Content
# HTTP Inspector MCP Server
A Streamable HTTP-based MCP server that integrates a web panel and screenshot functionality. A one-stop HTTP traffic inspection toolbox with single process and single port. Solves the problem of needing manual reproduction and screenshots after AI automated penetration testing.
## Features
- **Send arbitrary HTTP requests** — Supports all methods, custom headers/body, proxies, and timeouts (similar to Burp Repeater)
- **Web panel** — Real-time traffic history table (SSE push), raw HTTP details view, and manual send panel
- **Screenshots** — AI can call `screenshot_panel` to capture the web panel and return a PNG file URL
- **Streamable HTTP** — MCP client connects through `http://localhost:9876/mcp`
## Quick Start
```bash
# Install dependencies
cd mcp-http-inspector
pip install -e .
# Install Chromium browser (for screenshots)
# The project includes pre-built Chrome for linux/mac-arm/win64 in the browsers/ directory
# No extra installation needed; automatically detected on launch
# Run
python server.py
```
Open a browser and navigate to `http://localhost:9876` to view the web panel.
## MCP Client Configuration
```json
{
"mcpServers": {
"http-inspector": {
"url": "http://localhost:9876/mcp"
}
}
}
```
## MCP Tools
| Tool | Description |
|---|---|
| `send_http_request` | Send arbitrary HTTP requests, supports `auto_screenshot` for one-step screenshot capture |
| `list_history` | List request history, supports filtering and pagination (does not return raw body) |
| `get_request_detail` | Get raw HTTP request/response by ID (truncates 5000 characters by default) |
| `screenshot_panel` | Capture the web panel (history/detail/sender) and return a PNG download URL |
| `screenshot_last_request` | Quickly capture a screenshot of the latest request's detail without needing an ID |
| `clear_all_history` | Clear all history records and screenshot files |
> For more usage guides, see `.reasonix/skills/http-inspector/SKILL.md`
## Architecture
```
MCP Client ──HTTP──▶ :9876/mcp (Streamable HTTP)
Browser ──HTTP──▶ :9876/ (Web panel SPA)
:9876/api/* (REST + SSE)
│
httpx ──▶ Target server
SQLite ◀── History storage
Playwright ──▶ Screenshots
```
## Supported Platforms
Automatically detects the OS to select the built-in Chrome browser:
| System | Path |
|---|---|
| Linux x64 | `browsers/chrome-linux64/chrome` |
| macOS ARM | `browsers/chrome-mac-arm64/.../Google Chrome for Testing` |
| Windows x64 | `browsers/chrome-win64/chrome.exe` |
