From apiregen
Phase 1 — RECON: Analyze captured traffic to build a comprehensive context profile of the target site.
How this command is triggered — by the user, by Claude, or both
Slash command
/apiregen:reconcommands/This command is limited to the following tools:
The summary Claude sees in its command listing — used to decide when to auto-load this command
# Phase 1 — RECON You are performing Phase 1 (Recon) of the API reverse engineering workflow. Your goal is to build a **Page Context Document** — a comprehensive profile of the target site derived entirely from captured HAR traffic. ## Input The user will provide: 1. **Target page** — the URL they want to reverse-engineer 2. **Data of interest** — what they want to extract (e.g., events, odds, products, prices) 3. **HAR file(s)** — path to a `.har` file or a directory containing them If the user hasn't provided all three, ask for the missing pieces before proceeding. ## Procedure ### ...
You are performing Phase 1 (Recon) of the API reverse engineering workflow. Your goal is to build a Page Context Document — a comprehensive profile of the target site derived entirely from captured HAR traffic.
The user will provide:
.har file or a directory containing themIf the user hasn't provided all three, ask for the missing pieces before proceeding.
Use load_har to ingest the HAR file(s). Confirm how many entries and sessions were loaded.
har_overview to get summary statistics.har_domains to list every domain contacted.For each domain classified as Data API:
har_endpoints filtered to that domain to list all unique endpoints./graphql paths or query/mutation in request bodies.api.example.com/v2/...).har_search_headers with name_pattern matching common auth headers: authorization, x-auth, x-api-key, x-csrf, x-xsrf, bearer.har_cookies to find session/auth cookies (look for names containing: token, auth, session, csrf, jwt, sid).har_search_headers looking for CDN/WAF signatures:
cf-ray, cf-cache-statusx-akamaix-served-by, x-fastlyx-amz-cfx-iinfohar_search_bodies with pattern looking for CAPTCHA scripts: recaptcha, hcaptcha, turnstile, challenges.cloudflare.har_search_headers with name_pattern="upgrade" and value_pattern="websocket" to find WebSocket connections.har_search with mime_type="event-stream" to find SSE connections.har_search_bodies in response bodies looking for framework signatures:
__REACT, _reactRootContainer, react-domng-version, ng-app, angular__VUE, vue-router, vuex__NEXT_DATA__, _next/__NUXT__Produce a Page Context Document with these sections:
One-paragraph plain-language summary of what the site is, what stack it uses, and where data comes from.
Table of every domain contacted, classified by category, with request counts.
Before finalizing, search the web and any available source code for additional context about the target's API:
Document any findings:
Format the document clearly with markdown headers and tables. Save the document to .apiregen/reports/page-context.md. This document will be referenced in all subsequent phases.
After the Page Context Document is written, dispatch the appropriate specialist(s) via the Agent tool based on detected signals. Multiple specialists may apply to the same target:
rest-api-specialist — invoke when versioned REST paths (/api/v1/, /rest/), REST envelopes ({data, meta}), pagination params (offset/limit/cursor), Bearer/API-key auth, or REST client libraries (axios, fetch, Retrofit, OkHttp) are detected.graphql-specialist — invoke when a /graphql endpoint accepting {query, variables}, GraphQL operation strings (query/mutation/subscription), AST literals in JS bundles, persisted-query fields (documentId, sha256Hash), or Apollo/Relay/urql client signatures are detected.websocket-specialist — invoke when WebSocket upgrade handshakes, ws:///wss:// URLs, graphql-ws / socket.io / SignalR / STOMP / MQTT signatures, binary frame handling (Protobuf/MessagePack), or real-time data (live odds, live scores, chat, streams) are detected.grpc-transport-specialist — invoke when gRPC, gRPC-Web, Connect, Twirp, Protobuf-over-HTTP, service/method paths, grpc-status, grpc-timeout, connect-protocol-version, or generated Protobuf clients are detected.realtime-framework-specialist — invoke when Socket.IO, SignalR, STOMP, MQTT-over-WebSocket, Phoenix Channels, Pusher, Ably, Centrifugo, Mercure, SSE/EventSource, or long-polling fallback patterns are detected.rpc-transport-specialist — invoke when JSON-RPC, tRPC, XML-RPC, SOAP, OData actions/functions, batch endpoints, or custom command/action envelopes are detected.mobile-transport-specialist — invoke for APK/mobile app targets or when OkHttp, Retrofit, Volley, Ktor, URLSession, Alamofire, Moya, native interceptors, certificate pinning, attestation, or mobile-only headers are detected.Pass each specialist the path to the saved Page Context Document and the relevant HAR path so it can continue from the recon findings without repeating discovery work.
npx claudepluginhub livedge/apiregen --plugin apiregen/reconRuns a full reconnaissance pipeline on a target: enumerates subdomains, discovers live hosts, crawls URLs, classifies by bug class, and scans for vulnerabilities with nuclei. Outputs results to a target-specific directory.
/reconSearches npm and GitHub for promising packages in a category for CVE hunting (JS/Python/Go), filters by stars/activity/CVEs, ranks top 5 candidates, and proposes the best target.