fiddler-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| open_archiveA | Parse a Fiddler .saz archive and return an overview. Archives are cached; use reload=true to re-read. Args: saz_path: Path to the .saz file. reload: Re-parse the file even if already cached. |
| list_sessionsA | List sessions (method, URL, status, duration, size, process...) with pagination. Args: saz_path: Path to the .saz file (parsed on first use). limit: Max sessions to return (1-500). offset: Skip the first N sessions (pagination). |
| get_sessionA | Full details of one session: request & response start lines, headers, bodies, timers, flags. This is the only tool that returns the complete (unredacted) URL and bodies — intended for deep inspection of a specific session. Args: saz_path: Path to the .saz file. index: Session number (1-based, as shown by list_sessions). include_body: Decode and show bodies (may be truncated). max_body_chars: Max chars of each decoded body to include. |
| filter_sessionsA | Search/filter sessions by host, method, status, URL keyword or regex, body keywords, size and duration. Args: saz_path: Path to the .saz file. host: Substring match on Host[:port]. method: HTTP method, e.g. GET/POST (case-insensitive). status: Exact status code. status_min / status_max: Status code range. url_keyword: Case-insensitive substring of the URL. url_regex: Regex (Python syntax, max 200 chars) matched against the URL. req_body_keyword: Substring search inside the decoded request body. resp_body_keyword: Substring search inside the decoded response body. min_size / max_size: Request+response body size range in bytes. min_ms / max_ms: Total duration range in milliseconds. only_errors: Only 4xx/5xx responses. only_redirects: Only 3xx responses. only_success: Only 2xx responses. with_response: True/False to require/forbid a response. websocket: True/False to require/forbid WebSocket messages. limit: Max sessions returned (1-1000). |
| session_statsB | Aggregate statistics: method/status/host distribution, traffic volume, duration percentiles, error samples. Args: saz_path: Path to the .saz file. |
| slow_requestsA | Rank sessions by total duration (Fiddler TOTAL = ClientDoneResponse - ClientBeginRequest). Args: saz_path: Path to the .saz file. top_n: How many slowest sessions to return (1-100). min_ms: Only consider sessions slower than this threshold. |
| security_scanA | Scan traffic for security issues: cleartext credentials, secret tokens in URLs/bodies, cookie flags, sensitive files, PII leakage. Args: saz_path: Path to the .saz file. max_findings: Cap on reported findings (1-2000). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool has a clearly distinct purpose: opening the archive, listing sessions, inspecting a single session, filtering by criteria, computing statistics, ranking slow requests, and security scanning. Even the overlapping list/filter tools are differentiated by filtering vs. plain pagination, and slow_requests is a specific ranking view.
Most tools follow a verb_noun pattern (open_archive, list_sessions, get_session, filter_sessions), but session_stats, slow_requests, and security_scan use descriptive noun phrases rather than imperative verbs. All names are snake_case and readable, so the deviation is minor.
Seven tools is well-scoped for a Fiddler archive analysis server. Each tool earns its place, covering the full range of archive inspection and analysis without redundancy or bloat.
The toolset covers the complete analysis workflow: loading/parsing the archive, listing sessions, deep inspection, filtering/searching, aggregate statistics, performance ranking, and security scanning. Minor potential gaps like archive comparison or export are not core to the domain.