WEBXRAY

Local browser observatory / zero telemetry

The web page
behind the web page.

Turn one load into a living causal map. Watch first-party code invite CDNs, tag managers wake analytics, cookies change, and trackers settle into orbit.

Run it locally ↓ Read the field guide
00
accounts
00
cloud uploads
04
causal lenses
LIVE SPECIMEN / DENSE LOAD Preserved locally
WebXRay mapping a dense page load into site-core, supply-chain, and recognition-frontier orbits
Scroll to inspect

01 — THE PROBLEM

A network table shows entries.
WebXRay shows the system.

A modern site is a supply chain. First-party scripts invite services, services invite other services, and recognition can continue long after the visible page has appeared.

WebXRay reconstructs that chain from a clean Chromium context and makes every signal inspectable, replayable, and exportable.

RequestsRedirectsCookiesWorkersWebSocketsSecurity headersRecognition

02 — THE INSTRUMENT

Four ways to interrogate
one preserved observation.

Organism lens grouping a dense observation into semantic orbits

01 / WHO IS HERE?

See the whole dependency ecology.

Site core, non-recognition supply chain, and recognition frontier settle into deterministic orbits. Hundreds of requests collapse into weighted relationships.

01

Organism

What belongs to the site, and what orbits outside it?

02

Cascade

When did each service wake up during the load?

03

Lineage

Who invited whom through redirects and sanitized initiators?

04

Recognition

Which relationships can recognize a visit across time or context?

03 — CAUSAL FOCUS

Touch one signal.
Reveal its route.

Select or hover a service and unrelated noise recedes. The complete causal neighborhood—inviter, service, descendants, storage, and recognition evidence—comes forward.

  • Plain-language service purpose
  • Transfer and runtime behavior
  • Cookie lifecycle transitions
  • Security boundaries and ancestry
A selected signal in WebXRay with unrelated nodes suppressed and its causal route highlighted
FIG. 02 One selected service, isolated with its complete route.

04 — PRIVACY BOUNDARY

What leaves your machine.

No telemetry. No account. No hosted backend. No cloud persistence.

WebXRay binds to 127.0.0.1 by default and launches an isolated browser context. Its evidence model deliberately excludes bodies, page contents, credentials, fragments, query values, cookie values, and WebSocket payloads.

Inspect the complete privacy model →

DELIBERATELY EXCLUDED

  • 01 Request / response bodies
  • 02 Page text and form data
  • 03 Cookie values
  • 04 URL credentials and fragments
  • 05 WebSocket frame contents
  • 06 Everyday browser history

05 — FIELD WORK

Observe. Interrogate. Preserve.

  1. 01

    Paste a target

    Start with an HTTP or HTTPS address in a fresh, isolated Chromium context.

  2. 02

    Watch it assemble

    Switch lenses, inspect services, replay the load, and optionally compare consent aftershock.

  3. 03

    Export the evidence

    Save sanitized JSON, a standalone HTML report, or a self-playing WebM forensic film.

06 — START OBSERVING

Two commands.
One clean browser.

Requires Node.js 22+, npm, and Chrome or Chromium.

TERMINAL / LOCAL SETUP01
npm ci
npm run dev

Open http://127.0.0.1:4178, then run a target or choose the deterministic 8-second demo.

WEBXRAY / LOCAL-FIRST WEB OBSERVATORY

Make the invisible
answerable.

Explore on GitHub ↗ Open documentation