Release notes

Live capture, plus optional history

Open the Netraptor panel in DevTools and the inspected tab's requests appear right away: documents, scripts, styles, images, fonts and API calls, with no rule to set up. Live traffic stays in memory for the open panel. Record this site is now Keep history for this site. Turn it on and Netraptor saves fetch and XHR calls to disk and captures them with DevTools closed. Saved sessions appear in the session picker next to the live one, and the Free plan keeps the last three.

Guide: How to find the API endpoints of a website using browser developer tools

Resource type chips with multi-select

Filter by Fetch/XHR, GraphQL, Doc, JS, CSS, Img, Media, Font, WS, Wasm or Other, as in Chrome's Network panel. Cmd/Ctrl-click selects several chips at once. The API Map, API exports and Agent Tools still list only fetch, XHR and GraphQL endpoints, so images and scripts never show up as endpoints.

Waterfall, timing, initiators and cookies

A Waterfall column draws each request's queueing, connection, wait and download phases, and a Timing tab lists them with durations. The Initiator tab shows the call stack with file:line links that open the source when Chrome reports them. A Cookies tab splits the request and response cookies. The detail pane docks to the right or the bottom, and you can drag it to resize.

Right-click menu with copy and resend

Right-click a request to copy it as cURL (bash or cmd), PowerShell, fetch or Node.js fetch, or to copy the response, or the request as HAR. Resend runs the request again with fetch in the inspected page, and Edit and resend lets you change the method, URL, headers and body first. The new request shows up in the list tagged Resent. Save all as HAR (sanitized) strips credentials from headers, URLs and JSON bodies. Resend works on live traffic only, not on saved history, because replay needs the page you are inspecting.

Guide: How to open a HAR file: free HAR viewers and HAR analyzers

Hide noise and collapse repeats

Hide noise is on by default and hides analytics, realtime channels and ad requests, with a count for each category. Turn it off to see them dimmed in place. Mute a domain or an endpoint from the row menu and manage the list in Settings. Identical requests that arrive back to back, with the same method, URL, status and request body, collapse into one row marked ×3. Expand it to inspect every member.

Chrome-style filters and search across bodies

The filter box suggests keywords as you type, accepts OR between terms and lists your recent filters. Press Cmd/Ctrl+F to search request and response headers and bodies in the selected session, with case-sensitive and regex options. Each match shows a snippet, and opening one clears any filter that hides it. Live response bodies load on demand, so text matches appear as they are read.

Keyboard shortcuts, free themes and saved filters

Arrow keys move through rows, Enter opens one, / focuses the filter, Cmd/Ctrl+L clears the log and ? opens the full list. System, Light and Dark themes are free, along with app colour presets (Netraptor, Chrome, Firefox, GitHub and Nord). Saved filters, which used to be Pro, are free too.

A popup that shows what is being captured

The toolbar popup tells you to open DevTools to start capturing, shows capture status and stats, and offers quick export of saved history. Page groups in Requests and the API Map now also split on single-page-app route changes, so a pushState navigation starts a new group.

Fixes and improvements

• Export filenames use your local date instead of the UTC date.
• Agent Tools merges duplicate endpoints on the same site and names the remaining variants by what differs between them, instead of adding _2 and _3.
• Binary and control-character bodies show as a hex view instead of garbled text.
• Right-clicking a request no longer changes which request the detail pane shows.

Requests grouped by page load

Every reload or navigation now starts a new group headed "Reloaded" or "Navigated to", with the time and the number of requests it made. With Collapse on reload turned on (the default), earlier loads fold away when the page loads again, the way Chrome clears its log, and expand with one click. Clear (or Cmd/Ctrl+K) hides earlier requests from the view without deleting them, and Show brings them back.

Guide: How to find the API endpoints of a website using browser developer tools

Drag to reorder and hide columns

Drag any table header left or right to move the column. Right-click a header to show or hide columns or reset order, visibility and widths. Each table remembers its own layout.

Paste a filter into the rule builder

The rule builder's Expression box is now editable. Paste a filter such as has-request-header:x-region jwt:region=au and the condition rows are rebuilt from it. Terms the rows can't express, such as domain: or larger-than:, stay in the text and the rule is saved as written.

Guide: JWT decode: how to decode a JWT token in Chrome without an online decoder

JSON viewer colour themes

Pick from Netraptor, GitHub, Monokai, Dracula, Solarized or Nord in Settings, with a live preview. Each theme has light and dark variants, and the viewer's gear menu has a quick switcher.

Fixes and improvements

• Invert now applies to the type chip and Security filters as well as the filter text, and is disabled when there is nothing to invert.

Fixes and improvements

• Uninstalling opens a short, optional survey on netraptor.dev. Nothing is sent unless you submit it.

Fixes and improvements

• Open tabs no longer log "Extension context invalidated" after Netraptor reloads or updates.
• With Local MCP turned on and no server running, Chrome no longer logs a connection error on every retry.
• Settings opens in a tab when Chrome refuses to open the options page from the popup.
• The Crawl tab no longer crashes on forms saved by older versions.
• The MCP server (0.3.2) exits when your coding agent disconnects and reports its real version.

Recording rules

Turn on Record this site in the toolbar popup and Netraptor saves every fetch and XHR call for that domain and its subdomains, across page loads, with or without DevTools open. Settings lists every recording rule, including hosts like localhost:3000.

Guide: How to find the API endpoints of a website using browser developer tools

Crawl in your logged-in tab

Crawl this site visits same-site links in your own tab, so it sees what you see. It skips links that look like logout or delete actions, and form filling is opt-in per domain and never touches payment or password forms. Free crawls cover 25 pages; Pro goes up to 1000 and shows every endpoint and schema change between two crawls.

A Requests table modelled on Chrome's Network panel

Name, Method, Status, Type, Initiator, Size and Time columns you can resize and sort, with Headers, Payload, Preview, Response and Security tabs for each request. Filters use Chrome's syntax (method:POST, status-code:4xx) plus -/path to hide a path prefix.

API Map and GraphQL

The API Map groups calls into endpoints such as /orders/{id} and shows real request and response samples. Apps that use GraphQL get a GraphQL tab listing each operation.

JWT and security checks

Netraptor finds JWTs in headers, cookies, URL parameters and bodies and decodes them on your machine. The Security menu flags expired tokens, alg: none, tokens in URLs, missing exp, Access-Control-Allow-Origin: * and more in one click, and filters like jwt:role=admin or jwt(token_id):region=au narrow the list. Custom rules can be built and tested against a recorded session.

Guide: JWT decode: how to decode a JWT token in Chrome without an online decoder

Exports

Free exports a Postman collection grouped by page, a HAR file or one cURL command per endpoint. Pro adds OpenAPI 3.1 (YAML or JSON), Bruno and Insomnia. Auth headers and cookies are stripped by default.

Guide: What is an OpenAPI spec, and how to generate one from your web app's traffic

Agent Tools and a local MCP server

Pro turns captured endpoints, forms and GraphQL operations into WebMCP registerTool code, form annotations or MCP tool definitions. The local, read-only MCP server lets Claude Code, Cursor and other clients look up your recorded endpoints and real responses.

Guide: An MCP server for your web app's API traffic (Codex, Claude Code, Cursor)