Everything RequestFox does

Capture every call, the moment it starts

Press Start (or Alt Shift S) and use your app. RequestFox lists fetch, XMLHttpRequest, WebSocket frames and server-sent events across tabs, iframes and pop-ups, including calls a service worker answers without the network.

• A call shows as soon as it starts and turns SLOW live if it drags; its finished card replaces it.
• Live streams: server-sent events, NDJSON and token streams, read with fetch, XMLHttpRequest or EventSource, stay open as rows that fill as events arrive. RequestFox keeps the newest ones within the body limit, and flags error events, a missing end marker and long pauses. A page's gRPC-Web or Connect server stream is kept the same way.
• The log can be a table: one line per call, sorted by a click on a heading, with columns that read a value out of each JSON answer (data.items.length), a Group by host view and a session Overview (calls, errors, slow calls, status families, the slowest five, hosts). A 5,000-call log only draws the rows on screen.
• Each call is tied to the click or form submit that caused it.
• Every session goes to History, to reopen, search and compare with another run.
• Search takes free text and tokens such as status:500, host:api.example.com and path:/users/:id; a leading - leaves matches out.

Problems flagged for you

These are the panel's own labels. Open a flagged call and it says what happened in plain words.

• FAILED refused, timed out, or a 4xx/5xx answer
• SLOW past the slow threshold you set
• RAPID 140ms the same call fired twice in a moment
• RETRY 900ms sent again after it failed
• N+1 one call per id in a quick burst
• GRAPHQL ERROR an error inside a 200 OK
• RPC ERROR a JSON-RPC error inside a 200 OK
• Token expired a 401 caused by an expired JWT
• SCHEMA CHANGED the answer's JSON shape changed
• SPEC MISMATCH the call breaks your linked OpenAPI spec
• ASSERTION FAILED one of your checks failed
• SECURITY a passive finding, such as a token in a URL

Inspect without leaving the page

Each call opens to its headers, body and Details: the timing split (DNS, connect, TLS, waiting, download), the HTTP version, bytes on the wire, and the page functions that made the call.

• JSON answers read as a tree you can filter, with a value's path one click away.
• The Timeline puts every call on a time ruler; Performance lists the heaviest endpoints.
• GraphQL calls are checked against a schema you load, and so are their answers: a wrong type, a null in a non-null field or a missing field is named by its place in the answer. Every flagged call carries a stable finding code (such as RF-FAILED-5XX) and a "Why is this flagged?" explanation, offline.
• gRPC-Web and Connect answers are read as fields once you load your .proto files (RequestFox's own parser), and by field number without them.
• SOAP and XML: import a WSDL, read an XML answer as a tree, and add XPath checks (XPath 1.0 subset, our own reader).
• A call to an LLM API (OpenAI-style, Anthropic or Gemini) shows the model, the token counts and the stop reason its own answer gives. Nothing is estimated, and no cost is shown.

Compose, replay and send

Replay any captured call, or Edit & Replay it. Compose builds requests from scratch with Params, Headers, raw, form or multipart bodies, environments and {{variables}}, secret variables kept encrypted, and saved collections. Up to five requests stay open at once as chips above the URL, each with its own form and answer, and they come back when the panel opens again (typed secrets are never written to disk).

• Auth: Basic, Bearer, API key, Digest, OAuth 2.0 (browser sign-in with PKCE, device code, client credentials, refresh token, password), OpenID Connect discovery, OAuth 1.0a (HMAC, RSA and PLAINTEXT signatures), JWT Bearer signing (HS, RS and ES algorithms), AWS Signature v4 and an HMAC preset.
• Save an answer as an example, and keep notes on requests, collections and folders. The QUERY method (a safe request with a body) is in every method list.
• A cookie jar, per site and off until you turn it on, keeps the cookies a site sets so a sign-in carries to your next sends. It never touches the browser's own cookies, and cookie values never go into an export or the log. Importing the browser's cookies for a site is the one step that asks for an optional permission.
• While recording, a send goes through the page with its cookies; with nothing recording it goes from the extension itself, without any page's cookies.
• A WebSocket client connects to any ws:// or wss:// server, with a Socket.IO mode; captured Socket.IO frames read as events and their arguments.
• An MCP server tester: connect to an MCP server over Streamable HTTP, list its tools, resources and prompts, and call one from a form built from its schema. It only sends the requests you pick and shows the answers.
• Copy any request as code in 15 languages, cURL for bash and Windows cmd included.
• Environments can inherit from a parent, and a .env file imports as an environment (credential-like values go to the encrypted vault).

Import from Postman, Insomnia, Bruno, Hoppscotch, Thunder Client, OpenAPI 3, Swagger 2, HAR and cURL, from a file, several files or a whole folder at once (batch import, with one summary of what happened to each file), or from a URL (Import from URL: the browser asks for access to that one site). How to replay and edit a request.

Mocks and faults

Make an endpoint fail, slow down, pause for editing, or return the answer you choose, with no backend change. "Mock this response" turns any captured call into a mock in one step.

• Rule profiles and mock sets stay on with nothing recording: switch one on and its header, URL or mock rules apply to the sites it names in every tab, until you switch it off. A chip under the top bar says what is on. Each is one JSON file to share.
• In Chrome, rewrite the request or the reply with a script: sign a header, add a field to every body, or change what the page gets back. In Chrome and Firefox, WebSocket message rules drop or change a socket's text messages by text or a JSON field.
• In Chrome, Slow down the whole tab (Slow 3G, Fast 3G, 4G, offline or your own numbers) through the browser's debugger. It is optional, asks once, and Chrome then shows its own "started debugging this browser" bar. Firefox has no such API, so it offers each rule's Slow and Throttle modes instead. DevTools throttles with nothing to allow.

How to mock an API response.

Checks, contracts and suites

Add pass/fail checks to an endpoint on status, time, fields, headers or a JSON Schema, or a check that an answer stays the same as last time. Advice on caching and compression points out a large text answer sent uncompressed, or the same answer downloaded again with nothing a cache could use. Link an OpenAPI spec and every call is checked against it, with coverage of the operations seen. Chain saved requests into suites, with pass or fail per step and data-driven runs.

How to check API calls against OpenAPI.

Export evidence and tests

Export a session as a self-contained HTML report, HAR, CSV, session JSON, a Postman collection or an OpenAPI 3.0 spec built from the calls. Export your saved collections for Bruno, Insomnia or Hoppscotch (passwords, tokens and keys become empty variables to fill in), or as one API docs page (Export docs) with no script and no outside link. Open a GitHub or Linear issue with the repro filled in. Turn a recording into tests:

• Playwright
• Cypress
• k6
• JMeter
• Gatling
• Locust

Run the same checks in CI with the command-line tool you download from the panel; it can also make negative tests from an OpenAPI spec (probe) and serve a mock API from one (mock). The CLI can send over HTTP/2 (--http2, no quiet fall-back to HTTP/1.1), write the docs page (docs), say why a finding is flagged (explain) and fail only on new findings (--baseline). How to run API checks in CI.

Private by design

No account, no server, no analytics. Authorization headers, cookies and secret-shaped fields are redacted in everything you view or export, and site access is asked for when you press Start. Read the privacy policy.

What it does not do

• It sees what a browser tab sends. Mobile and desktop apps need a proxy-based tool.
• No team workspace or cloud sync, by design. Share work as files: collections, sessions, HAR and reports.
• Pre-request and post-response scripts, and rewriting a request or reply with a script, run in Chrome only; Firefox does not let extensions run code typed at runtime. Chaining values between requests works in both.
• No native gRPC or MQTT client: gRPC-Web and Connect work from a browser; client and bidirectional streams cannot be sent from one.
• RequestFox contains no AI model and no AI code. The MCP server tester and the LLM call view only test and inspect other services. MCP servers that run as a local program (stdio) are out of a browser's reach.
• It is free. Its code is MIT-licensed and ships readable inside the extension; the source repository is not public.