GarethQ: AJAX calls & JSON?
Can the tool intercept the internal XHR/fetch calls a page makes to its own backend — the private JSON API behind the rendered HTML — and expose those endpoints through the MCP as callable tools, so I can hit them on demand during a session instead of scraping the DOM?
Two things I specifically want to know:
1. Does it capture the request headers and session auth/tokens so a discovered endpoint stays callable after the tab closes, or only live while the page is open?
2. How does it handle endpoints protected by signed, CSRF, or HMAC'd parameters — does it replay/refresh those, or do they break?
Arjun_RetrieverAI
Aug 2, 2026A: Hey yes, with our recording feature: you can start recording, demonstrate a task, and finish and prompt to create a subroutine of executable code that hits the underlying APIs of a website.
This code on replay then gets executed from within the context of the webpage so all the headers/CSRF/HMAC get automatically created and propagated.
More info:
- https://www.rtrvr.ai/blog/ai-subroutines-zero-token-deterministic-automation
- https://www.rtrvr.ai/blog/vibe-hacking-rover-gemini-flash-lite
In the video on the post, we created subroutine to get any user's Twitter followers by reverse engineering Twitter's graphql.