Why your coding agent can't see your app's API calls (and how to fix it in Claude Code, Cursor and Codex)

A coding agent is a process on your machine. It reads files, runs shell commands and calls the tools you connect. Your app's API calls run somewhere else, inside a Chrome tab, carried by your session cookies, and Chrome only lists them in the Network panel while DevTools is open. Nothing connects that tab to the agent unless you add something that does.

So the agent falls back on what it can reach.

• It reads your frontend source. That tells it which URL the code builds, but not what the server sends back, which fields are optional, or what the error body looks like.
• It runs curl from the terminal. That request has none of your login cookies, so a logged-in endpoint answers 401 or redirects to the login page.
• It guesses. Payload shapes and endpoint names get filled in from patterns, and the code looks plausible until you run it.

Search terms like "claude code browser", "cursor browser" and "browser mcp" come from this gap. There are three ways to close it, and they suit different jobs.

1. Paste it. Copy as cURL or export a HAR file and paste it into the chat. Works with any agent and needs no setup. It is manual, covers only what you copied, and leaks tokens unless you clean it first.
2. Let the agent drive its own browser. Chrome DevTools MCP, Playwright MCP, Claude in Chrome or Cursor's built-in browser give the agent a browser to open pages in and read requests from. Best for reproducing a bug. The agent sees only what it loads in that session, and logged-in pages need a login in that browser.
3. Let the agent read traffic you already recorded. A local MCP server, such as the one in Netraptor Pro, serves calls recorded in your own logged-in browser, grouped by endpoint. Best for writing code against the API. It is read-only and covers only what you recorded.

You can combine them. Many people use a browser MCP server to reproduce and a recorded-traffic server to answer API questions.

For a single failing call this is the fastest route. Open DevTools, go to the Network panel, reproduce the problem, right-click the request and choose Copy, then Copy as cURL. Paste it into the chat with the response body and ask your question. For a whole flow, export a HAR file. How to create a HAR file in Chrome walks through it.

The costs add up quickly.

• Copy as cURL includes the request's headers, so cookies and bearer tokens go into the chat unless you delete them.
• Chrome's default HAR export is sanitized, which removes only the Cookie, Set-Cookie and Authorization headers. Tokens in URLs, custom headers and bodies stay in the file. See what a HAR file contains.
• A HAR file for a few minutes of use can hold hundreds of requests, including scripts and images, and it all lands in the agent's context.
• The paste is a snapshot. When the API changes, you copy again.

Pasting is the right choice for a one-off question about one request, or when you can't install anything.

A browser MCP server gives the agent tools to open pages, click, type and read what the page did. The main choices:

• Chrome DevTools MCP, from the Chrome DevTools team. Network, console, screenshots, performance traces and Lighthouse. Add it with claude mcp add chrome-devtools --scope user -- npx chrome-devtools-mcp@latest. Setup, attach mode and flags are in our Chrome DevTools MCP guide.
• Playwright MCP, from Microsoft. Drives Chrome, Firefox, WebKit or Edge from the accessibility tree and can mock responses. Add it with claude mcp add playwright npx @playwright/mcp@latest.
• Claude in Chrome, Anthropic's browser extension. Start Claude Code with claude --chrome. Claude opens new tabs in your Chrome and shares its login state, and its tools include reading console messages and network requests. It needs a direct Anthropic plan (Pro, Max, Team or Enterprise).
• Cursor's browser, built into Cursor Agent. It runs as a web view inside Cursor, reads console messages and monitors the page's HTTP requests and responses. Cookies and storage persist per workspace, so you log in there once.

This is the better choice when the agent has to act. Reproducing a bug, checking that a UI fix works, reading console errors after a change, profiling a slow page and testing a flow end to end all need a live browser. It is also the only option of the three that can see pages you have never opened, because the agent can open them.

The limits show up when the question is about the API as a whole.

• The agent sees only the requests from pages it loads in that session. Chrome DevTools MCP's request list starts again at each navigation, and its includePreservedRequests option reaches back 3 navigations.
• Logged-in pages need a login in the agent's browser. Chrome DevTools MCP and Playwright MCP start their own browser profile unless you use attach mode or an extension, and attaching hands the agent your real session.
• Each page the agent walks through costs tool calls and context, so mapping a large dashboard this way is slow.
• Requests come back as a flat list of URLs, so /orders/1042 and /orders/1043 are two rows the agent has to group itself.

The third option skips the agent's browser. You use your app the way you normally do, and the agent queries what you recorded. Netraptor is a Chrome extension that records your app's fetch and XHR calls in your own signed-in Chrome. Turn on "Keep history for this site" in its popup and it saves those calls in your browser, with DevTools open or closed. "Crawl this site" visits same-site pages you would not click by hand.

Netraptor Pro includes a local, read-only MCP server, @branch42-labs/netraptor-mcp. Your agent starts it over stdio, and it reads the sessions saved in your browser. It exposes five tools.

• list_sessions lists your saved sessions.
• list_endpoints lists a session's endpoints as path templates like /orders/{id}, with call counts and status codes.
• get_endpoint returns one endpoint's inferred request and response schema, its parameters, the pages that called it and a few real examples.
• search finds endpoints by path, URL or GraphQL operation name across all saved sessions.
• get_request returns one recorded request with headers and bodies.

A few details matter before you rely on it.

• It reads saved sessions only. Traffic you watch in the Netraptor DevTools panel without Keep history stays in memory and is not available to the agent.
• It redacts before the agent sees anything. Headers, URL parameters and top-level JSON fields with sensitive names, such as Authorization, Cookie or names containing token, secret, session or key, come back as [redacted]. Nested JSON fields are not redacted, so use a test account for data you would not paste into a chat.
• Netraptor records from inside the page, so a request only has the headers your site's code set. Browser-added headers such as Cookie are never recorded. Chrome DevTools MCP shows them.
• It can't click, navigate or send requests. Anything you never opened or crawled is missing.
• It is part of Pro, a one-time $29.99 purchase. Recording, Keep history and Postman, HAR and curl exports are on the Free plan.

Pairing happens once. In Netraptor, open Settings, then Local MCP server, copy the pairing command (npx -y @branch42-labs/netraptor-mcp pair NR-…), run it in a terminal and turn on the switch. The server listens only on 127.0.0.1:47321, accepts connections only from the extension, and both sides prove the pairing secret with HMAC-SHA256 before any data moves. Keep Chrome running while the agent works. The MCP server guide covers the full setup and security model.

For a browser, start Claude Code with Claude in Chrome, or add Chrome DevTools MCP for every project.

claude --chrome
# or
claude mcp add chrome-devtools --scope user -- npx chrome-devtools-mcp@latest

For recorded traffic, pair Netraptor once, then add the server. Run /mcp inside Claude Code to check that it connected.

claude mcp add netraptor -- npx -y @branch42-labs/netraptor-mcp

Cursor's built-in browser covers console and network for pages the agent opens, with nothing to install. To add recorded traffic, or Chrome DevTools MCP for DevTools features, add entries under mcpServers in ~/.cursor/mcp.json for all projects or .cursor/mcp.json for one (Cursor MCP docs).

{
  "mcpServers": {
    "netraptor": {
      "command": "npx",
      "args": ["-y", "@branch42-labs/netraptor-mcp"]
    },
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest"]
    }
  }
}

Codex adds stdio servers with codex mcp add and stores them in ~/.codex/config.toml, which the Codex CLI and IDE extension share (Codex MCP docs).

codex mcp add netraptor -- npx -y @branch42-labs/netraptor-mcp
codex mcp add chrome-devtools -- npx chrome-devtools-mcp@latest
codex mcp list

If you prefer to edit the file, this is the same Netraptor entry in TOML.

[mcp_servers.netraptor]
command = "npx"
args = ["-y", "@branch42-labs/netraptor-mcp"]

Specific questions get the best answers, because the agent can look up one endpoint instead of reading everything. Prompts that work well:

• "What does GET /orders/{id} return? Show me a real response."
• "Write a typed client for the endpoints the checkout page calls."
• "Which calls returned 401 in my last session, and what did the token refresh request return just before?"
• "Generate a mock server for the endpoints under /api/billing using the recorded responses."
• "Which GraphQL operations does the dashboard run, and what variables does each take?"

If you would rather hand the agent a file, generate an OpenAPI spec from the same traffic. To read the endpoint list yourself first, see how to find every API endpoint a web app calls.

• One request, one question: paste it with Copy as cURL, minus the tokens.
• The agent has to reproduce, click or verify: Chrome DevTools MCP for Chrome-specific debugging, Playwright MCP for flows and other browsers, Claude in Chrome or Cursor's browser if you want the one built into your agent.
• The agent has to write code against your app's real API: recorded traffic through Netraptor's MCP server.
• A page nobody has opened yet: a browser MCP server, or record or crawl it first.

The common pattern is both: the recorded traffic tells the agent which endpoints exist and what they return, and a browser MCP server lets it check the fix.