Hx0-HawkEye

What the extension does

Hx0 HawkEye is a native browser extension for Chrome, Firefox, and mainstream Chromium based browsers. It provides a full workflow from the sidebar: capture, intercept, modify, replay, rule based detection, and AI assisted analysis of network traffic. The README describes it as a lightweight alternative to setting up a proxy, because it works directly with the page's own XHR, Fetch, and WebSocket traffic and keeps the same origin login state as the current tab. That removes the common proxy problems of dropped cookies and frequent sign out. The capture covers WebSocket traffic as well as normal requests, and the sidebar layout means the tool is available without leaving the page. The README lists core strengths as zero environment dependency, no need to open Burp Suite or change the system proxy, no root certificate to trust, and no Java environment to configure. It also stresses session consistency, since the traffic seen is exactly what the logged in page sends. The tool is aimed at daily development debugging, interface troubleshooting, and authorized security screening. The project is explicit that it is for use within authorized scope, and it ships both a community edition and a Pro edition with additional capabilities. The extension form factor is the main differentiator: instead of a separate interception proxy, the whole flow lives in a browser sidebar that sees real tab traffic.

AI assistance and Pro features

The README describes a full process AI capability built on bring your own key, meaning the user supplies their own model API. The AI is embedded in the sidebar workflow rather than offered as a separate chat. It can generate test cases and payloads, including dynamic mutation payloads in the micro fuzzing view that use request context instead of a fixed wordlist. It can give a semantic reading of a complex request or response to help judge risk. It can batch analyse selected packets and pull out patterns across an interface family or third party calls, which helps with supply chain and dependency surface screening. It also combines built in dark link detection rules with AI context reading to review multiple pages for static threats. The version 1.0.6 update opened several community edition abilities that were in 1.0.5 only partially, including an intelligent proxy splitter, full depth search, and built in or custom sensitive information matching with a keyword library. The Pro edition adds a HawkEye browser automation MCP that lets agent hosts such as Codex, Cursor, and LM Studio drive the real browser and the extension tools over stdio, Streamable HTTP, or legacy SSE. It also adds a browser level agent that plans and executes multi step tasks in the user's real tab and login state. These Pro features require a trial or a Pro license to enable.

Performance and safety controls

The 1.0.6 release notes describe performance rework for Firefox and Chrome. The DOM snapshot was changed to a single linear traversal with bounded output, and off screen elements are filtered early. The Firefox webRequest listener is registered and unregistered dynamically by status, which avoids always on overhead. The agent and MCP transports were compacted, notifications batched, observers reused, and large results support continuation through a next cursor field so task evidence stays complete. These changes aim to keep the extension responsive while capturing and analysing traffic. On safety, the README says built in penetration and CTF knowledge was updated to version 1.0.6, and the agent does not enable skills by default in a new session. A user must first enable allowed skills or submodules in advanced settings, then click the Skills control in the current agent session, and the agent may only call within that allowed list and toward the stated goal. This dual explicit authorization is meant to keep the autonomous capabilities from acting outside the user's intent. The release is distributed as a ZIP only, per the badges, and the version is 1.0.6. The tool's scope is authorized security work, and the README repeats that the browser level agent is not an ordinary chat or one off report but an autonomous operator inside the user's real sessions, which is why the permission gating exists. The source and ZIP releases are on the asaotomo Hx0-HawkEye GitHub repository.

Editorial conclusion

The extension's source and release files live at the asaotomo Hx0-HawkEye repository, and the product page is at hx0.store/products/hawkeye.