HTTP Monitor

Inspect, intercept, modify and redirect fetch/XHR requests. Network simulation, captures, statistics and DevTools.

HTTP Monitor turns the Network tab into a workbench: it does not just observe a page's traffic, it lets you intervene in it without touching the application code or standing up a test server. WHAT YOU CAN DO Mock and patch - Mock responses. Set the status, headers and body you need for any request, with dynamic templates ({{uuid}}, {{now}}, {{req.body.customer.id}}) and named variants per rule you switch between in a click. - Mock server-sent event streams. Write the stream in raw SSE format, or as a form with one block per event, and give each event its own delay so the pacing matches what the real endpoint does. - Patch real responses. Instead of replacing the whole payload, apply a patch on top of what the server returned and leave the rest untouched. Requests - Edit requests before they leave: URL, method, headers, query parameters and body. Every header and query row can either set a value or remove it outright, because sending an empty "Authorization:" is not the same as not sending it. - Keep named request variants on a single rule ("As admin", "As reader") instead of duplicating the rule just to change a header. - Redirect traffic from one environment to another without changing your project's configuration. - Build requests from scratch and send them, filed in the same folders as the rules that describe the same API. Control - Match a URL seven ways: contains, does not contain, equals, starts with, ends with, wildcard, or regular expression. - Condition a rule on a named query parameter or request header, or on the path, method, body or status code. - Simulate network conditions: latency, intermittent errors and connection failures, to exercise the paths you can rarely reproduce by hand. - Group rules into scenarios ("Empty lists", "Backend down") you switch on all at once, and organise them in nested folders with tags. - Keep global settings — site scope, capture list, blocklist, redirects, headers, hooks — in a tree of inheriting profiles (Base -> QA -> QA - Sprint 42). A child adds to what it inherits or switches single entries off; nothing is ever copied, so editing the parent reaches every descendant. Capture and inspect - Capture traffic with full request and response detail: fetch and XHR, WebSocket frames in both directions, SSE streams, sendBeacon, and calls made inside Web Workers. - Turn on deep mode for a tab to capture what no in-page interceptor can reach: the document navigation, every subresource of every frame, service worker traffic, preflight OPTIONS, and real response bodies for all of it. - Search inside a body. The field prunes the JSON tree to the branches that match and keeps the path to each one, so you still see the shape around the hit instead of a flat list of paths. - Read a bearer token without leaving the browser: algorithm, key id, an expiry countdown and every claim, decoded locally — no pasting tokens into a web page. - Replay any capture with your edits against the real server, from the page itself, so it carries the page's own cookies, origin and referer. - Export to Postman or HAR, and import a Postman collection back as rules. Insights - A prioritised list of findings, not a dashboard: duplicate calls, serial chains, connection queueing, backend-bound latency, uncompressed payloads, cacheable GETs, calls sent after the token had expired, personal data over-exposed in payloads, credentials in query strings, missing policy headers, response shapes that are not stable between calls, p50 regressions against a frozen baseline, and rules that are armed but never fired. - Every finding carries its evidence, an estimated cost and an action. Copy one as a Markdown issue, or the whole session as a report. - See which third parties the app talks to, and how many bytes it sends them — not just what it downloads. - Generate TypeScript interfaces from every body observed, with fields marked optional because they were genuinely missing from some samples. Scripting - Write your own JavaScript, in a real editor, when a declarative rule is not enough: a response script per rule, with state that survives between calls. - Or install global hooks that run around every intercepted call with no rule at all — onBeforeSend to see and rewrite what the app really sends, onResponseReceived to change what it gets back. A "debugger;" inside a hook stops DevTools on the real call. WHY INSTALL IT Reproducing a backend failure often costs more than fixing it: you need the right data, the right environment, or someone willing to break a service on purpose. HTTP Monitor removes that step. You force the 500, the timeout, the malformed payload or the edge case that only happens in production, straight from the browser, in seconds, and repeatably. It works just as well for frontend development against a backend that does not exist yet, for QA covering hard-to-trigger cases, and for diagnosing live what a page is actually requesting — including the traffic the page itself cannot see. Available as a popup, a side panel, and its own panel in DevTools (F12), with nine themes (Light, Dark, System, Solarized, Nord, One Dark Pro, Dracula, Monokai and a high-contrast palette) and keyboard shortcuts throughout. A floating panel on the page itself shows which calls the extension is currently affecting. DEEP MODE, AND WHAT IT COSTS Deep mode is built on Chrome's debugger API, so it is off by default and switched on one tab at a time. While it is on, Chrome shows its "being debugged" banner, DevTools cannot attach its own debugger to that same tab, and every request pauses briefly, which is real latency. Everything else in the extension works without it: deep mode exists only for the traffic and the response bodies an in-page interceptor is not able to see. KNOWN LIMITS - SharedWorker is deliberately left alone. Intercepting it would mean starting its message port, which would deliver messages before the app registers its own handler and lose them. - data:, blob:, srcdoc and sandboxed frames without allow-same-origin receive no content script. Only the network layer and deep mode reach them. - Synchronous XHR is never held or delegated — during page startup or inside a worker — because it cannot wait without freezing the thread. - Response bodies for traffic outside the page require deep mode. Chrome offers no other way. - A WebSocket can be blocked, redirected, made to fail and captured, but not mocked: a conversation is not a response you can write in a box. A stream is, which is why SSE can be. PRIVACY Captures and configuration are stored only in your browser. The extension has no server, includes no analytics, and sends your traffic to no third party. It also starts restricted rather than open: out of the box the site list is empty and the extension acts on no page at all until you add one.