caido-mode

Full integration with Caido, a web security testing proxy, exposed to Claude Code as a command-line tool built on the official @caido/sdk-client package. It provides broad coverage of Caido's API: searching HTTP history with HTTPQL, retrieving and replaying requests, editing requests, managing scopes, filter presets, and environments, creating and updating security findings, monitoring tasks, switching projects, managing hosted files, controlling intercept, listing plugins, checking instance health, and exporting requests as curl commands. Because all traffic routes through Caido, actions also appear in its UI for further analysis.

The design centers on preserving authentication context. Since session cookies, JWTs, and CSRF tokens can be large, the recommended pattern is to find an organic request in HTTP history that already carries valid auth, use the edit command to change only what is needed (path, method, body, or headers), and send it so the response returns with full context intact. The edit command is highlighted as the key feature and supports IDOR testing, header add and remove, find-and-replace anywhere in the request, session reuse, and connection overrides such as SNI and connect-host or port.

Authentication uses a Personal Access Token created in the Caido dashboard. A one-time setup command validates the PAT through the SDK's device-code flow, exchanging it for access and refresh tokens that a custom cache persists to secrets.json so they survive across CLI invocations; auth resolves from the CAIDO_PAT environment variable, then the stored PAT, then a valid cached token. Other commands cover recent requests, full request and response retrieval, raw sending from string, file, or stdin, replay sessions and collections (with a recommendation to rename sessions for identification), and replay-tab lookup. All commands output JSON.