Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

🎃 Import a HAR file (browser network capture) as REST tools

Offen
  • Stimmt etwas nicht?
#856 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Anfängerfreundlichkeit
55/100
Issue-Typ
Feature
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
typescript
Bereich
backend-api-design, documentation, frontend, security

Rechercherichtung

Start with curl.parser.ts, postman.parser.ts, and the ParsedTool shape in openapi.parser.ts; then trace parser registration and importTools() in the backend, and IMPORT_SOURCES/handleImportTools in the connector page. Build the HAR parser and cover it with har.parser.spec.ts, then verify additive imports, the file-upload flow, and the requested docs updates. Done means the listed security, parsing, UI, test, and documentation acceptance criteria pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

enhancement hacktoberfest help wanted

Part of the October Challenge #846.

Why

Many internal and legacy web apps have no OpenAPI spec and no Postman collection. What users can always do is open DevTools, click through the app and "Save all as HAR". Turning that capture into REST tools would make AnythingMCP useful for exactly the APIs nobody documented. Similar tools: Postman and Insomnia import HAR; mitmproxy2swagger turns captures into specs.

Self-hosted vs Cloud

  • Self-hosted: available in Community and Business, no licence gate.
  • Cloud (DEPLOYMENT_MODE=cloud): same feature. The parser runs only on uploaded text and never makes outbound requests (unlike the OpenAPI/Postman url option), so there is no new SSRF surface. Captures are sensitive (session cookies, tokens, personal data in bodies), so nothing from the HAR may be stored except the endpoint shapes described below.
  • Who can use it: same as the other import sources. POST /api/connectors/:id/import requires assertCanWrite (connector owner or ADMIN; VIEWER refused), and the connector belongs to the caller's organization.

What to build

  1. Parser packages/backend/src/connectors/parsers/har.parser.ts (HarParser, @Injectable, parse(content: string, opts: { baseUrl: string }): ParsedTool[]), registered in PARSERS in connectors.module.ts:
    • Validate the HAR 1.2 shape (log.entries[]). Reject content over 10 MB (the JSON body limit in main.ts:53) and stop after 2,000 entries, with a clear error.
    • Keep only entries whose origin equals the connector's baseUrl origin, and make each path relative to the baseUrl path. Skip OPTIONS, data:/blob: URLs, static assets (by extension and by response.content.mimeType: js, css, images, fonts, html) and non-2xx/3xx responses.
    • Path parameter inference: a segment that is numeric, a UUID, a hex/base64-ish id of 16 or more characters, or a date becomes {name}, named from the preceding segment (/orders/123/items/9 gives /orders/{order_id}/items/{item_id}). Use the {var} form that curl.parser.ts emits.
    • Dedupe by METHOD + templated path. Merge query parameter names and JSON body keys across duplicates.
    • Parameters: query params become string params. A JSON request body becomes a body schema with types only, using the Postman parser's inferJsonType approach. Form-urlencoded fields become string params.
    • Never copy captured values into defaults, examples or descriptions. A login request's body contains a password.
    • Headers: drop Authorization, Proxy-Authorization, Cookie, Set-Cookie, any name where isSecretName() is true, HTTP/2 pseudo-headers (:authority…), and browser noise (sec-*, user-agent, accept-encoding, referer, origin, host, content-length). Query params whose name is a secret (e.g. api_key, token) are dropped, and their names are returned as a warning ("configure auth on the connector instead").
    • Ignore response.content.text, cookies, postData.params file contents, and _initiator/_securityDetails.
    • Tool names: <method>_<path words>, passed through capToolName(), made unique.
  2. Controller: add 'har' to ImportToolsDto.source and a case 'har' in importTools() (content only, no url). Treat HAR like curl/json: additive, so it does not retire existing tools (additive flag).
  3. Frontend: add "HAR file (browser capture)" to IMPORT_SOURCES in the connector page, with a Choose file button (accept=".har,application/json"). Read the file with FileReader. Before upload, remove response.content.text and cookies from each entry (less data sent, smaller upload). Warn above 10 MB. Add a one-line hint: "Only requests to are imported; cookies and auth headers are discarded."

Where to look

  • packages/backend/src/connectors/parsers/curl.parser.ts:20: closest pattern (header handling at :138, {var} paths at :225, generateToolName at :318).
  • packages/backend/src/connectors/parsers/postman.parser.ts:223: header skip list; :433 inferJsonType.
  • packages/backend/src/connectors/parsers/openapi.parser.ts:12: the ParsedTool shape.
  • packages/backend/src/connectors/parsers/tool-name.util.ts:23: capToolName.
  • packages/backend/src/connectors/connector-secrets.util.ts:77: isSecretName.
  • packages/backend/src/connectors/connectors.controller.ts:323: ImportToolsDto; :1489 importTools(); :1656 the additive rule.
  • packages/backend/src/connectors/connectors.module.ts:36: PARSERS.
  • packages/frontend/src/app/connectors/[id]/page.tsx:23: IMPORT_SOURCES; :450 handleImportTools.

Acceptance criteria

  • har.parser.spec.ts next to the parser, with a small fixture HAR. It covers: other-origin and static entries skipped; /users/42 and /users/43 collapse into one GET /users/{user_id} tool; Authorization/Cookie/X-Api-Key absent from every endpointMapping; no captured value (e.g. a password in a login body) appears anywhere in the output (JSON.stringify(result) check); over-size input rejected. Run with cd packages/backend && npx jest src/connectors/parsers/har.
  • Importing a HAR never disables existing tools.
  • The UI option works end to end (Playwright spec under packages/frontend/tests/e2e/).
  • Docs: mention HAR in the import list of docs/connectors/rest.md (line 3), and add a source: "har" example next to the other /import examples in docs/api-reference.md (around line 121). Include a privacy note: "captures contain cookies; we discard them, but sanitize before sharing the file".

Out of scope

  • Inferring outputSchema from captured responses (follow-up).
  • Auto-configuring connector auth from captured tokens.
  • GraphQL/WebSocket entries in a HAR.
  • Creating a new connector from a HAR (import into an existing REST connector only).

Size

M (1–2 days)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.

Vorherrschende Sprache
TypeScript
Sterne
856
Forks
82
Ø Merge
5 Std. 18 Min.
Gemergte PRs (30 T.)
162

Entwicklungsumgebung

Dieses Projekt bietet weder Dev-Container noch Dockerfile noch Beitragsleitfaden – die Einrichtung liegt bei Ihnen. Beginnen Sie mit der README; die allgemeinen Schritte stehen in unserem Leitfaden für den ersten Beitrag.

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus HelpCode-ai/anythingmcp

Alle Issues in HelpCode-ai/anythingmcp

Ähnliche Issues

Weitere Issues zu TypeScript

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.