HTTP Trust Boundary Analyzer — replay requests, mutate headers safely, and quantify response influence (authorized testing only).
mrma helps answer: “Does this target trust proxy/host headers or behave differently based on request metadata?”
It focuses on meaningful diffs (not just status/length), plus profiles that model common trust-boundary behaviors.
Start use now: Github.
Note:If your system CA store is broken or you’re testing lab/self-signed certs, use --insecure.
mrma run --url https://example.com --follow-redirectsMost tooling stops at: status code, length, or manual diffing.
mrma adds:
default, dynamic, nextjs, api-json)--ignore-header, --ignore-body-regexrun --repeat (great for dynamic targets)profile proxy-trust (forwarded/proxy headers)profile host-routing (host-related routing headers)mrma report → mrma_report.json + mrma_report.md
Operational polish:--rps, --retries)List packs:
Proxy trust pack (extended):
Replay a raw HTTP request file:
Discover minimal request from a raw request:
Ignore volatile headers:
Ignore noisy dynamic content using regex:
Generate a compact report:
Terminal-friendly Markdown viewing (optional):
Most commands support --json:
Global config:
~/.config/mrma/config.tomlLocal (per-project):
./mrma.tomlShow merged config:
Example:
Tip: disable config for a single run: