Browser to API

Cursor/Codex skill that reverse-engineers any website into a documented API client by analyzing network activity, CDP logs, and site behavior.

What It Does

browser-to-api turns a captured browser session into a best-effort OpenAPI 3.1 spec, HTML coverage report, and zero-dependency client.mjs. It consumes a sibling Browserbase browser-trace run; it does not itself drive the browser or capture traffic. Source: Browserbase browser-to-api SKILL.md, 2026-06-30

How It Works

1. Run browser-trace against an existing CDP target, Browserbase session, browse, Stagehand, Playwright, or another browser driver.
2. Optionally run browse network on before the flow so response bodies are available; the CDP firehose alone has request bodies but not response bodies.
3. Drive the flows whose API surface matters.
4. Run browser-to-api over .o11y/<run>/cdp/network/{requests,responses}.jsonl.
5. Inspect the generated index.html, openapi.yaml, confidence.json, samples/, and client.mjs.

The skill decomposes GraphQL / JSON-RPC style multiplexed endpoints by operationName / method-like fields, filters analytics and bot-defense noise, redacts common secrets, and flags confidence limits. The output is inductive evidence from observed traffic, not an upstream contract. Source: Browserbase browser-to-api SKILL.md, 2026-06-30

Reviewed Demo

The X artifact shows Codex Developer Mode prompted to "Browser to API reverse engineer opentable" for restaurant availability and reservations. The reviewed video frames show a bounded public OpenTable availability trace, followed by a generated report titled "OpenTable Availability and Reservation APIs (observed)" with 10 operations, GraphQL APQ endpoint /dapi/fe/gql, 16 samples, variables, curl/client examples, and redacted fields. Source: X/@derekmeegan video artifact, reviewed 2026-06-30

That makes the durable idea: use the browser as an API-discovery probe when the public page already exercises a backend API, then promote the repeated client into a typed tool only after source review, redaction, and terms-of-service judgment. It is not a license to scrape private flows.

Current Source Snapshot

As of the 2026-06-30 version check, browserbase/skills is on main at commit d919e311d6ce8d8b3daa5f33853e67e43a545b9a, with 3,614 stars and 228 forks. The latest observed commit hardens trace artifacts to owner-only permissions because CDP captures can contain cookies, auth headers, bearer tokens, passwords, private URLs, and authenticated screenshots. Source: GitHub API, 2026-06-30

skills.sh lists browser-to-api at roughly 1.4K installs and points installation to npx skills add https://github.com/browserbase/skills --skill browser-to-api. Source: skills.sh, 2026-06-30

Safety And Install Gate

Do not silently import this as an always-on executable skill yet. The capability is useful, but the risk surface is unusually sharp: traces and generated reports can include credentials, cookies, bearer tokens, private URLs, user identifiers, and third-party response bodies. The skills.sh security surface flagged the package as high-risk for credential exposure and third-party-content prompt injection, and Brin returned a caution verdict for the repo/skill. Source: skills.sh security check and Brin API review, 2026-06-30

Kevin's route:

• Use as a candidate workflow for undocumented API discovery.
• Run only in an isolated project/run directory.
• Scope with --origins and --include / --exclude.
• Add custom --redact keys before report sharing.
• Treat generated specs and clients as local/private until manually reviewed.
• Promote to an executable local skill only after skill-auditor, Brin, source review, and a redaction fixture.

Relevance to Kevin's Stack

Complements Browser Testing Skills and Browserbase Browse.sh (Open Web Catalog) for structured extraction. Where agent-browser automates interaction and visual/state inspection, browser-to-api extracts a programmatic API hypothesis from observed traffic. The right routing is: explore with browser automation, capture with browser-trace, generate a spec with browser-to-api, then turn only stable, permitted endpoints into a boring CLI/tool. Source: compiled from X bookmark analysis, 2026-06-30

Signal

2,428 likes and 4,371 bookmarks indicate strong developer interest in reverse-engineering web APIs without scraping. The bookmark-to-like ratio (1.8x) suggests high "save for later" utility. Source: X engagement data, 2026-05-13

---

Timeline

• 2026-05-13 | Announced on X by @derekmeegan. Demo showed Codex one-shotting an OpenTable API client. Source: X/@derekmeegan, 2026-05-13
• 2026-06-30 | Deep-reviewed the local thumbnail/video artifact, upstream browser-to-api and browser-trace skill docs, skills.sh install surface, Brin verdict, and security warnings. Promoted as a routed candidate with a redaction/manual-review gate, not as an active auto-installed skill. Source: GitHub browserbase/skills, commit d919e311d6ce8d8b3daa5f33853e67e43a545b9a; X/@derekmeegan video artifact