Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

🎃 Import a HAR file (browser network capture) as REST tools

Đang mở
  • Có gì không ổn?
#856 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
4/5
Thời gian dự kiến
3-5 ngày
Mức phù hợp với người mới
55/100
Loại issue
Tính năng
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
typescript
Lĩnh vực
backend-api-design, documentation, frontend, security

Hướng nghiên cứu

Start with curl.parser.ts, postman.parser.ts, and the ParsedTool shape in openapi.parser.ts; then trace parser registration and importTools() in the backend, and IMPORT_SOURCES/handleImportTools in the connector page. Build the HAR parser and cover it with har.parser.spec.ts, then verify additive imports, the file-upload flow, and the requested docs updates. Done means the listed security, parsing, UI, test, and documentation acceptance criteria pass.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

enhancement hacktoberfest help wanted

Part of the October Challenge #846.

Why

Many internal and legacy web apps have no OpenAPI spec and no Postman collection. What users can always do is open DevTools, click through the app and "Save all as HAR". Turning that capture into REST tools would make AnythingMCP useful for exactly the APIs nobody documented. Similar tools: Postman and Insomnia import HAR; mitmproxy2swagger turns captures into specs.

Self-hosted vs Cloud

  • Self-hosted: available in Community and Business, no licence gate.
  • Cloud (DEPLOYMENT_MODE=cloud): same feature. The parser runs only on uploaded text and never makes outbound requests (unlike the OpenAPI/Postman url option), so there is no new SSRF surface. Captures are sensitive (session cookies, tokens, personal data in bodies), so nothing from the HAR may be stored except the endpoint shapes described below.
  • Who can use it: same as the other import sources. POST /api/connectors/:id/import requires assertCanWrite (connector owner or ADMIN; VIEWER refused), and the connector belongs to the caller's organization.

What to build

  1. Parser packages/backend/src/connectors/parsers/har.parser.ts (HarParser, @Injectable, parse(content: string, opts: { baseUrl: string }): ParsedTool[]), registered in PARSERS in connectors.module.ts:
    • Validate the HAR 1.2 shape (log.entries[]). Reject content over 10 MB (the JSON body limit in main.ts:53) and stop after 2,000 entries, with a clear error.
    • Keep only entries whose origin equals the connector's baseUrl origin, and make each path relative to the baseUrl path. Skip OPTIONS, data:/blob: URLs, static assets (by extension and by response.content.mimeType: js, css, images, fonts, html) and non-2xx/3xx responses.
    • Path parameter inference: a segment that is numeric, a UUID, a hex/base64-ish id of 16 or more characters, or a date becomes {name}, named from the preceding segment (/orders/123/items/9 gives /orders/{order_id}/items/{item_id}). Use the {var} form that curl.parser.ts emits.
    • Dedupe by METHOD + templated path. Merge query parameter names and JSON body keys across duplicates.
    • Parameters: query params become string params. A JSON request body becomes a body schema with types only, using the Postman parser's inferJsonType approach. Form-urlencoded fields become string params.
    • Never copy captured values into defaults, examples or descriptions. A login request's body contains a password.
    • Headers: drop Authorization, Proxy-Authorization, Cookie, Set-Cookie, any name where isSecretName() is true, HTTP/2 pseudo-headers (:authority…), and browser noise (sec-*, user-agent, accept-encoding, referer, origin, host, content-length). Query params whose name is a secret (e.g. api_key, token) are dropped, and their names are returned as a warning ("configure auth on the connector instead").
    • Ignore response.content.text, cookies, postData.params file contents, and _initiator/_securityDetails.
    • Tool names: <method>_<path words>, passed through capToolName(), made unique.
  2. Controller: add 'har' to ImportToolsDto.source and a case 'har' in importTools() (content only, no url). Treat HAR like curl/json: additive, so it does not retire existing tools (additive flag).
  3. Frontend: add "HAR file (browser capture)" to IMPORT_SOURCES in the connector page, with a Choose file button (accept=".har,application/json"). Read the file with FileReader. Before upload, remove response.content.text and cookies from each entry (less data sent, smaller upload). Warn above 10 MB. Add a one-line hint: "Only requests to are imported; cookies and auth headers are discarded."

Where to look

  • packages/backend/src/connectors/parsers/curl.parser.ts:20: closest pattern (header handling at :138, {var} paths at :225, generateToolName at :318).
  • packages/backend/src/connectors/parsers/postman.parser.ts:223: header skip list; :433 inferJsonType.
  • packages/backend/src/connectors/parsers/openapi.parser.ts:12: the ParsedTool shape.
  • packages/backend/src/connectors/parsers/tool-name.util.ts:23: capToolName.
  • packages/backend/src/connectors/connector-secrets.util.ts:77: isSecretName.
  • packages/backend/src/connectors/connectors.controller.ts:323: ImportToolsDto; :1489 importTools(); :1656 the additive rule.
  • packages/backend/src/connectors/connectors.module.ts:36: PARSERS.
  • packages/frontend/src/app/connectors/[id]/page.tsx:23: IMPORT_SOURCES; :450 handleImportTools.

Acceptance criteria

  • har.parser.spec.ts next to the parser, with a small fixture HAR. It covers: other-origin and static entries skipped; /users/42 and /users/43 collapse into one GET /users/{user_id} tool; Authorization/Cookie/X-Api-Key absent from every endpointMapping; no captured value (e.g. a password in a login body) appears anywhere in the output (JSON.stringify(result) check); over-size input rejected. Run with cd packages/backend && npx jest src/connectors/parsers/har.
  • Importing a HAR never disables existing tools.
  • The UI option works end to end (Playwright spec under packages/frontend/tests/e2e/).
  • Docs: mention HAR in the import list of docs/connectors/rest.md (line 3), and add a source: "har" example next to the other /import examples in docs/api-reference.md (around line 121). Include a privacy note: "captures contain cookies; we discard them, but sanitize before sharing the file".

Out of scope

  • Inferring outputSchema from captured responses (follow-up).
  • Auto-configuring connector auth from captured tokens.
  • GraphQL/WebSocket entries in a HAR.
  • Creating a new connector from a HAR (import into an existing REST connector only).

Size

M (1–2 days)

How to claim

Comment "I'd like to work on this" and we'll assign you. Rules in #846.

Ngôn ngữ chính
TypeScript
Star
856
Fork
82
Merge trung bình
6 giờ 15 phút
Pull request đã merge (30 ngày)
141

Chuẩn bị môi trường

Dự án này không cung cấp dev container, Dockerfile hay hướng dẫn đóng góp, nên bạn cần tự thiết lập môi trường: hãy bắt đầu từ README và xem hướng dẫn đóng góp lần đầu của chúng tôi để biết các bước chung.

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của HelpCode-ai/anythingmcp

Tất cả issue của HelpCode-ai/anythingmcp

Issue tương tự

Thêm issue về TypeScript

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.