← MCP Security Catalog

Requestly MCP Server 1.0.4

npm · @requestly/mcp · latest release

Verified with no proven findings
Security result
8
Observed tools
30
Version rating
100
Change risk

Independent inventory

Observed 2026-08-18T11:15:51.026Z using mcpSecurity-inventory. Protocol 2025-06-18.

ToolCategoryRisk
create_groupCreate a new group in Requestly.
Input schema
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the group to be created."
    },
    "status": {
      "type": "string",
      "enum": [
        "Active",
        "Inactive"
      ],
      "default": "Active"
    },
    "isFavourite": {
      "type": "boolean",
      "default": false
    }
  },
  "required": [
    "name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
create_ruleThis endpoint allows you to create various types of rules in Requestly, such as Redirect, Cancel, Replace, Headers, User-Agent, Script (Insert Script), Query Param, Modify Request, Modify Response, and Delay. Each rule has a specific structure and parameters based on the ruleType. New rules default to Inactive. Script/Request/Response rules (which can execute code in the browser/request pipeline) are ALWAYS created Inactive and must be reviewed by a human and explicitly activated before they take effect.
Input schema
{
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "Name of the rule."
    },
    "description": {
      "type": "string",
      "description": "Description of the rule."
    },
    "ruleType": {
      "type": "string",
      "enum": [
        "Redirect",
        "Cancel",
        "Replace",
        "Headers",
        "UserAgent",
        "Script",
        "QueryParam",
        "Request",
        "Response",
        "Delay"
      ],
      "description": "Type of the rule. This determines the structure of the pairs array."
    },
    "status": {
      "type": "string",
      "enum": [
        "Active",
        "Inactive"
      ],
      "default": "Inactive",
      "description": "Status of the rule. Defaults to Inactive; rules must be explicitly activated after a human reviews them. Script/Request/Response rules are always created Inactive."
    },
    "groupId": {
      "type": "string",
      "description": "ID of the group the rule belongs to."
    },
    "pairs": {
      "type": "array",
      "items": {},
      "description": "List of rule pair objects. Structure depends on ruleType:\n      \n      - Redirect: Array of redirect pairs. Each pair must have: source (matching criteria), destinationType (string), destination (target URL)\n      - Cancel: Array of cancel pairs. Each pair must have: source (matching criteria to cancel requests)\n      - Replace: Array of replace pairs. Each pair must have: source (matching criteria), from (string to replace), to (replacement string)\n      - Headers: Array of header pairs. Each pair must have: source (matching criteria), modifications (array of header modifications with header, type, and optional value)\n      - UserAgent: Array of user agent pairs. Each pair must have: source (matching criteria), userAgent (custom user agent string)\n      - Script: Array of script injection pairs. Each pair must have: source (matching criteria), scripts (array of script objects with codeType \"js\" or \"css\", value (script content or URL), loadTime \"beforePageLoad\" or \"afterPageLoad\", type \"url\" or \"code\")\n      - QueryParam: Array of query param pairs. Each pair must have: source (matching criteria), modifications (array of param modifications)\n      - Request: Array of request pairs. Each pair must have: type (\"code\" or \"static\"), value (request content)\n      - Response: Array of response pairs. Each pair must have: source (matching criteria), response (object with type, value, and optional serveWithoutRequest)\n      - Delay: Array of delay pairs. Each pair must have: source (matching criteria), delay (number in milliseconds)\n      \n      All source objects must have: key (\"Url\", \"Host\", or \"Path\"), operator (\"Equals\", \"Contains\", \"Matches\", or \"Wildcard_Matches\"), value (string to match against)"
    }
  },
  "required": [
    "name",
    "ruleType",
    "pairs"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "title": "Create Rule",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": false,
  "openWorldHint": true
}
delete_groupDelete a specific group in Requestly using its id. IRREVERSIBLE and CASCADES — deleting a group also deletes every rule it contains. Requires confirm: true. Never set confirm: true on the user's behalf — first show the user the exact group id and get their explicit approval.
Input schema
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Unique identifier of the group to delete."
    },
    "confirm": {
      "type": "boolean",
      "default": false,
      "description": "Must be explicitly set to true by the human operator to authorize this irreversible, cascading deletion."
    }
  },
  "required": [
    "id"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "title": "Delete Group",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": true,
  "openWorldHint": true
}
delete_ruleDelete a specific rule in Requestly using its ruleId. IRREVERSIBLE. Requires confirm: true. Never set confirm: true on the user's behalf — first show the user the exact ruleId and get their explicit approval.
Input schema
{
  "type": "object",
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Unique identifier for the rule to delete."
    },
    "confirm": {
      "type": "boolean",
      "default": false,
      "description": "Must be explicitly set to true by the human operator to authorize this irreversible deletion."
    }
  },
  "required": [
    "ruleId"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "title": "Delete Rule",
  "readOnlyHint": false,
  "destructiveHint": true,
  "idempotentHint": true,
  "openWorldHint": true
}
get_groupsGet all groups in Requestly.
Input schema
{
  "type": "object",
  "properties": {
    "offset": {
      "type": "number",
      "default": 0
    },
    "pageSize": {
      "type": "number",
      "default": 30
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
get_rulesRetrieve all rules or a specific rule from Requestly using its API. Supports pagination and lookup by ruleId.
Input schema
{
  "type": "object",
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Unique ID of the rule to retrieve. If omitted, retrieves all rules."
    },
    "offset": {
      "type": "integer",
      "minimum": 0,
      "description": "Index to start results from (for pagination)."
    },
    "pageSize": {
      "type": "integer",
      "minimum": 1,
      "maximum": 75,
      "description": "Number of results to return (max 75)."
    }
  },
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
update_groupUpdate a specific group in Requestly.
Input schema
{
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Unique identifier of the group to update."
    },
    "name": {
      "type": "string",
      "description": "New name of the group."
    },
    "status": {
      "type": "string",
      "enum": [
        "Active",
        "Inactive"
      ],
      "default": "Active"
    },
    "isFavourite": {
      "type": "boolean",
      "default": false
    }
  },
  "required": [
    "id",
    "name"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
update_ruleUpdate an existing rule in Requestly. Requires ruleId and the updated rule payload. Activating a Script/Request/Response rule (status: 'Active') runs code in the browser/request pipeline and requires confirmActivation: true — never set it on the user's behalf; a human must review the rule's script/code first.
Input schema
{
  "type": "object",
  "properties": {
    "ruleId": {
      "type": "string",
      "description": "Unique identifier for the rule."
    },
    "name": {
      "type": "string",
      "description": "Name of the rule."
    },
    "description": {
      "type": "string",
      "description": "Description of the rule."
    },
    "ruleType": {
      "type": "string",
      "enum": [
        "Redirect",
        "Cancel",
        "Replace",
        "Headers",
        "UserAgent",
        "Script",
        "QueryParam",
        "Request",
        "Response",
        "Delay"
      ],
      "description": "Type of the rule. This determines the structure of the pairs array."
    },
    "status": {
      "type": "string",
      "enum": [
        "Active",
        "Inactive"
      ],
      "default": "Active",
      "description": "Status of the rule."
    },
    "objectType": {
      "type": "string",
      "const": "rule",
      "description": "Type of the object, always \"rule\".",
      "default": "rule"
    },
    "pairs": {
      "type": "array",
      "items": {},
      "description": "List of rule pair objects. Structure depends on ruleType:\n      \n      - Redirect: Array of redirect pairs. Each pair must have: source (matching criteria), destinationType (string), destination (target URL)\n      - Cancel: Array of cancel pairs. Each pair must have: source (matching criteria to cancel requests)\n      - Replace: Array of replace pairs. Each pair must have: source (matching criteria), from (string to replace), to (replacement string)\n      - Headers: Array of header pairs. Each pair must have: source (matching criteria), modifications (array of header modifications with header, type, and optional value)\n      - UserAgent: Array of user agent pairs. Each pair must have: source (matching criteria), userAgent (custom user agent string)\n      - Script: Array of script injection pairs. Each pair must have: source (matching criteria), scripts (array of script objects with codeType \"js\" or \"css\", value (script content or URL), loadTime \"beforePageLoad\" or \"afterPageLoad\", type \"url\" or \"code\")\n      - QueryParam: Array of query param pairs. Each pair must have: source (matching criteria), modifications (array of param modifications)\n      - Request: Array of request pairs. Each pair must have: type (\"code\" or \"static\"), value (request content)\n      - Response: Array of response pairs. Each pair must have: source (matching criteria), response (object with type, value, and optional serveWithoutRequest)\n      - Delay: Array of delay pairs. Each pair must have: source (matching criteria), delay (number in milliseconds)\n      \n      All source objects must have: key (\"Url\", \"Host\", or \"Path\"), operator (\"Equals\", \"Contains\", \"Matches\", or \"Wildcard_Matches\"), value (string to match against)"
    },
    "confirmActivation": {
      "type": "boolean",
      "default": false,
      "description": "Must be set to true by the human operator to activate a code-bearing (Script/Request/Response) rule after they have reviewed the injected code."
    }
  },
  "required": [
    "ruleType",
    "pairs"
  ],
  "additionalProperties": false,
  "$schema": "http://json-schema.org/draft-07/schema#"
}
Annotations
{
  "title": "Update Rule",
  "readOnlyHint": false,
  "destructiveHint": false,
  "idempotentHint": true,
  "openWorldHint": true
}

Resources 0

Resource templates 0

Prompts 0

Changes from previous version

Compared with initial baseline using full_baseline.

RiskChangeSubject
No material changes recorded.

Confirmed vulnerabilities

SeverityFindingAdvisory
No confirmed vulnerability is published for this version.

Provenance

Artifact SHA-256: c43ee0ffe69a985fdbac884202652fecf7df192b3d8e7a34035c01a47f55d890

Scanner: mcp-proof-engine 0.1.0.

Let’s talk about MCP security.

Share your details and our security team will contact you.