browser-to-api

Generate OpenAPI 3.1 specs, HTML explorers, and JavaScript clients from browser HTTP traffic.

Updated Aug 19, 2026
One-click install
npx skills add https://github.com/nperepichka/Antigravity --skill browser-to-api-nperepichka
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: browser-to-api
Source: https://github.com/nperepichka/Antigravity/tree/main/config/skills/browser-to-api
Command: npx skills add https://github.com/nperepichka/Antigravity --skill browser-to-api-nperepichka

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Undocumented internal or third-party web APIs force developers to manually inspect network traffic and hand-write specifications. This Skill converts observed browser traffic (HAR files or live Chrome/Edge CDP sessions) into a complete OpenAPI 3.1 specification, an interactive HTML explorer, and a ready-to-use JavaScript client SDK, entirely offline with zero npm dependencies. ## Core Features & Use Cases - Traffic-to-Spec Pipeline: A five-stage pipeline (load, filter, normalize, infer, emit) pairs requests with responses, strips analytics noise, templatizes path parameters (UUIDs, numeric IDs, slugs), and infers JSON schemas from observed payloads. - Multiplexed Endpoint Decomposition: Automatically splits GraphQL and JSON-RPC endpoints into distinct named operations, including persisted-query hash extraction. - Multiple Input Methods: Convert an exported .har file directly, record a live local Chrome/Edge session via CDP, or consume HAR output from Playwright/Puppeteer scripts. - Privacy-First Output: Redacts sensitive headers, tokens, and PII before generating deliverables: openapi.yaml/json, index.html explorer, client.mjs SDK, report.md, and confidence.json. - Use Case: You need to integrate with a vendor's undocumented web app. Record a browsing session, run the discovery pipeline, and receive a full OpenAPI spec plus a callable client module. ## Quick Start Ask the agent to convert your exported session.har file into an OpenAPI specification and interactive API explorer using the browser-to-api skill.

Frequently Asked Questions about browser-to-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an OpenAPI spec from a HAR file?▼

Export a HAR file from your browser's DevTools Network tab, then run node scripts/discover.mjs --har session.har --out ./api-spec. The pipeline produces openapi.yaml, openapi.json, an interactive index.html explorer, and a client.mjs SDK in the output directory.

How to reverse-engineer an undocumented web API from browser traffic?▼

Record traffic either by saving a HAR file from DevTools or by running a live CDP capture with node scripts/capture.mjs start. Then run discover.mjs to normalize endpoints, infer JSON schemas, and emit a full OpenAPI 3.1 specification with confidence metrics.

Does this work with Playwright or Puppeteer network recordings?▼

Yes. Configure Playwright to record a HAR file via the recordHar context option, then pass that file to discover.mjs with the --har flag. Any standard HAR export from Chrome, Edge, Firefox, or automation tools is supported.

What are the requirements for live Chrome CDP traffic capture?▼

Live capture requires Node.js 18+ (Node 22+ recommended for native WebSocket) and a local installation of Google Chrome or Microsoft Edge. No cloud services, API keys, or npm packages are needed; the recorder connects via the Chrome DevTools Protocol on a local debug port.

Are sensitive tokens and cookies redacted from the generated spec?▼

Yes. The infer stage automatically redacts sensitive headers like Authorization, Cookie, and X-API-Key, plus JSON body keys such as password, token, and secret. You can add custom field names with the --redact flag, and redaction counts appear in report.md.

Can it handle GraphQL endpoints in captured traffic?▼

Yes. The normalize stage detects multiplexed endpoints by discriminator fields like operationName or query opname parameters, then decomposes them into separate operations. Persisted GraphQL query hashes are also extracted into the generated client SDK.