Skip to content

Commit fb6b64c

Browse files
NickIlievNickIliev
committed
add articles about Fiddler skills + improved MCP section
1 parent 30630f0 commit fb6b64c

File tree

5 files changed

+459
-26
lines changed

5 files changed

+459
-26
lines changed

‎agent-tools/agent-skills.md‎

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
---
2+
title: Agent Skills
3+
page_title: Fiddler Everywhere Agent Skills – Automate MCP Setup and Traffic Analysis in AI Coding Tools
4+
description: "Install and use the official Fiddler Everywhere agent skills to automate MCP server configuration, HTTPS traffic analysis, and Fiddler installation in AI-powered IDEs such as GitHub Copilot, Claude Code, Cursor, Windsurf, and OpenAI Codex CLI."
5+
slug: fiddler-agent-skills
6+
publish: true
7+
position: 15
8+
---
9+
10+
# Agent Skills
11+
12+
Agent skills are instruction files that extend your coding assistant with the ability to interact with Fiddler Everywhere through its [MCP server](slug://fiddler-mcp-server). Once loaded, your coding tool can capture, inspect, and analyze live HTTPS traffic without you having to leave your editor.
13+
14+
The official Fiddler Everywhere skills are hosted in the [fiddler-agent-tools](https://github.com/telerik/fiddler-agent-tools) GitHub repository and cover three common workflows out of the box:
15+
16+
| Skill | Purpose |
17+
|:------|:--------|
18+
| `fiddler-download-setup` | Download, install, and launch Fiddler Everywhere from scratch. |
19+
| `fiddler-mcp-setup` | Connect your coding assistant to the Fiddler MCP server. |
20+
| `fiddler-feature-verification` | Verify that a feature's HTTP calls completed correctly by analyzing captured traffic. |
21+
22+
>tip You can also [create your own custom skills](slug://fiddler-creating-custom-skills) to tailor Fiddler-powered workflows to your specific needs.
23+
24+
## Prerequisites
25+
26+
- Fiddler Everywhere **Pro** or higher subscription.
27+
- A supported coding tool (see [Supported Tools](#supported-tools)).
28+
- **Node.js** installed — required when using Claude Desktop (the `npx mcp-remote` bridge).
29+
- Git or a browser — to clone or download the repository.
30+
31+
## Installation
32+
33+
Clone or download the [fiddler-agent-tools](https://github.com/telerik/fiddler-agent-tools) repository to your local machine:
34+
35+
```bash
36+
git clone https://github.com/telerik/fiddler-agent-tools.git
37+
```
38+
39+
Each skill lives as a `SKILL.md` file inside its own folder under `skills/`:
40+
41+
```
42+
fiddler-agent-tools/
43+
skills/
44+
fiddler-download-setup/SKILL.md
45+
fiddler-mcp-setup/SKILL.md
46+
fiddler-feature-verification/SKILL.md
47+
```
48+
49+
After cloning, point your coding tool at the skill files using the configuration steps for your tool below.
50+
51+
## Supported Tools
52+
53+
### GitHub Copilot in VS Code
54+
55+
Skills are loaded as [custom instructions](https://docs.github.com/en/copilot/customizing-copilot/adding-custom-instructions-for-github-copilot). Add the skill files to your workspace's `.github/` folder or reference them via your user-level instructions file.
56+
57+
1. Copy or symlink the `SKILL.md` files you want into `.github/copilot-instructions.md` or include them using the `files` directive in your Copilot configuration.
58+
2. Open the Copilot Chat panel, switch to **Agent** mode, and activate the `@workspace` agent.
59+
3. Invoke a skill by describing the task in natural language (see [Invoking Skills](#invoking-skills)).
60+
61+
### GitHub Copilot CLI
62+
63+
Add the skill files to your Copilot CLI configuration directory (`~/.copilot/`):
64+
65+
1. Create or edit `~/.copilot/mcp-config.json` and add the Fiddler MCP server entry (the `fiddler-mcp-setup` skill generates this file for you automatically).
66+
2. Reference skill content by passing it as context when running `gh copilot suggest` or `gh copilot explain`.
67+
68+
### Claude Code
69+
70+
Claude Code loads skills automatically when a `SKILL.md` is placed in a `.claude/skills/` folder inside your project directory, or when you register the skill path in the project's Claude config.
71+
72+
1. Create a `.claude/skills/` directory in your project and copy the skill folders there:
73+
```bash
74+
mkdir -p .claude/skills
75+
cp -r /path/to/fiddler-agent-tools/skills/* .claude/skills/
76+
```
77+
2. Start (or restart) Claude Code from your project directory. The skills are loaded automatically.
78+
3. Add `.claude/skills/` to `.gitignore` if the skills folder should stay local.
79+
80+
### Claude Desktop
81+
82+
Claude Desktop uses a bridge (`npx mcp-remote`) to connect to the Fiddler HTTP MCP server. The `fiddler-mcp-setup` skill generates the correct configuration.
83+
84+
1. Ensure **Node.js** is installed (`node --version`).
85+
2. Run the `fiddler-mcp-setup` skill (see [Invoking Skills](#invoking-skills)) — it will write the configuration to the Claude Desktop config file automatically.
86+
3. Restart Claude Desktop to apply the changes.
87+
88+
### Cursor
89+
90+
Cursor supports agent skills placed in the `.cursor/` folder of your project.
91+
92+
1. Copy the skill folders into `.cursor/skills/`:
93+
```bash
94+
mkdir -p .cursor/skills
95+
cp -r /path/to/fiddler-agent-tools/skills/* .cursor/skills/
96+
```
97+
2. Restart Cursor or reload the project. The skills are available in Composer and the Chat panel.
98+
99+
### Windsurf
100+
101+
Place the skill files in your Windsurf workspace and reference them as custom context:
102+
103+
1. Copy the skill folders into a `.windsurf/skills/` directory in your project.
104+
2. In the Windsurf Cascade panel, use **Add context** to attach the relevant `SKILL.md` when you want to invoke a skill.
105+
106+
### OpenAI Codex CLI
107+
108+
Codex CLI loads skills from `~/.codex/` or from a project-local `.codex/` directory.
109+
110+
1. Copy the skill folders into `.codex/skills/`:
111+
```bash
112+
mkdir -p .codex/skills
113+
cp -r /path/to/fiddler-agent-tools/skills/* .codex/skills/
114+
```
115+
2. Codex picks up the skills automatically on the next invocation.
116+
117+
## Invoking Skills
118+
119+
Skills are triggered by describing your intent in natural language. Each skill includes a description that helps the agent recognize when it should be applied. The table below shows the typical trigger phrases for each skill.
120+
121+
| Skill | When the Agent Invokes It | Example Trigger Phrase |
122+
|:------|:--------------------------|:-----------------------|
123+
| `fiddler-download-setup` | Fiddler Everywhere is not installed | *"Download and install Fiddler Everywhere"* / *"Set up Fiddler from scratch"* |
124+
| `fiddler-mcp-setup` | MCP tools are unavailable, auth errors, first-time setup | *"Set up Fiddler MCP"* / *"Connect Fiddler to my IDE"* / *"I can't see Fiddler tools"* |
125+
| `fiddler-feature-verification` | After running a feature you want to verify via HTTP traffic | *"Verify the HTTP calls my feature made"* / *"Check what requests my app sent"* |
126+
127+
---
128+
129+
## Available Skills
130+
131+
### fiddler-download-setup
132+
133+
**Purpose**: Automates the complete first-time installation of Fiddler Everywhere on macOS, Linux, or Windows — from downloading the installer to launching the application.
134+
135+
**What it does**:
136+
1. Checks whether Fiddler Everywhere is already installed.
137+
2. Detects the operating system and resolves the latest version from the official manifest.
138+
3. Downloads the installer for your platform.
139+
4. Runs a silent installation (with a native macOS privilege prompt where required).
140+
5. Launches Fiddler Everywhere.
141+
142+
**When to use**: Use this skill when a developer does not have Fiddler Everywhere installed yet and wants to go from zero to a running Fiddler instance in one step.
143+
144+
**Typical invocation**: *"Download Fiddler Everywhere"*, *"Install Fiddler for me"*, *"Get started with Fiddler"*
145+
146+
---
147+
148+
### fiddler-mcp-setup
149+
150+
**Purpose**: Connects your coding assistant to the Fiddler Everywhere MCP server. It discovers the correct port, retrieves or generates an API key, writes the right config file for your tool, and gitignores it to keep the key out of source control.
151+
152+
**What it does**:
153+
1. Verifies Fiddler Everywhere is installed and running.
154+
2. Detects the current coding tool (VS Code, Claude Code, Cursor, etc.) from directory markers.
155+
3. Checks whether a Fiddler MCP config already exists.
156+
4. Discovers the MCP port (default `8868`) and confirms it is reachable.
157+
5. Calls the Fiddler key-management endpoint to retrieve or generate a unique API key.
158+
6. Probes the server with the key to confirm the connection is valid.
159+
7. Writes the correct config file for the detected tool with the right JSON (or TOML) schema.
160+
8. Appends the config file to `.gitignore` if the file is inside a project directory.
161+
9. Initiates the Fiddler login flow if the user is not yet authenticated.
162+
163+
**When to use**: Use this skill whenever the Fiddler MCP tools are not available in a session, on first-time setup, or when you encounter authentication errors connecting to Fiddler.
164+
165+
**Typical invocation**: *"Set up Fiddler MCP"*, *"I can't see Fiddler tools"*, *"Connect Fiddler to VS Code"*, *"tool not found error"*
166+
167+
---
168+
169+
### fiddler-feature-verification
170+
171+
**Purpose**: Analyzes the HTTPS traffic captured by Fiddler Everywhere after you run a feature or user flow, and produces a structured report grouped by endpoint — flagging failures, auth errors, retries, and slow calls.
172+
173+
**What it does**:
174+
1. Calls `get_status` to confirm Fiddler is reachable and capturing.
175+
2. Calls `get_sessions_count` to check that traffic was captured.
176+
3. Calls `get_sessions` to retrieve the captured session list.
177+
4. Optionally uses `apply_filters` to narrow a large or noisy capture to the relevant traffic.
178+
5. Groups sessions by endpoint (host + normalized path).
179+
6. Calls `get_session_details` for failures, slow calls, and representative successful requests.
180+
7. Produces a plain-language verification report with verdict, endpoint summary, timing, status-code distribution, and a flagged issues list.
181+
182+
**Output format**:
183+
```
184+
Feature Verification
185+
186+
Overall verdict: [Feature appears healthy / partially successful / likely failed / Inconclusive]
187+
188+
Traffic window: [description of the analyzed capture window]
189+
190+
Endpoint summary:
191+
- METHOD HOST /normalized/path
192+
Calls: N | Statuses: 200 x3, 401 x1 | Timing: avg Xms, max Yms
193+
What happened: [plain-language summary]
194+
195+
Possible issues:
196+
- ⚠️ [Endpoint] [Issue name] — [explanation]
197+
198+
Conclusion:
199+
- [Short answer on whether the feature appears to work correctly]
200+
```
201+
202+
**When to use**: Run this skill after executing a feature, clicking a UI flow, or running an integration test — whenever you want to confirm that the HTTP calls your application made look correct.
203+
204+
**Typical invocation**: *"Verify the HTTP calls my feature made"*, *"Check what requests my app sent"*, *"Did my login flow work correctly?"*, *"Are there any errors in the captured traffic?"*
205+
206+
## See Also
207+
208+
* [Fiddler Everywhere MCP Server](slug://fiddler-mcp-server)
209+
* [Prompt Library](slug://fiddler_ai_prompt_library)
210+
* [Creating Custom Skills](slug://fiddler-creating-custom-skills)

‎agent-tools/creating-custom-skills.md‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
---
2+
title: Creating Custom Skills
3+
page_title: Creating Custom Fiddler Agent Skills – Build AI-Powered HTTP Analysis Workflows
4+
description: "Learn how to build custom Fiddler Everywhere agent skills that combine MCP tools with your own analysis logic. Extend AI coding assistants like GitHub Copilot, Claude, and Cursor with tailored LLM-driven HTTPS traffic workflows and share them with your team."
5+
slug: fiddler-creating-custom-skills
6+
publish: true
7+
position: 20
8+
---
9+
10+
# Creating Custom Skills
11+
12+
The [official Fiddler agent skills](slug://fiddler-agent-skills) cover the most common workflows, but you can write your own skills to automate any Fiddler-powered analysis or debugging task that is specific to your application or team.
13+
14+
A **skill** is a plain Markdown file (`SKILL.md`) that instructs a coding assistant on how to perform a specific task. The file describes what the skill does (for automatic invocation), lists the operating rules the agent must follow, and documents the step-by-step procedure including which Fiddler MCP tools to call and what output to produce.
15+
16+
## Skill File Structure
17+
18+
A well-formed `SKILL.md` has three parts: **YAML frontmatter**, **operating rules**, and **procedure steps**.
19+
20+
```markdown
21+
---
22+
name: my-skill-name
23+
description: >
24+
Short description of when and why this skill should be invoked.
25+
Write it so that the agent's skill-matching logic can recognize
26+
the right moment to load this skill automatically.
27+
---
28+
29+
# Skill Title
30+
31+
One-sentence summary of what this skill accomplishes.
32+
33+
## Operating rules
34+
35+
- Rule 1 — a constraint that must always hold (e.g. "Use MCP tools only; do not grep local files for traffic data.")
36+
- Rule 2 — another invariant
37+
38+
## Steps
39+
40+
1. First step.
41+
2. Second step.
42+
...
43+
44+
## Output format
45+
46+
Describe the exact shape of the final output the agent should produce.
47+
```
48+
49+
### Frontmatter fields
50+
51+
| Field | Required | Description |
52+
|:------|:---------|:------------|
53+
| `name` | Yes | Unique identifier for the skill (kebab-case). Used for logging and disambiguation. |
54+
| `description` | Yes | Plain-language description of the skill's purpose and the situations in which it should be activated. This text is used by the agent to decide whether to load the skill. The more specific it is, the more reliably the skill is invoked. |
55+
56+
## Using Fiddler MCP Tools in a Skill
57+
58+
Skills interact with Fiddler Everywhere through its MCP tools. When writing a skill, instruct the agent to call these tools by name instead of using shell commands, file reads, or other workarounds.
59+
60+
The most useful tools for custom skills are:
61+
62+
| Tool | What it returns | Typical use |
63+
|:-----|:----------------|:-----------|
64+
| `get_status` | Login state, capturing status, session count | Health check at the start of a skill |
65+
| `get_sessions` | List of captured sessions with metadata | Identify which sessions belong to the feature under analysis |
66+
| `get_sessions_count` | Total session count | Quick sanity check before heavier calls |
67+
| `get_session_details(id)` | Full request/response headers and body | Inspect specific sessions in depth |
68+
| `apply_filters` | (modifies the active session view) | Narrow a large capture to relevant traffic before calling `get_sessions` |
69+
| `create_rule` | (creates a traffic manipulation rule) | Automate response modification, header injection, redirect, etc. |
70+
| `clear_sessions` | (clears all captured sessions) | Reset state at the start of a clean test run |
71+
| `start_capture_with_browser` | (launches a browser with proxy pre-set) | Automate a browser-based capture |
72+
| `start_capture_with_terminal` | (opens a proxied terminal) | Automate a CLI-based capture |
73+
74+
Refer to the [Fiddler MCP Server](slug://fiddler-mcp-server#available-mcp-tools) article for the complete tool reference.
75+
76+
### Tips for writing reliable skill steps
77+
78+
- **Start with `get_status`** — always confirm Fiddler is reachable and the user is logged in before proceeding.
79+
- **Use `apply_filters` before `get_sessions`** when the capture may be noisy — this reduces the data the agent must reason about.
80+
- **Limit `get_session_details` calls** — call it only for sessions that genuinely need deep inspection (failures, slow calls, key representative requests). Avoid calling it for every session.
81+
- **Be explicit about output format** — define the exact shape of the report the agent should produce. This makes the skill's output consistent and easy to consume.
82+
- **Keep operating rules short and unambiguous** — every rule should be a hard constraint, not advice.
83+
84+
## Walkthrough: A Custom Security Header Check Skill
85+
86+
The following example builds a skill that checks all captured sessions for missing or misconfigured security response headers, then produces a prioritized findings list.
87+
88+
### 1. Create the skill folder and file
89+
90+
```bash
91+
mkdir -p .claude/skills/fiddler-security-header-check
92+
touch .claude/skills/fiddler-security-header-check/SKILL.md
93+
```
94+
95+
### 2. Write the SKILL.md
96+
97+
```markdown
98+
---
99+
name: fiddler-security-header-check
100+
description: >
101+
Analyze captured HTTPS sessions for missing or misconfigured security
102+
response headers (Content-Security-Policy, Strict-Transport-Security,
103+
X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
104+
Use this skill when a developer asks to check security headers, audit
105+
response headers, or verify that hardening headers are present.
106+
---
107+
108+
# Security Header Check
109+
110+
Inspect captured HTTPS traffic and report missing or misconfigured
111+
security response headers across all relevant endpoints.
112+
113+
## Operating rules
114+
115+
- Use Fiddler MCP tools for all traffic inspection. Do not read local files.
116+
- Call get_session_details only for sessions with status 2xx or 3xx responses
117+
and only up to 20 sessions. Prioritize unique hosts.
118+
- Do not report OPTIONS preflight sessions — skip them.
119+
120+
## Steps
121+
122+
1. Call get_status. Confirm Fiddler is reachable and the user is logged in.
123+
If session count is 0, stop and ask the user to capture traffic first.
124+
2. Call get_sessions to retrieve the session list.
125+
3. Filter to unique (host, path) pairs — ignore query strings and fragment identifiers.
126+
Deduplicate by host to keep the analysis manageable.
127+
4. For each unique host (up to 10), call get_session_details for the
128+
most recent successful (2xx/3xx) session.
129+
5. For each response, check for the presence and correctness of:
130+
- Content-Security-Policy
131+
- Strict-Transport-Security (HSTS)
132+
- X-Frame-Options
133+
- X-Content-Type-Options
134+
- Referrer-Policy
135+
6. Produce the output report described below.
136+
137+
## Output format
138+
139+
Security Header Report
140+
141+
Hosts analyzed: N
142+
143+
| Header | Status | Details |
144+
|:-------|:-------|:--------|
145+
| Content-Security-Policy | ✅ Present / ❌ Missing / ⚠️ Misconfigured | [value or reason] |
146+
| Strict-Transport-Security | ... | ... |
147+
| X-Frame-Options | ... | ... |
148+
| X-Content-Type-Options | ... | ... |
149+
| Referrer-Policy | ... | ... |
150+
151+
Findings:
152+
- ❌ [HOST] Missing Content-Security-Policy — all responses lacked this header.
153+
- ⚠️ [HOST] Weak HSTS max-age — max-age=300 is below the recommended 31536000.
154+
155+
Recommendation:
156+
[Short actionable summary of the most important fixes]
157+
```
158+
159+
### 3. Load and invoke the skill
160+
161+
Place the `SKILL.md` in `.claude/skills/fiddler-security-header-check/` and restart your
162+
coding tool. Then simply ask:
163+
164+
> *"Check the security headers in my captured traffic"*
165+
166+
The agent will recognize the request, load the skill, and run the steps above against your current Fiddler capture.
167+
168+
## Sharing and Contributing Skills
169+
170+
If you build a skill that could benefit other developers:
171+
172+
1. Fork the [fiddler-agent-tools](https://github.com/telerik/fiddler-agent-tools) repository.
173+
2. Add your skill folder under `skills/your-skill-name/SKILL.md`.
174+
3. Update the `README.md` skills table.
175+
4. Open a pull request with a clear description of what the skill does and when it is invoked.
176+
177+
## See Also
178+
179+
* [Agent Skills](slug://fiddler-agent-skills)
180+
* [Fiddler Everywhere MCP Server](slug://fiddler-mcp-server)
181+
* [Prompt Library](slug://fiddler_ai_prompt_library)

0 commit comments

Comments
 (0)