Prompts & examples

Ready-to-use prompts for reverse-engineering APIs, controlling devices, and exporting traffic.

Once your client is connected, you drive Busymate in plain language. Here are prompts that map cleanly onto the tools, plus a couple of raw JSON-RPC examples for when you want to script it.

Reverse-engineer an API flow

The killer use case: point an agent at traffic you already captured and have it explain how a real app talks to its backend.

"Look at the captured traffic for identity.doordash.com and tell me exactly how the app authenticates — which endpoint, what headers it needs, and the request body shape. Then write me a curl command that reproduces the login call."

The agent calls inspect_requests with the full hostname, reads back the real request + response headers and bodies, and reconstructs the flow. (Pass a full hostname containing a dot — a bare brand word like "doordash" is rejected so the lookup stays a fast index scan.)

"Across all my devices, which hosts am I seeing 401 responses from in the last hour?"

That's search_entries filtered by status and date.

Control a device

"Turn on the VPN on my iPad, then route its traffic through a proxy in Germany so it looks like it's browsing from there. Show me which proxy you picked."

The agent runs vpn_on_device, then list_proxies filtered by country, then set_device_external_proxy (confirm-gated — it'll confirm before flipping egress).

"Set the lock-screen Live Activity message on my iPhone to 'Capturing — staging build'."

That's set_live_activity_message.

Drive a remote browser

"Open https://example.com/login in the bmc Chrome, take a screenshot, then read the page and tell me what fields the login form has."

browser_open → browser_screenshot → browser_snapshot. (The device's remote-control opt-in must be ON; flip it with set_device_cdp_control first.)

Export HAR

"Give me a HAR export of every request to api.stripe.com captured today."

export_har scoped by host and date — you get a standard HAR 1.2 log you can drop into any HAR viewer.

Manage service groups & tags

"Create a service group called 'Payments' that matches *.stripe.com and *.braintreegateway.com, then tag every entry in it as billing."

upsert_service_group to define the group, then tag_entry (or a search_entries + tag loop) for the labelling.

Manage paused domains

"Pause capture for analytics.example.com and telemetry.example.com globally, and show me the current paused list."

set_paused_domains — call it with no domains to read the list, or with an array to replace it.

Raw JSON-RPC

Every tool call is a JSON-RPC 2.0 tools/call. Discover what's available first:

http
POST https://mcp.busymate.net
Authorization: Bearer <ACCESS_TOKEN>
Content-Type: application/json
json
{ "jsonrpc": "2.0", "id": 1, "method": "tools/list" }

The response lists all 188 tools with their JSON schemas:

json
{
  "jsonrpc": "2.0",
  "id": 1,
  "result": {
    "tools": [
      { "name": "list_devices", "description": "List every paired device.", "inputSchema": { "type": "object", "properties": {} } },
      { "name": "inspect_requests", "description": "Deep-inspect FULL captured request/response detail for ONE host …", "inputSchema": { "type": "object" } }
    ]
  }
}

Inspect requests for a host

json
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "inspect_requests",
    "arguments": {
      "host": "identity.doordash.com",
      "method": "POST",
      "limit": 5
    }
  }
}

A confirm-gated call

Destructive tools reject a call that omits confirm. To actually flip a device's upstream proxy:

json
{
  "jsonrpc": "2.0",
  "id": 3,
  "method": "tools/call",
  "params": {
    "name": "set_device_external_proxy",
    "arguments": {
      "device": "My iPad",
      "country": "DE",
      "confirm": true
    }
  }
}

Without "confirm": true, the server returns an error explaining that the action needs explicit confirmation — the guardrail that keeps an agent from doing something destructive by accident.

Next

Tool referenceOverview