Network Inspector: Find in Content
network_inspector_findSearch captured Roku network traffic—request/response URLs, headers, and bodies—for any text or regex. Find which requests contain a session ID, error string, or JSON field across all captured traffic.
Instructions
Search the FULL content of captured transactions — request/response URL, headers, and bodies — for query, unlike network_inspector_list_events' host filter which only matches hostname/SNI/URL. This is the tool for "which request(s) contain X" (a session id, an error string, a specific JSON field/value) across the whole buffer, without paging through every event with get_event_detail. Each result carries total (match count), scopes (per-scope breakdown: url/reqHeaders/reqBody/respHeaders/respBody), and the matching event's summary (host/url/method/status) inline. query is required; scopes optionally narrows which parts are searched (omit for all); caseSensitive (default false); regex treats query as a JS regex (a dangerous/over-long pattern safely degrades to a literal search rather than erroring). device optional — omit to search every Roku with captured traffic. limit caps results (default 50, max 500). Requires Network Inspector enabled (see network_inspector_status).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max matching events to return (default 50, max 500). | |
| query | Yes | Required. Text (or regex, with `regex: true`) to search for. | |
| regex | No | Treat `query` as a JS regular expression (default false). | |
| device | No | Optional Roku IP or serial. Omit to search every Roku with captured traffic. | |
| scopes | No | Optional. Which parts to search: url, reqHeaders, reqBody, respHeaders, respBody. Omit for all. | |
| caseSensitive | No | Case-sensitive match (default false). |