derive-client

derive-client is a skill for Claude Code from fcakyon/claude-codex-settings. It costs 100 tokens per session (1,205 once invoked), scanned A, a copy of derive-client, Apache-2.0.

A workflow that records a website's browser network traffic in a HAR file and turns the captured requests into a standalone client, script, or command-line tool. A HAR file is a saved record of browser requests and responses.

In plain words
What is it for?
Use it to reverse-engineer a site's API, generate clients for specific user flows, and verify those flows directly against the endpoints.
Why use it?
It removes the need to drive the browser for every later request and helps identify the site's internal API, request formats, responses, and authentication details.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Part of the agent-browser plugin — 6 skills shipped together

Good fit Use it to reverse-engineer a site's API, generate clients for specific user flows, and verify those flows directly against the endpoints.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/fcakyon/claude-codex-settings/derive-client
About the project

claude-codex-settings is a collection of configurations and reusable extensions for Claude Code, OpenAI Codex, Cursor, and related coding tools. Developers use its skills, commands, hooks, agents, plugins, and MCP servers to shape coding-agent workflows and connect alternative model APIs. The catalogue entries are components of this collection that can be installed into supported coding tools.

fcakyon/claude-codex-settings · 1,178 stars · on GitHub · claudesettings.com

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add fcakyon/claude-codex-settings --skill derive-client
Clone the repo
git clone --depth 1 https://github.com/fcakyon/claude-codex-settings

Made for: Claude Code.

Or install agent-browser, the plugin that ships this one along with the rest of its 6 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for derive-client

README.md
[![agentmods](https://agentmods.dev/badge/skills/fcakyon/claude-codex-settings/derive-client/github.svg)](https://agentmods.dev/skills/fcakyon/claude-codex-settings/derive-client)
Your own site
<a href="https://agentmods.dev/skills/fcakyon/claude-codex-settings/derive-client"><img src="https://agentmods.dev/badge/skills/fcakyon/claude-codex-settings/derive-client/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for derive-client

Your own site · 80×15
<a href="https://agentmods.dev/skills/fcakyon/claude-codex-settings/derive-client"><img src="https://agentmods.dev/badge/skills/fcakyon/claude-codex-settings/derive-client.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 100 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,205 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin 91% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00100 $0.01205
Opus 5.5 $0.00040 $0.00482
Sonnet 5.5 $0.00020 $0.00241
Haiku 4.5 $0.00010 $0.00120

Measured 15d ago against content hash f8ef4e450c9b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

derive-client scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Origin

This is a copy

91% identical to derive-client — 1 line differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

plugins/agent-browser/skills/derive-client/SKILL.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Derive an API client from a recorded session

Driving a browser is the right tool for the first visit and the wrong tool for the hundredth. This skill records a site's network traffic once while you use it, then turns the captured requests into a standalone client (script, CLI, or library) that talks to the site's internal API directly.

The recording alone contains everything needed: agent-browser embeds text response bodies (JSON/HTML/JS) in the HAR by default, so endpoint shapes can be studied offline after the browser is closed.

Workflow

1. Record     Start HAR capture, drive the flows you want in the client
2. Identify   Find the real API endpoints among the noise
3. Extract    Pull request shapes, response schemas, and auth material
4. Generate   Write the client, one function per flow
5. Verify     Call every endpoint for real before declaring done

1. Record

agent-browser network har start          # embeds text response bodies by default
# ... drive the site: search, open a detail page, paginate, etc. ...
agent-browser network har stop /tmp/site.har
  • Exercise every flow the client should support, and run each one at least twice with different inputs (two search terms, two detail pages). Diffing the recorded URLs reveals which parts are parameters.
  • If the site needs login, log in before starting the HAR so credentials don't land in the recording unnecessarily. The session cookies are exported separately in step 3.
  • --content all embeds binary bodies too (base64); --content none disables embedding. Per-body cap is 2 MB.

While the session is still open, agent-browser network requests and network request <id> give the same data interactively — but only the HAR survives navigation and browser close, so prefer it for anything multi-page.

2. Identify endpoints

Query the HAR with jq:

# All JSON API calls: method, URL, status
jq -r '.log.entries[]
  | select(.response.content.mimeType | test("json"))
  | "\(.request.method) \(.response.status) \(.request.url)"' /tmp/site.har

Read the full file on GitHub · 88 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 15d ago First seen · 88 lines · 100 tokens per session scan A f8ef4e450c9b

Subscribe to this mod's changes

derive-client is a skill published in the GitHub repository fcakyon/claude-codex-settings (1,178 stars, last pushed yesterday), licensed Apache-2.0. It adds 100 tokens to every session and 1,205 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 91% identical to derive-client, differing in 1 line, and is treated as a copy.

Related

Other skills, from other repositories

lov-optimize-tauri-backend

Optimize Tauri backend architecture and development ergonomics for Tauri 2 apps, especially Rust restart pain, oversized src-tauri/src/lib.rs files, excessive #[tauri::command] surfaces, stringly invoke APIs, long IPC streams, and dev-state recovery. Use when the user asks about Tauri hot reload, Rust-side restarts…

lovstudio/skills · 125 tokens

lov-publish-wechat-channels

A browser-based assistant for checking, uploading, saving, scheduling, and publishing local videos to WeChat Channels, WeChat’s short-video platform. It also verifies the resulting draft or publication status.

lovstudio/skills · 91 tokens

lov-cli-creator

A tool-building workflow that turns a local project into an installable command-line program. The program exposes the project's real backend, returns predictable JSON, documents how it works, and includes runnable tests.

lovstudio/skills · 58 tokens

lov-fill-web-form

Fill web forms by fetching form fields from a URL, deep-searching the user's local knowledge base for relevant info, and generating a markdown document with all answers pre-filled. Use when the user provides a URL to a web form (conference application, speaker submission, event registration, profile form) and wants…

lovstudio/skills · 146 tokens

lov-api-creator

A development workflow for adding an app's API gateway support to a uni-api FastAPI backend and its uni-app frontend. It creates grouped gateway endpoints and a shared frontend calling layer.

lovstudio/skills · 75 tokens

lov-integrate-lovstudio-llm-skill

An integration with LovStudio.AI’s OpenAI-compatible API for text chat, speech-to-text, speech translation, speech generation, and live audio sessions. It returns structured results that other application code can use.

lovstudio/skills · 78 tokens