSON into its context window.
Its distinguishing feature is value provenance tracing: given any token, cookie, id, or payload field, hartrace reconstructs where the value was produced (which response set it) and where it was consumed (which later requests sent it), as a compact timeline. Every other tool — search, inspection, diffing — is built to return small, structured results with hard size caps, so analysis stays cheap regardless of how large the capture is.
load_har("session.har")
trace_value("session", "<csrf token>")
→ set_by: response #4 body, JSON path data.csrf
→ used_in: request #9 header X-CSRF, request #9 body field token
---
Why this exists
HAR files are large, deeply nested, and repetitive. The two common ways an AI ends up analyzing them are both bad: writing throwaway extraction scripts every session, or pasting raw HAR JSON into the context window (slow, expensive, and it overflows on anything real). A 100-entry capture can be several megabytes; a single gzipped response can be hundreds of kilobytes.
hartrace moves the extraction and correlation to the server. Tools return only what was asked for, capped. The questions that normally require reading many entries by hand — where did this auth token come from? which request produced this cookie? where is this id reused? — are answered in one call.
---
Features
- Provenance tracing — trace_value follows any value across the capture (responses → requests), reporting JSON paths for body fields. Works on tokens, cookies, ids, headers, and payload fields alike, not just cookies.
- Search toolkit — full regex search across URLs, headers, and request/response bodies; header finder; URL/endpoint finder; query-parameter extraction.
- Inspection — per-request and per-response retrieval with base64 + gzip/deflate decoding, nested-JSON unwrapping, binary detection, and size caps.
- Lifecycle maps — cookie_map and token_map summarize how cookies and high-entropy secrets flow through a session.
- Diffing — compare two captures by (method, url, ordinal) so repeated calls to the same endpoint align.
- Loading — from a local path or an http(s) URL (with SSRF protection and a size cap).
- Safe by construction — every list/search tool paginates with server-clamped limits; secrets are redacted in inspection output; no tool raises to the transport (errors are returned as structured values).
---
Installation
Requires Python 3.10+.
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
