# trimstray/htrace.sh

My simple Swiss Army knife for http/https troubleshooting and profiling.

Repository: https://github.com/trimstray/htrace.sh
Canonical: https://ross.abutalabs.com/products/htracesh
Language: Shell
License: GPL-3.0
License Family: copyleft
Topics: https-troubleshoting, http-requests, httptracer, redirect-urls, testing-tools, security-tools, debugging-tools, swissarmyknife, mozilla-observatory, ssllabs-scan, nmap, nmap-scripts, testssl, waf, sublist3r
Last push: 2024-11-19T14:04:50+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 2973, "days_push": 652, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3860, forks 244 (observed 2026-08-28T04:08:27.536467+00:00)

## What it is
htrace.sh is a shell-script CLI that combines HTTP/HTTPS request troubleshooting (redirect tracing, headers, body, SSL parameters, custom methods and proxies) with wrappers around security tools like Nmap, testssl.sh, SSL Labs, and Mozilla Observatory. It packages these checks behind a single command, installable natively on Debian/Ubuntu/macOS or via a Docker image.

## Use cases
- trace the redirect chain of a url
- inspect http response headers and body
- check a site's ssl/tls configuration
- scan a website for missing security headers
- detect whether a waf is in front of a site
- run ssl labs and observatory scans from the terminal
- debug why an https endpoint behaves unexpectedly

## When to choose
- You want one terminal command that mixes HTTP request inspection with TLS and security scanning
- You're doing quick triage of redirects, headers, and SSL misconfigurations on Linux or macOS
- You prefer avoiding dependency setup by running a prebuilt Docker image

## When to avoid
- You need structured JSON output or a programmatic API for automation and CI pipelines
- You require load testing, deep application profiling, or continuous monitoring rather than point-in-time triage
- You can't install the wrapped external tools (Nmap, testssl.sh, etc.) and don't want to use Docker

## Facets
- artifact type: cli-tool
- maturity: active
- function: http-client, security, vulnerability-scanning, developer-tools
- domain: security, web-development, developer-tools, networking
- platform: cli
- tags: http-troubleshooting, https, ssl-tls, redirect-tracing, header-analysis, nmap, testssl, ssllabs, mozilla-observatory, waf-detection, subdomain-enumeration, shell-script, swiss-army-knife, linux, macos, docker

## Member repositories
- trimstray/htrace.sh (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:27.536467+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:25:54.284632+00:00, confidence not recorded.
  - readme: https://github.com/trimstray/htrace.sh (fetched 2026-08-28T04:08:27.536467+00:00, sha 45ffdf6eae4a)
- Data as of 2026-08-30T08:39:29.467469+00:00.