Atlas / MCP servers / elonjask / Reqable

ReqableSAFE

Name: Reqable
Author: elonjask

mcp/elonjask/reqable

MCP server by elonjask · Audited 2026-10-06

⚑ Report / re-scan Source ↗

MCP server for Reqable local capture data

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

17 16r · 1w · 0d

Transport

—

License

MIT

Stars

242

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Reqable MCP Server exposes local Reqable capture traffic to MCP clients (Windsurf/Cursor/Claude/Codex).

Default architecture is local-only:

Reqable posts HAR(JSON) to http://127.0.0.1:18765/report.
Optional incremental WebSocket events can be posted to http://127.0.0.1:18765/ws/events.
reqable-mcp normalizes and stores requests/messages in local SQLite.
MCP tools query local data only (no cloud relay by default).

Docs: English | 中文

Features

Local-first, privacy-first ingest path.
Real-time ingest via Reqable Report Server.
HAR file import fallback for missed sessions.
HTTP request query/search/domain stats/API analysis.
WebSocket session/message parsing for HAR entries carrying message-frame extensions.
Cross-platform runtime (macOS / Linux / Windows with Python 3.10+).

Prerequisites

Install and open Reqable.
Configure Reqable Report Server to post to http://127.0.0.1:18765/report.
Ensure Node.js (for npx) and uv (for uvx) are available.

Installation

Run via npx (recommended)

npx -y reqable-mcp@latest

Local development

uv run reqable-mcp

MCP Client Configuration

{
"mcpServers": {
"reqable": {
"command": "npx",
"args": ["-y", "reqable-mcp@latest"]
}
}
}

Reqable Report Server Setup

Use these values in Reqable "Add Report Server":

Name: reqable-mcp-local
Match rule: * (or your target domains)
Server URL: http://127.0.0.1:18765/report
Compression: None (or keep consistent with your receiver)

After saving, generate traffic and call ingest_status to verify incoming payload count.

Important note: reqable-mcp still uses HTTP-only ingest transport (no

Read from source at commit 3c0217d13257OBSERVED · 2026-10-06

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add reqable-mcp --env REQABLE_INGEST_TOKEN=${REQABLE_INGEST_TOKEN} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "reqable-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "REQABLE_INGEST_TOKEN": "${REQABLE_INGEST_TOKEN}"
      }
    }
  }
}

Exposed tools (17)

16 read · 1 write · 0 destructive.

Tool	Risk	Description
`analyze_api`	read	Analyze API structure for a specific domain.
`analyze_websocket_session`	read	Analyze a WebSocket session and summarize frame directions, types, JSON shapes, and close events.
`export_websocket_session_raw`	read	Export the raw uploaded WebSocket session entry and raw frame list.
`generate_code`	read	Generate API call code from a captured request.
`get_domains`	read	Get all captured domains with request counts.
`get_request`	read	Get detailed information for a single request.
`get_websocket_session`	read	Get WebSocket session details and messages by request ID.
`health_report`	read	Return ingest status plus data quality checks for WebSocket payloads.
`import_har`	write	Import a HAR file (or line-delimited JSON entries) as fallback.
`ingest_status`	read	Check local ingest server status.
`list_active_websocket_sessions`	read	List recently active WebSocket sessions inferred from latest captured frames.
`list_requests`	read	List recent HTTP/WebSocket handshake requests captured from Reqable reports.
`list_websocket_sessions`	read	List captured WebSocket sessions.
`repair_websocket_messages`	read	Backfill missing WebSocket message fields from raw frames.
`search_requests`	read	Search requests by keyword in URL, bodies, or raw uploaded entry (`raw` / `raw_entry`).
`search_websocket_messages`	read	Search WebSocket messages by keyword and precise frame filters.
`tail_websocket_messages`	read	Tail WebSocket messages for one session using seq cursor.

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (10)

LOWInventory / provenance · inv.hidden_file · CWE-1104

.pre-commit-config.yaml

.pre-commit-config.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/reqable_mcp/normalizer.py:39

hashlib.sha1(request_body.encode("utf-8", errors="ignore")).hexdigest()[:12],

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/reqable_mcp/normalizer.py:40

hashlib.sha1(response_body.encode("utf-8", errors="ignore")).hexdigest()[:12],

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/reqable_mcp/normalizer.py:43

digest = hashlib.sha1(seed.encode("utf-8", errors="ignore")).hexdigest()[:24]