Fiddler MCP Server

Created a GenAI assisted workflow that helps analysts examine HTTP traffic captured in Fiddler. Analysts can ask questions in natural language about redirects, scripts, downloads, headers and suspicious behaviour instead of reviewing each web session manually.

Implemented an MCP bridge as the interface between Fiddler and LLM clients, with support for Gemini, DeepSeek and OpenRouter. Developed 10 analysis tools which let the model search sessions, inspect headers and bodies, compare traffic, build timelines and review EKFiddle findings.

Built an agentic analysis workflow which triggers tools on demand to deliver comprehensive malicious website analysis in a report. The analyst can see the raw evidence behind each answer and remains responsible for the final decision.

Quick Start

Windows analysis VM with Fiddler Classic and Python 3.10 or later.

1. Download these two files from the repo root into the same folder:
   • Fiddler-MCP-Setup.bat
   • Fiddler-MCP-Bundle.zip
2. Double-click Fiddler-MCP-Setup.bat
3. Setup extracts to %USERPROFILE%\Fiddler_MCP, installs dependencies, deploys CustomRules.js, and starts the bridge plus client
4. API keys are not required during setup. Enter them in the client window when prompted
5. In Fiddler: Rules > Reload Script (Ctrl+R)

Day-to-day restart from the install folder:

start-fiddler-mcp.bat

5ire-bridge.py runs inside the client as the MCP child. There is no third console window.

Guides: QUICK_START_GUIDE.txt, Fiddler_MCP_Guide.pdf

Architecture

Fiddler Classic          enhanced-bridge.py        5ire-bridge.py         gemini-fiddler-client.py
     |                         |                        |                      |
     |   POST /live-session    |                        |                      |
     |------------------------>|  REST API (8081)       |                      |
     |   (JSON session data)   |----------------------->|   MCP tools/list     |
     |                         |  /api/sessions/...     |   tools/call         |
     |                         |                        |--------------------->|
     |                         |                        |   stdin/stdout MCP   |
     |                         |                        |                      |
     |                         |                        |   Native tool loop
     |                         |                        |---------------------> LLM API

1. Fiddler captures traffic and POSTs JSON via CustomRules.js
2. enhanced-bridge.py buffers sessions and exposes REST on port 8081
3. 5ire-bridge.py exposes MCP tools that call that REST API
4. gemini-fiddler-client.py binds those tools on the active LLM provider, runs the chat loop, and executes every tool through call_tool

The model never talks to Fiddler or Python directly. The client is the middleman.

MCP Tools