🎃 Import a HAR file (browser network capture) as REST tools

Start with curl.parser.ts, postman.parser.ts, and the ParsedTool shape in openapi.parser.ts; then trace parser registration and importTools() in the backend, and IMPORT_SOURCES/handleImportTools in the connector page. Build the HAR parser and cover it with har.parser.spec.ts, then verify additive imports, the file-upload flow, and the requested docs updates. Done means the listed security, parsing, UI, test, and documentation acceptance criteria pass.

Part of the October Challenge #846.

Why

Many internal and legacy web apps have no OpenAPI spec and no Postman collection. What users can always do is open DevTools, click through the app and "Save all as HAR". Turning that capture into REST tools would make AnythingMCP useful for exactly the APIs nobody documented. Similar tools: Postman and Insomnia import HAR; mitmproxy2swagger turns captures into specs.

Self-hosted vs Cloud

• Self-hosted: available in Community and Business, no licence gate.
• Cloud (DEPLOYMENT_MODE=cloud): same feature. The parser runs only on uploaded text and never makes outbound requests (unlike the OpenAPI/Postman url option), so there is no new SSRF surface. Captures are sensitive (session cookies, tokens, personal data in bodies), so nothing from the HAR may be stored except the endpoint shapes described below.
• Who can use it: same as the other import sources. POST /api/connectors/:id/import requires assertCanWrite (connector owner or ADMIN; VIEWER refused), and the connector belongs to the caller's organization.

What to build

1. Parser packages/backend/src/connectors/parsers/har.parser.ts (HarParser, @Injectable, parse(content: string, opts: { baseUrl: string }): ParsedTool[]), registered in PARSERS in connectors.module.ts:
   • Validate the HAR 1.2 shape (log.entries[]). Reject content over 10 MB (the JSON body limit in main.ts:53) and stop after 2,000 entries, with a clear error.
   • Keep only entries whose origin equals the connector's baseUrl origin, and make each path relative to the baseUrl path. Skip OPTIONS, data:/blob: URLs, static assets (by extension and by response.content.mimeType: js, css, images, fonts, html) and non-2xx/3xx responses.
   • Path parameter inference: a segment that is numeric, a UUID, a hex/base64-ish id of 16 or more characters, or a date becomes {name}, named from the preceding segment (/orders/123/items/9 gives /orders/{order_id}/items/{item_id}). Use the {var} form that curl.parser.ts emits.
   • Dedupe by METHOD + templated path. Merge query parameter names and JSON body keys across duplicates.
   • Parameters: query params become string params. A JSON request body becomes a body schema with types only, using the Postman parser's inferJsonType approach. Form-urlencoded fields become string params.
   • Never copy captured values into defaults, examples or descriptions. A login request's body contains a password.
   • Headers: drop Authorization, Proxy-Authorization, Cookie, Set-Cookie, any name where isSecretName() is true, HTTP/2 pseudo-headers (:authority…), and browser noise (sec-*, user-agent, accept-encoding, referer, origin, host, content-length). Query params whose name is a secret (e.g. api_key, token) are dropped, and their names are returned as a warning ("configure auth on the connector instead").
   • Ignore response.content.text, cookies, postData.params file contents, and _initiator/_securityDetails.
   • Tool names: <method>_<path words>, passed through capToolName(), made unique.
2. Controller: add 'har' to ImportToolsDto.source and a case 'har' in importTools() (content only, no url). Treat HAR like curl/json: additive, so it does not retire existing tools (additive flag).
3. Frontend: add "HAR file (browser capture)" to IMPORT_SOURCES in the connector page, with a Choose file button (accept=".har,application/json"). Read the file with FileReader. Before upload, remove response.content.text and cookies from each entry (less data sent, smaller upload). Warn above 10 MB. Add a one-line hint: "Only requests to are imported; cookies and auth headers are discarded."

Where to look

• packages/backend/src/connectors/parsers/curl.parser.ts:20: closest pattern (header handling at :138, {var} paths at :225, generateToolName at :318).
• packages/backend/src/connectors/parsers/postman.parser.ts:223: header skip list; :433 inferJsonType.
• packages/backend/src/connectors/parsers/openapi.parser.ts:12: the ParsedTool shape.
• packages/backend/src/connectors/parsers/tool-name.util.ts:23: capToolName.
• packages/backend/src/connectors/connector-secrets.util.ts:77: isSecretName.
• packages/backend/src/connectors/connectors.controller.ts:323: ImportToolsDto; :1489 importTools(); :1656 the additive rule.
• packages/backend/src/connectors/connectors.module.ts:36: PARSERS.
• packages/frontend/src/app/connectors/[id]/page.tsx:23: IMPORT_SOURCES; :450 handleImportTools.

Acceptance criteria

• har.parser.spec.ts next to the parser, with a small fixture HAR. It covers: other-origin and static entries skipped; /users/42 and /users/43 collapse into one GET /users/{user_id} tool; Authorization/Cookie/X-Api-Key absent from every endpointMapping; no captured value (e.g. a password in a login body) appears anywhere in the output (JSON.stringify(result) check); over-size input rejected. Run with cd packages/backend && npx jest src/connectors/parsers/har.
• Importing a HAR never disables existing tools.
• The UI option works end to end (Playwright spec under packages/frontend/tests/e2e/).
• Docs: mention HAR in the import list of docs/connectors/rest.md (line 3), and add a source: "har" example next to the other /import examples in docs/api-reference.md (around line 121). Include a privacy note: "captures contain cookies; we discard them, but sanitize before sharing the file".

Out of scope

• Inferring outputSchema from captured responses (follow-up).
• Auto-configuring connector auth from captured tokens.
• GraphQL/WebSocket entries in a HAR.
• Creating a new connector from a HAR (import into an existing REST connector only).

Size

M (1–2 days)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.