Overview
API discovery, protocol reverse-engineering, JavaScript security code review, and request export.
API Security Researcher passively monitors web traffic to map APIs, decode protocols, and surface security issues — all from your browser. What it does: - Captures fetch, XHR, WebSocket, and EventSource traffic without requiring debugger or webRequest permissions - Automatically decodes Protobuf, JSPB, gRPC-Web, GraphQL, Server-Sent Events, NDJSON, Google batchexecute, and async chunked responses - Learns API schemas from observed traffic — request/response structures, URL parameters, field types, and enums - Probes for official API documentation on discovered interfaces - Performs static analysis of JavaScript bundles using Babel AST to extract API call sites, proto - field maps, and enums before requests even happen - Detects DOM XSS sinks, open redirects, prototype pollution, unsafe postMessage listeners, and other security patterns with taint tracking from user-controlled sources - Exports requests as curl, fetch, or Python snippets - Exports and imports OpenAPI 3.0.3 specs with protobuf field number round-tripping - Cross-tab request log filtering and collaborative field/parameter renaming Who it's for: Security researchers, penetration testers, bug bounty hunters, and developers who want to understand the APIs behind any website. Code can be viewed at https://github.com/NDevTK/APIClient under the GNU GPL v3 license.
Details
- Version1.0.0
- Updated5 April 2026
- Size489KiB
- LanguagesEnglish (United Kingdom)
- DeveloperWebsite
Email
ndevtk@protonmail.com - Non-traderThis developer has not identified itself as a trader. For consumers in the European Union, please note that consumer rights do not apply to contracts between you and this developer.
Privacy
This developer declares that your data is
- Not being sold to third parties, outside of the approved use cases
- Not being used or transferred for purposes that are unrelated to the item's core functionality
- Not being used or transferred to determine creditworthiness or for lending purposes
