HAR Skills

HAR Skills is an AI-native HAR (HTTP Archive) analysis toolkit.

It is designed for AI agents first, then exposed as a Go SDK and CLI. An agent can install one binary, inspect a HAR file, search traffic, audit security issues, score performance, redact secrets, replay requests, transform captures, diff versions, and export results in machine-readable formats.

AI Agent First

HAR files are dense, noisy, and easy to mishandle in chat context. HAR Skills turns them into tool calls that agents can safely compose:

• Skill document: CLAUDE.md is a progressive-disclosure guide written for AI agents.
• CLI tool surface: har exposes 24 commands with text, JSON, CSV, and YAML output where supported.
• Go SDK surface: the root package can be embedded into custom agent tools, workers, CI jobs, and MCP servers.
• Automation-safe behavior: typed errors, nil-safe public APIs, streaming/lazy parsing, redaction, validation, and deterministic export helpers.
• MCP-ready direction: the current CLI and SDK are structured so an MCP server can wrap the same capabilities without inventing a second API.

One-Prompt Agent Bootstrap

Give this to an AI agent when you want it to analyze HAR files with this project:

You can use HAR Skills, an AI-native HAR (HTTP Archive) analysis toolkit.

Install:
  go install github.com/cyberspacesec/har-skills/cmd/har@latest

Core usage:
  har -f <capture.har> <command> [flags]
  cat capture.har | har <command>
  har -f capture.har <command> --format json

Start with:
  har -f capture.har info --format json
  har -f capture.har security --format json
  har -f capture.har performance --format json
  har -f capture.har find --errors --format json
  har -f capture.har find --slow 1000 --format json
  har -f capture.har redact -o clean.har

Full agent skill docs:
  https://github.com/cyberspacesec/har-skills/blob/main/CLAUDE.md

Capability Tree

The diagram is generated by scripts/render_feature_tree.py, so capability changes can be reviewed as code and re-rendered deterministically.

Access Methods

What Agents Can Do

Install

Go Install

go install github.com/cyberspacesec/har-skills/cmd/har@latest
har --version

Prebuilt Binary

Download the latest build from GitHub Releases.

Supported release targets include Linux, macOS, Windows, and FreeBSD on common x86 and ARM architectures.

Build From Source

git clone https://github.com/cyberspacesec/har-skills.git
cd har-skills
go build -o har ./cmd/har/
./har --help

CLI Quick Start

har -f capture.har info                              # Overview
har -f capture.har list --limit 20                   # List entries
har -f capture.har find "api/users"                  # Search URL text
har -f capture.har find --errors                     # 4xx/5xx requests
har -f capture.har find --slow 1000                  # Requests slower than 1s
har -f capture.har find --response-header "X-Debug"  # Response header search
har -f capture.har headers --response --name server  # Inspect headers
har -f capture.har timing --summary                  # Timing breakdown
har -f capture.har waterfall                         # Request timeline
har -f capture.har security                          # Security audit
har -f capture.har performance                       # Performance score
har -f capture.har cache                             # Cacheability analysis
har -f capture.har cookie                            # Cookie security analysis
har -f capture.har connections                       # Connection reuse analysis
har -f capture.har content                           # Content type and size analysis
har -f capture.har extract --index 0 -o body.bin     # Extract response body
har -f capture.har redact -o clean.har               # Redact sensitive data
har -f capture.har transform --help                  # Rewrite URLs, headers, schemes
har -f capture.har export curl                       # Export as cURL commands
har -f capture.har export postman -o collection.json # Export Postman collection
har diff before.har after.har                        # Compare captures
har merge a.har b.har -o merged.har                  # Merge captures
har -f capture.har split --by domain                 # Split captures
har -f capture.har dedup --remove -o dedup.har       # Remove duplicate requests
har -f capture.har index --pattern "api"             # Build/query index
har -f capture.har validate                          # Validate HAR spec
har -f capture.har replay                            # Replay HTTP requests

Command Reference

Go SDK

package main

import (
	"fmt"
	"log"

	har "github.com/cyberspacesec/har-skills"
)

func main() {
	h, err := har.ParseHarFile("capture.har")
	if err != nil {
		log.Fatal(err)
	}

	stats := h.Statistics()
	fmt.Printf("requests=%d avg=%.1fms\n", stats.TotalRequests, stats.AvgTime)

	security := h.SecurityAudit()
	fmt.Printf("security=%d/100\n", security.Score)

	perf := h.PerformanceScore()
	fmt.Printf("performance=%s %.1f/100\n", perf.Grade(), perf.OverallScore)

	redacted := h.Redact(har.DefaultRedactOptions())
	if err := redacted.SaveToFile("clean.har", true); err != nil {
		log.Fatal(err)
	}
}

SDK Capability Areas

• Parsing: files, bytes, readers, gzip-compressed input, stdin-friendly workflows.
• Large files: standard, optimized, lazy, and streaming parsing models.
• Creation: build HAR files programmatically and save formatted JSON.
• Search/filter: methods, status codes, domains, content types, URL patterns, timing, size.
• Statistics: global summaries, timing percentiles, domains, status codes, content distribution.
• Security: headers, cookies, CORS, mixed content, sensitive data exposure.
• Performance: TTFB, total load time, request count, transfer size, cache, compression.
• Privacy: redaction of credentials, tokens, API keys, cookies, headers, IP addresses.
• Operations: validate, transform, replay, extract, deduplicate, index.
• Interop: diff, merge, split, export to common developer and report formats.

Project Layout

.
├── *.go                 # Root Go SDK package
├── cmd/har/             # Cobra CLI used by humans and agents
├── CLAUDE.md            # Progressive AI Agent Skill documentation
├── docs/assets/         # Generated README diagrams and static assets
├── scripts/             # Documentation generation helpers
├── examples/            # SDK examples
├── testdata/            # HAR fixtures
└── doc/                 # Additional human documentation

For Agent Tool Authors

If you are wrapping HAR Skills for another agent runtime:

1. Use the CLI first when you need a stable process boundary.
2. Prefer --format json for model-readable outputs.
3. Run redact before sending HAR-derived content to external systems.
4. Use validate before deeper analysis when the capture source is unknown.
5. Use the Go SDK when you need long-running workers, custom filters, or embedded policy.

Contributing

Contributions are welcome. Please read CONTRIBUTING.md for guidelines.

License

MIT License

简体中文

HAR Skills 是一个 AI 原生的 HAR（HTTP Archive）分析工具集。

它优先面向 AI Agent 设计，同时提供 CLI 和 Go SDK。Agent 可以通过一个 har 命令完成 HAR 文件的解析、搜索、安全审计、性能评分、脱敏、重放、转换、对比、合并拆分和多格式导出。

AI Agent 接入方式

给 Agent 的一键提示词

你可以使用 HAR Skills 分析 HAR（HTTP Archive）文件。

安装：
  go install github.com/cyberspacesec/har-skills/cmd/har@latest

基础用法：
  har -f <capture.har> <command> [flags]
  cat capture.har | har <command>
  har -f capture.har <command> --format json

优先从这些命令开始：
  har -f capture.har info --format json
  har -f capture.har security --format json
  har -f capture.har performance --format json
  har -f capture.har find --errors --format json
  har -f capture.har find --slow 1000 --format json
  har -f capture.har redact -o clean.har

完整 Skill 文档：
  https://github.com/cyberspacesec/har-skills/blob/main/CLAUDE.md

能力概览

• 读入与解析：文件、字节、Reader、stdin、gzip、标准/优化/懒加载/流式解析。
• 检索与洞察：概要、列表、URL/正则搜索、状态码、Header、Cookie、域名、耗时、瀑布流。
• 安全与隐私：安全响应头、Cookie 安全、CORS、混合内容、敏感信息泄露、数据脱敏。
• 性能分析：TTFB、总加载耗时、请求数量、传输体积、缓存、压缩和优化建议。
• 操作与修复：验证、转换 URL/Header/Scheme、重放请求、提取响应体、去重、索引。
• 协作与导出：diff、merge、split，导出 curl、wget、Python、Postman、CSV、Markdown、HTML、JSON、JSONL、YAML、XML。

常用命令

har -f capture.har info --format json          # 文件概要
har -f capture.har find --errors --format json # 失败请求
har -f capture.har find --slow 1000            # 慢请求
har -f capture.har security                    # 安全审计
har -f capture.har performance                 # 性能评分
har -f capture.har redact -o clean.har         # 脱敏
har -f capture.har export curl                 # 导出复现命令
har diff before.har after.har                  # 对比两个 HAR
har merge a.har b.har -o merged.har            # 合并 HAR
har -f capture.har validate                    # 规范校验

Go SDK 示例

import har "github.com/cyberspacesec/har-skills"

h, err := har.ParseHarFile("capture.har")
if err != nil {
	panic(err)
}

stats := h.Statistics()
security := h.SecurityAudit()
performance := h.PerformanceScore()

_, _, _ = stats, security, performance