claudechrome-endpoint-extractor

name	claudechrome-endpoint-extractor
description	Extract API endpoints from the active ClaudeChrome browser tab and save them as local artifacts. Use when the user asks to find, capture, reverse engineer, document, or generate Python scripts for endpoints used by the current tab, this page, a live website, or a user-specified browser interaction in ClaudeChrome.

ClaudeChrome Endpoint Extractor

Overview

Use ClaudeChrome's browser MCP tools as the source of truth for live page state, network requests, runtime JavaScript, cookies/storage, and visible behavior. Produce durable local artifacts: structured endpoint JSON, Markdown notes, and Python client scripts generated by scripts/write_endpoint_artifacts.py.

Workflow

1. Confirm the active tab with browser__session_context or browser__get_page_info.
2. Capture the starting request list with browser__get_requests; use include_bodies: true only when response-body capture is enabled and needed.
3. Trigger the user-desired action in the bound tab: type, click, navigate, submit forms, switch tabs inside the app, or run focused browser__evaluate_js when direct DOM interaction is more reliable.
4. Re-read requests with URL filters for likely API hosts, paths, methods, or user terms.
5. Open important requests with browser__get_request_detail; record method, URL, status, headers, query parameters, payload shape, and response hints. Redact secrets from cookies, authorization headers, tokens, and signed URLs unless the user explicitly asks to preserve them locally.
6. If request bodies are unavailable or the page hides behavior behind bundled code, inspect live runtime assets from the tab. Use browser__evaluate_js to read loaded script URLs, fetch same-origin chunks, inspect webpack module exports, or extract function source snippets from the live runtime.
7. Save a normalized endpoint spec JSON and run scripts/write_endpoint_artifacts.py to create docs and Python scripts.
8. Verify by reading back the generated files. If safe and useful, run syntax checks on generated Python, but do not call private or state-changing endpoints unless the user explicitly asks.

Endpoint Spec Shape

The helper script accepts either a direct endpoints array or a capture-style object with confirmed_endpoints. Prefer this shape for new captures:

{
  "page": {
    "url": "https://example.com/app",
    "title": "Example App",
    "tab_id": 123
  },
  "evidence": [
    {
      "kind": "observed_network",
      "request_id": "req_...",
      "note": "Captured after pressing Translate"
    }
  ],
  "endpoints": [
    {
      "name": "translate_text",
      "kind": "observed_network",
      "host": "https://api.example.com",
      "path": "/v1/translate",
      "method": "POST",
      "headers": {"Content-Type": "application/json"},
      "params": {"client": "web"},
      "body_shape": {"text": "string", "to": "language code"},
      "signature_mode": "dynamic signature if present",
      "notes": ["Auth token was redacted"]
    }
  ]
}

Generate Artifacts

Run the helper from the skill directory or by absolute path:

python /path/to/claudechrome-endpoint-extractor/scripts/write_endpoint_artifacts.py \
  --spec /path/to/endpoints.json \
  --output-dir /path/to/output-dir \
  --client-name ExampleClient

Generated files:

• endpoints.normalized.json: normalized endpoint data used by the generator.
• ENDPOINTS.md: concise endpoint documentation and evidence notes.
• api_client.py: a requests-based Python client with one method per endpoint.

Python Client Boundaries

Generated clients are scaffolds for reproducible probing, not guaranteed bypasses for private APIs. Preserve dynamic signature, nonce, timestamp, CSRF, and auth requirements as explicit method parameters or TODO comments. Do not hard-code secrets from the browser session. If a captured endpoint depends on browser-only signing code, document the signing source and keep the generated method conservative.

ClaudeChrome Notes

Prefer browser MCP over static assumptions. Treat this page and current tab as the bound tab unless the user specifies a tab id. Use resolved_tab_id or the observed tab id in saved artifacts when possible. Cross-tab reads are acceptable when requested; cross-tab writes must be explicit.