AI agents
New in 1.1
Control what agents see
On this page
ReqRes redacts credential-shaped values before captured traffic reaches an agent. Redaction is on for every host until you name a host to send unmasked.
What is redacted
Redaction applies to everything a read tool returns: captured requests, bodies, trailers, WebSocket messages, stream events, RPC messages, held requests, rules, saved sessions and replay responses. It also applies to the rule a change tool returns, to the reply to answer_paused_request, to HAR files from export_sessions and to activity-log exports.
| Where | What ReqRes does |
|---|---|
| Headers | Replaces the value of a header with a sensitive name with «redacted». Each repeated Set-Cookie is redacted on its own, so 2 cookies stay 2 placeholders. |
| Trailers | Redacts them like headers. |
| Header names | Replaces JWTs and known vendor keys in the name. |
| URL query | Replaces the value of a parameter with a sensitive name with REDACTED, so the URL stays valid. |
| URL user and password | Removes them from the URL. |
| Rule paths | Replaces the value of a query parameter with a sensitive name with REDACTED, unless the value is a pattern that matches no letter or digit literally: * in any rule, or \w+ or [^&]* in a regex rule. A value that holds text is masked whole, and in a wildcard rule \w+ is text. JWTs and known vendor keys anywhere in the path are replaced too. |
| JSON and form bodies | Replaces the value of any sensitive key with «redacted», at any depth. |
| JSON inside a string | Parses and redacts JSON held in a string value, such as a tool call's arguments, up to 4 levels deep. |
| JSON behind an anti-XSSI prefix, or JSONP | Redacts the JSON inside and keeps the wrapper as it was. |
| JSON that does not parse | Matches sensitive names without parsing, for example in a body cut short. A sensitive name whose value is an object or array hides everything after it. |
| XML and HTML bodies | Replaces the text of an element, or the value of an attribute, with a sensitive name. |
| Any header value, URL or body text | Replaces JWTs and known vendor keys wherever they appear. |
| Bodies that are not JSON or form data | Also replaces long random-looking strings. |
| Row fields | Replaces JWTs and known vendor keys in the host, method, content type, app name, failure reason and HTTP version. |
An agent reads JSON bodies re-formatted, with the keys sorted. get_session also leaves out the cURL command for a redacted host, because it holds the raw headers.
A rule's path keeps its real values, and the rule matches on them. mock_from_session copies the captured query into the path, token and all, and an agent reads it masked. A path sent back to update_rule exactly as list_rules shows it keeps the stored one. create_rule, update_rule, mock_from_session and test_pattern refuse any other path that holds REDACTED after a sensitive name, or «redacted». To keep a rule's path, leave path out.
Streams, WebSocket messages and RPCs
- Streams. With
viewset toevents, ReqRes redacts each SSE or NDJSON event on its own, and withholds an unfinished event at the end. Withviewset toassembled, it redacts the text after putting it back together. An event whose delta helped spell a redacted value is marked "delta withheld". - WebSocket messages. Each payload is redacted like a body. The
containsfilter oflist_messagesandwait_for_messagematches the redacted text, so searching for a secret finds nothing. A payload cut at 64 KB loses its last word before redaction. A binary payload is not shown while its host is redacted. - gRPC calls. Redaction in the
rpcview goes by shape only for protobuf strings. Without the.protofile there are no field names, so ReqRes masks JWTs, vendor keys and long random-looking strings, but not a short secret. Bytes fields and messages ReqRes could not decode are withheld while the host is redacted. JSON messages are redacted by key name.
How ReqRes finds secrets
ReqRes checks names first. It lowercases a header, parameter or key name and removes - and _ before it compares. So X-Refresh-Token-V2 matches token.
| Check | Values |
|---|---|
| Name contains | authorization, token, secret, password, passwd, apikey, credential, cookie, privatekey, accesskey, sessionid, signature |
| Name is exactly | auth, key, pwd, sig, session, sid, otp, pin |
| Name is left alone | idempotencykey, keyboard, publickey, tokentype, keepalive, accesscontrolallowcredentials |
| Value starts with | sk_live_, sk_test_, rk_live_, ghp_, gho_, ghu_, ghs_, github_pat_, glpat-, shpat_, xoxb-, xoxa-, xoxp-, AKIA, ASIA, AIza, ya29. |
| Value looks like | A JWT: eyJ followed by dot-separated parts |
| Bodies that are not JSON or form data | A run of 24 or more letters, digits, - or _ that mixes upper and lower case, or letters and digits |
JSON and form bodies are parsed, not searched as text. Nesting, numbers and escaped quotes do not hide a value under a sensitive key. Access-Control-Allow-Credentials stays readable, because it holds only true.
Send a host unmasked
Send a host unmasked only when you know its traffic holds nothing real, such as a staging API.
- Open Settings ▸ MCP.
- In Redaction, type the host in the Send unmasked field.
- Click Add, or press Return.
- An exact host such as
api.example.comcovers that host only. A port is ignored. *.example.comcovers the subdomains ofexample.com, notexample.comitself.- ReqRes refuses any other wildcard form, and any text no host can match, with a note under the field, for example: "ReqRes cannot match “api.example.com, www.example.com”. Use a host like api.example.com, or *.example.com for its subdomains."
- A host already in the list is refused too: "“api.example.com” is already excepted."
- The note goes away once you change the text, or remove the host it names.
- The change applies to the agent's next call.
- To redact a host again, click Remove next to it.
No switch turns redaction off for all hosts. To stop agents reading traffic at all, turn the MCP server off. See Turn the MCP server off.
Where real values remain
Redaction changes what agents read. The real values still exist in these places:
- The ReqRes window. The traffic list, the inspector, the Paused Requests panel and the approval panel show real values.
- Saved sessions. ReqRes stores them unmasked on your Mac. Agents still read them redacted. See Save a session.
- Replayed requests.
replay_requestsends the captured credentials to the original server. The agent reads only the redacted response. - Unmasked hosts. Agents read their real values, in held requests and rule paths too, and HAR files from
export_sessionskeep them.query_session_bodystill redacts their bodies. - Rules. A rule keeps its path, headers and body as written.
mock_from_sessioncopies the captured response, and the captured query into the path, credentials included. Agents read rules redacted. - The activity log. It keeps a copy of each rule an agent changed or deleted, with real values, so Undo can restore it. An export of the log redacts it.
The activity log shows each change with credential-shaped values redacted, for unmasked hosts too. That covers a token in a URL query or a rule's path, and the URL in the result of an answer to a held request.
For what leaves your Mac, including through an agent, see Data and privacy.