Netraptor 0.1.0: record, crawl and export your web app's API
Version 0.1.0 · Released
Netraptor 0.1.0 is the first public release. It records the API calls your web app makes, crawls the pages you would not click by hand, and exports what it found to Postman, HAR, cURL, OpenAPI 3.1 or tools for coding agents. Everything stays in your browser.
Recording rules
Turn on Record this site in the toolbar popup and Netraptor saves every fetch and XHR call for that domain and its subdomains, across page loads, with or without DevTools open. Settings lists every recording rule, including hosts like localhost:3000.
Guide: How to find the API endpoints of a website using browser developer tools
Crawl in your logged-in tab
Crawl this site visits same-site links in your own tab, so it sees what you see. It skips links that look like logout or delete actions, and form filling is opt-in per domain and never touches payment or password forms. Free crawls cover 25 pages; Pro goes up to 1000 and shows every endpoint and schema change between two crawls.
A Requests table modelled on Chrome's Network panel
Name, Method, Status, Type, Initiator, Size and Time columns you can resize and sort, with Headers, Payload, Preview, Response and Security tabs for each request. Filters use Chrome's syntax (method:POST, status-code:4xx) plus -/path to hide a path prefix.
API Map and GraphQL
The API Map groups calls into endpoints such as /orders/{id} and shows real request and response samples. Apps that use GraphQL get a GraphQL tab listing each operation.
JWT and security checks
Netraptor finds JWTs in headers, cookies, URL parameters and bodies and decodes them on your machine. The Security menu flags expired tokens, alg: none, tokens in URLs, missing exp, Access-Control-Allow-Origin: * and more in one click, and filters like jwt:role=admin or jwt(token_id):region=au narrow the list. Custom rules can be built and tested against a recorded session.
Guide: JWT decode: how to decode a JWT token in Chrome without an online decoder
Exports
Free exports a Postman collection grouped by page, a HAR file or one cURL command per endpoint. Pro adds OpenAPI 3.1 (YAML or JSON), Bruno and Insomnia. Auth headers and cookies are stripped by default.
Guide: What is an OpenAPI spec, and how to generate one from your web app's traffic
Agent Tools and a local MCP server
Pro turns captured endpoints, forms and GraphQL operations into WebMCP registerTool code, form annotations or MCP tool definitions. The local, read-only MCP server lets Claude Code, Cursor and other clients look up your recorded endpoints and real responses.
Guide: An MCP server for your web app's API traffic (Codex, Claude Code, Cursor)