Skip to content
Get packs

Guide · Agent skill

How to use the Derive API Client agent skill (derive-client)

Updated · written with AI from the project's own documentation and checked against our catalogue data

The derive-client skill teaches an AI agent to reverse-engineer a website's internal API. The agent records the browser's network traffic once, studies the saved requests, and writes a standalone script or command-line tool that calls the site directly without opening a browser. This guide explains what the skill does, how to install it, how to trigger it, and what to watch for, so you can decide whether it fits a site you automate repeatedly.

Derive API Clientvercel-labs/agent-browser · Apache-2.0

Quick start

  1. 1Download and unzip. Download the ZIP from this page and unzip it so SKILL.md sits in a derive-client folder.
  2. 2Place the skill. Copy the folder into ~/.claude/skills/ or your project's .claude/skills/, or upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Install the prerequisites. Make sure the agent-browser CLI and jq are available, and that you have an account on the target site if it needs login.
  4. 4Ask for the client. Describe the outcome in plain language, for example asking the agent to derive a client for a specific site.
  5. 5Record the flows. Log in first if needed, start the HAR capture, run each flow twice with different inputs, then stop and save the file.
  6. 6Generate and verify. Let the agent identify endpoints, write the client, and call each function against the live site before accepting it.

What is an agent skill, and what does derive-client make the agent do?

An agent skill is a folder with a SKILL.md file that gives an AI agent step-by-step instructions for one kind of task. When the task comes up, the agent reads the instructions and follows them.

Normally an agent drives a web browser each time it needs something from a website, which is slow and fragile. derive-client changes that. It has the agent record the browser's network traffic while it uses the site, identify the real API endpoints among the noise, extract request shapes and response schemas, generate a client with one function per flow, and then call every endpoint against the live site to verify it.

  • Record: capture a HAR file while you drive the flows the client should support.
  • Identify: find first-party JSON API calls and ignore analytics and static assets.
  • Extract: pull request shapes, response bodies and authentication material.
  • Generate: write the client, reading cookies and tokens from a file or environment variable.
  • Verify: call each endpoint for real and compare the response with the recording.

Install the derive-client skill

Download the ZIP from this page and unzip it. The skill is a single file, SKILL.md, inside the derive-client folder. Place that folder in one of these locations:

  • Personal skills for Claude Code: ~/.claude/skills/
  • Project-specific skills: the .claude/skills/ folder inside your project
  • Claude apps: upload the skill under Settings → Capabilities → Skills

Check the requirements before you start

The skill depends on the agent-browser CLI from vercel-labs/agent-browser. The agent calls it through Bash or npx. It also uses jq to query the HAR file. If the target site requires login, you need an account on that site.

The skill declares that it runs scripts and uses the network.

  • agent-browser CLI (vercel-labs/agent-browser), invoked via Bash or npx
  • jq, for querying the HAR file
  • A site account and login, if the target site requires authentication

How to trigger the skill with natural requests

You do not need a special command. Ask for the outcome in plain language. The skill's description lists phrases that match it, such as "derive a client", "build a CLI for <site>", "reverse engineer this site's API", "record network requests" and "turn this site into an API".

It also fits when you plan to automate the same site repeatedly and direct HTTP calls would beat driving the browser every time.

  • Derive a client for the product search on example-site, then I can run it from the terminal.
  • Reverse engineer this site's API so I can pull the order list without a browser.
  • Build a CLI for this site that fetches a listing by ID.

Record a session the skill can study

Start a HAR capture, use the site, then stop the capture and save the file. Exercise every flow the client should support, and run each flow at least twice with different inputs. Comparing the recorded URLs shows which parts are parameters.

If the site needs login, log in before starting the recording. Text response bodies are embedded in the HAR by default. The recording is enough to study endpoints after the browser is closed.

  • --content all embeds binary bodies too (base64); --content none disables embedding.
  • The per-body cap is 2 MB.
  • Only the HAR survives navigation and browser close, so prefer it for multi-page flows.
agent-browser network har start # ... drive the site: search, open a detail page, paginate, etc. ... agent-browser network har stop /tmp/site.har

Find the endpoints and read the request shapes

The agent queries the HAR with jq to list JSON API calls with their method, URL and status. Analytics endpoints such as /collect, /track, /beacon and /log, third-party domains and static assets are noise. The real API is usually first-party, returns JSON and matches the actions you performed.

For one endpoint, the agent reads the request headers, POST body and response body. The response body is the real payload and is used to derive types. Cookies are exported separately with agent-browser cookies get --json, and the client loads them at runtime rather than hardcoding values.

  • Look for authorization, cookie, x-csrf-token, x-api-key and site-specific x-* headers.
  • Some sites return 403 without a matching user-agent, referer or x-requested-with header.
  • Pagination, sort and filter parameters become function options.
jq -r '.log.entries[] | select(.response.content.mimeType | test("json")) | "\(.request.method) \(.response.status) \(.request.url)"' /tmp/site.har

Test the client and fix common failures

The skill requires calling every generated function against the live API and comparing the response shape with the recording. Some failures have known causes.

  • 401 or 403: expired or missing session. Log in again with agent-browser and re-export cookies.
  • 403 or 419 on writes: the CSRF token is per session or per form. Fetch the token endpoint first, or keep that flow in the browser.
  • Works, then breaks: signed or expiring request parameters. Fall back to the browser for that step.
  • Different shape than the HAR: A/B tests or geo-dependent responses. Re-record and treat the union as optional fields.

What people use it for

  • Pulling structured search results from a site that has no public API, on a repeated schedule.
  • Building a small CLI that fetches listings or items by ID for a site you are allowed to access.
  • Replacing a slow browser-automation script with direct HTTP calls for the same flow.
  • Keeping the HAR file so the client can be re-derived when the site's internal API changes.

Frequently asked questions

What is the derive-client agent skill?

It is an agent skill that tells an AI agent to record a website's network traffic into a HAR file, find the internal API endpoints, and generate a standalone client or CLI that calls them directly. After the first recording, the client does not need a browser.

How do I install derive-client?

Download the ZIP from this page and unzip it. Place the derive-client folder in ~/.claude/skills/ or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.

What does derive-client require?

It requires the agent-browser CLI from vercel-labs/agent-browser, invoked through Bash or npx, and jq for querying the HAR file. If the target site requires authentication, you also need an account and login for that site.

Is derive-client free to use?

The skill is licensed under Apache-2.0. The source does not describe pricing for the agent-browser CLI or any other service, so check those projects for their own terms.

Does derive-client run scripts and use the network?

Yes. The skill runs scripts and uses the network. It also handles live session cookies and tokens from recordings, which the skill says must be treated as secrets and kept out of version control.

What should I use instead of derive-client?

If the site has a public, documented API, use that, since it is safer and more stable than reverse engineering. For sites with terms that prohibit automated access, or for sensitive accounts such as banking or email, do not use this skill.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use derive-client if you repeatedly automate the same site, want lighter scripts than browser automation, and are allowed to access the site. Pick a documented public API, or keep the task in a browser, when the site's terms prohibit automated access or when the account is sensitive.

Download the skill