Product README

The technical map of Guardian.

A privacy-conscious Chrome DevTools extension for monitoring selected API contracts and turning captured JSON payloads into reusable extraction recipes.

Product boundary

Free

Useful without an upgrade

  • Capture Fetch, XHR, JSON, GraphQL, XML, and API-like traffic.
  • Pause or resume capture globally.
  • Normalize endpoints and infer JSON schemas.
  • Search, pin, unpin, delete, and export contract baselines.
  • Check drift only for pinned contracts.
  • View endpoint-grouped, field-level drift breakdowns.
  • Rank and deduplicate API Finder candidates.
  • Use Ollama locally or bring an optional cloud AI key.
Payload Lab Pro

$129 one time

  • Inspect complete captured JSON responses.
  • Browse every distinct JSON path.
  • Select an array and enumerate all nested fields.
  • Map payload values into structured rows.
  • Preview extracted data.
  • Export CSV, recipe JSON, JavaScript, and Loompath.
  • Activate one license on up to three devices.

How capture works

Guardian observes network entries exposed through the Chrome DevTools API while its panel is open. It does not inject scripts into the inspected website and does not request access to every site.

  • Reloading, navigating, or changing SPA routes begins a clean observation window.
  • Saved baselines remain available across capture sessions.
  • Response bodies remain in memory and are not persisted.
  • Rendering is batched and expensive ranking is deferred until API Finder is visible.
  • Requests from an earlier navigation generation are discarded.

Cached and service-worker responses may appear without readable content on the first pass. Keep Guardian open and reload to let Chrome expose the response body.

AI providers

ProviderProtocolData location
OllamaLocal /api/chatLocal machine
OpenAIResponses APIOpenAI
ClaudeAnthropic Messages APIAnthropic
OpenRouterChat CompletionsOpenRouter and routed provider
ZenMuxChat CompletionsZenMux and routed provider

External providers are optional. Guardian displays a persistent warning and API Finder requires a per-run acknowledgement. User-supplied API keys are stored in Chrome local storage and sent only to the selected provider.

API Finder

API Finder combines deterministic response analysis with optional AI reasoning. It ranks first-party candidates using visible sample matches, expected field names, object arrays, collection size, resource type, and API-like URLs.

Trackers and static assets receive strong penalties. Third-party traffic is hidden by default, and repeated requests sharing a normalized method and endpoint are represented by one strongest candidate.

The optional AI report receives only the strongest bounded candidates and returns the best endpoint, confidence, supporting evidence, observed parameters, a sanitized cURL example, and credible alternatives.

External evidence boundaries

  • Secret-like fields and query parameters are redacted.
  • Authorization and cookie headers are excluded.
  • Response excerpts and compact schemas are truncated.
  • The user explicitly acknowledges every external API Finder run.

Lemon Squeezy licensing

Payload Lab Pro is a $129 one-time purchase. Guardian activates one Lemon Squeezy license instance per installation, validates no more than daily, and provides a seven-day offline grace period after a successful check.

The production build allows variant 1952527. One license may be active on up to three devices when the Lemon Squeezy activation limit is configured to three. Deactivation removes local license state and releases the installation’s license instance.

Get Payload Lab Pro

Ollama setup

The default provider uses http://localhost:11434 with a text-oriented model such as qwen3:8b.

$env:OLLAMA_ORIGINS = "chrome-extension://YOUR_EXTENSION_ID"
ollama serve

The endpoint and model can be changed in Guardian settings. API Finder reads the active model context allocation and fits ranked evidence into the available budget.

Architecture

ComponentResponsibility
devtools.html / devtools.jsRegisters the Contract Guardian DevTools panel.
panel.html / panel.jsTraffic capture, contracts, API Finder, Payload Lab, licensing UI, and exports.
background.jsAI provider requests, local Ollama proxying, and Lemon Squeezy operations.
lib/contracts.jsEndpoint normalization, schema inference, drift comparison, and redaction.
lib/extractor.jsExhaustive JSON-path discovery, extraction, and CSV generation.
lib/license-config.jsProduction variant, checkout, validation interval, and offline grace settings.

Security and publishing notes

  • Bricolage Grotesque is bundled locally under the SIL Open Font License.
  • Captured payloads are treated as untrusted input.
  • Guardian never executes AI responses or downloaded code.
  • Cloud AI transfer occurs only after user selection and disclosure.
  • Authenticated replay and automated scheduling are intentionally outside the current product boundary.
  • The extension requests only storage plus narrowly scoped provider and licensing hosts.

For step-by-step instructions, continue to the detailed usage guide.