Product boundary
Useful without an upgrade
- Capture Fetch, XHR, JSON, GraphQL, XML, and API-like traffic.
- Pause or resume capture globally.
- Normalize endpoints and infer JSON schemas.
- Search, pin, unpin, delete, and export contract baselines.
- Check drift only for pinned contracts.
- View endpoint-grouped, field-level drift breakdowns.
- Rank and deduplicate API Finder candidates.
- Use Ollama locally or bring an optional cloud AI key.
$129 one time
- Inspect complete captured JSON responses.
- Browse every distinct JSON path.
- Select an array and enumerate all nested fields.
- Map payload values into structured rows.
- Preview extracted data.
- Export CSV, recipe JSON, JavaScript, and Loompath.
- Activate one license on up to three devices.
How capture works
Guardian observes network entries exposed through the Chrome DevTools API while its panel is open. It does not inject scripts into the inspected website and does not request access to every site.
- Reloading, navigating, or changing SPA routes begins a clean observation window.
- Saved baselines remain available across capture sessions.
- Response bodies remain in memory and are not persisted.
- Rendering is batched and expensive ranking is deferred until API Finder is visible.
- Requests from an earlier navigation generation are discarded.
Cached and service-worker responses may appear without readable content on the first pass. Keep Guardian open and reload to let Chrome expose the response body.
AI providers
| Provider | Protocol | Data location |
|---|---|---|
| Ollama | Local /api/chat | Local machine |
| OpenAI | Responses API | OpenAI |
| Claude | Anthropic Messages API | Anthropic |
| OpenRouter | Chat Completions | OpenRouter and routed provider |
| ZenMux | Chat Completions | ZenMux and routed provider |
External providers are optional. Guardian displays a persistent warning and API Finder requires a per-run acknowledgement. User-supplied API keys are stored in Chrome local storage and sent only to the selected provider.
API Finder
API Finder combines deterministic response analysis with optional AI reasoning. It ranks first-party candidates using visible sample matches, expected field names, object arrays, collection size, resource type, and API-like URLs.
Trackers and static assets receive strong penalties. Third-party traffic is hidden by default, and repeated requests sharing a normalized method and endpoint are represented by one strongest candidate.
The optional AI report receives only the strongest bounded candidates and returns the best endpoint, confidence, supporting evidence, observed parameters, a sanitized cURL example, and credible alternatives.
External evidence boundaries
- Secret-like fields and query parameters are redacted.
- Authorization and cookie headers are excluded.
- Response excerpts and compact schemas are truncated.
- The user explicitly acknowledges every external API Finder run.
Lemon Squeezy licensing
Payload Lab Pro is a $129 one-time purchase. Guardian activates one Lemon Squeezy license instance per installation, validates no more than daily, and provides a seven-day offline grace period after a successful check.
The production build allows variant 1952527. One license may be active on up to three devices when the Lemon Squeezy activation limit is configured to three. Deactivation removes local license state and releases the installation’s license instance.
Ollama setup
The default provider uses http://localhost:11434 with a text-oriented model such as qwen3:8b.
$env:OLLAMA_ORIGINS = "chrome-extension://YOUR_EXTENSION_ID"
ollama serveThe endpoint and model can be changed in Guardian settings. API Finder reads the active model context allocation and fits ranked evidence into the available budget.
Architecture
| Component | Responsibility |
|---|---|
devtools.html / devtools.js | Registers the Contract Guardian DevTools panel. |
panel.html / panel.js | Traffic capture, contracts, API Finder, Payload Lab, licensing UI, and exports. |
background.js | AI provider requests, local Ollama proxying, and Lemon Squeezy operations. |
lib/contracts.js | Endpoint normalization, schema inference, drift comparison, and redaction. |
lib/extractor.js | Exhaustive JSON-path discovery, extraction, and CSV generation. |
lib/license-config.js | Production variant, checkout, validation interval, and offline grace settings. |
Security and publishing notes
- Bricolage Grotesque is bundled locally under the SIL Open Font License.
- Captured payloads are treated as untrusted input.
- Guardian never executes AI responses or downloaded code.
- Cloud AI transfer occurs only after user selection and disclosure.
- Authenticated replay and automated scheduling are intentionally outside the current product boundary.
- The extension requests only
storageplus narrowly scoped provider and licensing hosts.
For step-by-step instructions, continue to the detailed usage guide.