# Arcane Scout — API Pentesting > A professional Chrome DevTools extension for API traffic inspection and web pentesting. Canonical page: [https://chrome-stats.com/d/arcane-scout](https://chrome-stats.com/d/arcane-scout) ## Overview - **ID:** `arcane-scout` - **Platform:** Firefox - **Type:** Firefox add-on - **Status:** Available - **Publisher:** mateocallec - **Category:** web-development,privacy-security,search-tools - **Daily users:** 7 - **Weekly downloads:** 3 - **Rating:** 5.00 / 5 (1 ratings) - **Version:** 1.1.0 - **Last updated:** 2026-06-04 - **First published:** 2026-06-01 - **Size:** 85 KB - **Data as of:** 2026-09-14 - **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/arcane-scout/) - **Website:** [https://github.com/mateocallec/arcane-scout](https://github.com/mateocallec/arcane-scout) ## Description Arcane Scout is a Chrome and Firefox DevTools extension for API traffic inspection and web application security testing. Built for penetration testers, bug bounty hunters, and security-conscious developers who need more than the Network tab. ── API INSPECTOR ────────────────────────────────────── Capture every XHR and Fetch request in real time as you browse. Each request is logged with its method, endpoint, status code, and timestamp. Click any row to open a full detail drawer with five tabs: • Overview — URL, status, timing, and a one-click cURL export • Headers — all request and response headers, neatly grouped • Payload — request body with JSON pretty-printing and form data decoding • Response — response body with an HTML preview (sandboxed iframe), inline image, video, and audio viewers • Replay — edit and resend any captured request directly from the panel Beyond the request table, three additional explorer views give you deeper insight: • Routes — a collapsible tree of all captured path segments, filterable with a single click • Header Auditor — flags missing or misconfigured security headers (CSP, HSTS, X-Frame-Options, and more) with severity ratings • Cookies — lists every cookie on the current domain with enable/disable checkboxes; state persists across reloads but clears when the tab is closed Export your full session as JSON or HAR for use in other tools. ── PENTEST TOOLS ────────────────────────────────────── A dedicated panel with nine built-in tools: • Encoder / Decoder — encode and decode strings across Base64, URL, HTML, hex, and more • JWT — inspect and decode JSON Web Tokens; view header, payload, and signature fields • Payload Generator — generate fuzzing payloads for common injection categories (SQLi, XSS, path traversal, etc.) • Custom Request — build and send arbitrary HTTP requests with full control over method, URL, headers, and body; responses render inline with the same media viewers • JSON Tools — pretty-print, minify, and diff JSON payloads • XOR — XOR two values with a configurable key; useful for analysing obfuscated data • HTTP Downgrade — test whether a target enforces HTTPS or silently accepts plain HTTP connections • HTTP Inspector — view raw response headers and body without any browser normalisation • Vulnerability Disclosure — automatically fetches /.well-known/security.txt from the current domain (with fallback to www and the bare domain), parses all RFC 9116 fields, renders clickable contact and policy links, and shows an expiry validity badge ── PERMISSIONS ──────────────────────────────────────── Arcane Scout requests only the permissions it needs: • storage — persists captured requests and cookie state across page reloads within the same session • cookies — reads and toggles cookies for the inspected tab • contextMenus — adds a right-click menu entry to open the Help & Documentation page • host_permissions (<all_urls>) — required to capture network requests on any site you inspect and to fetch security.txt files cross-origin No data ever leaves your browser. All processing happens locally. ## Rankings - #39,005 — Overall - #111 — testing ## Permissions and access ### Permissions - `contextMenus` - `storage` - `cookies` ### Host permissions - `` ## Safety - **Risk impact:** Moderate risk impact - **Risk likelihood:** Moderate risk likelihood ### Analysis details - Allows access to all websites, posing a significant security risk as it can monitor and modify data from any visited site. - This extension has low user count. Unpopular extensions may not be stable or safe. > Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing). ## Similar extensions and apps - [API Debugger - Capture](https://chrome-stats.com/d/api-debugger-capture) — 1 users - [Website Inspector](https://chrome-stats.com/d/website-inspector) — 6 users - [Endpoint Hunter](https://chrome-stats.com/d/endpoint-hunter) — 13 users - [API Request Tester](https://chrome-stats.com/d/api-request-tester) — 172 users, 1.00 / 5 - [PacketProwler](https://chrome-stats.com/d/packetprowler) — 4 users - [Web Explode](https://chrome-stats.com/d/web-explode) — 21 users, 5.00 / 5 - [API Network Recorder](https://chrome-stats.com/d/api-network-recorder) — 20 users - [APIlot](https://chrome-stats.com/d/apilot) - [rep+](https://chrome-stats.com/d/rep) — 177 users, 5.00 / 5 - [Enhanced Network Tab](https://chrome-stats.com/d/enhanced-network-tab) — 45 users, 5.00 / 5 - [Request Inspector Lite](https://chrome-stats.com/d/request-inspector-lite) — 5 users - [Web Scraper - Export & Security Scanner](https://chrome-stats.com/d/web-scraper-export) — 157 users, 1.00 / 5 --- Source: [Chrome-Stats](https://chrome-stats.com/d/arcane-scout)