Derive Client
Reverse-engineer a website's internal API by recording browser traffic into a HAR file...
Install
npx skills add vercel-labs/agent-browser --skill derive-client -g -a claude-code -y- Repository
- vercel-labs/agent-browser45.1k
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Lightabout 1,194 tokens
- Runs scripts
- No, instructions only
What it does
Reverse-engineer a website's internal API by recording browser traffic into a HAR file, then generate a standalone client or CLI that calls the endpoints directly, with no browser needed after the first recording. Use when asked to "derive a client", "build a CLI for <site>", "reverse engineer this site's API", "record network requests", "turn this site into an API", or when the same site will be automated repeatedly and direct HTTP calls would beat driving the browser every time.
Derive an API client from a recorded session
Driving a browser is the right tool for the first visit and the wrong tool for the hundredth. This skill records a site's network traffic once while you use it, then turns the captured requests into a standalone client (script, CLI, or library) that talks to the site's internal API directly.
The recording alone contains everything needed: agent-browser embeds text response bodies (JSON/HTML/JS) in the HAR by default, so endpoint shapes can be studied offline after the browser is closed.
Workflow
1. Record Start HAR capture, drive the flows you want in the client
2. Identify Find the real API endpoints among the noise
3. Extract Pull request shapes, response schemas, and auth material
4. Generate Write the client, one function per flow
5. Verify Call every endpoint for real before declaring done
1. Record
agent-browser network har start # embeds text response bodies by default
# ... drive the site: search, open a detail page, paginate, etc. ...
agent-browser network har stop /tmp/site.har
- Exercise every flow the client should support, and run each one at least twice with different inputs (two search terms, two detail pages). Diffing the recorded URLs reveals which parts are parameters.
- If the site needs login, log in before starting the HAR so credentials don't land in the recording unnecessarily. The session cookies are exported separately in step 3.
--content allembeds binary bodies too (base64);--content nonedisables embedding. Per-body cap is 2 MB.
While the session is still open, agent-browser network requests and network request <id> give the same data interactively, but only the HAR survives navigation and browser close, so prefer it for anything multi-page.
2. Identify endpoints
Query the HAR with jq:
