The API client with no collections.

Sonar reads your Next.js or Express code, logs in for you, and shows the line behind every error.

macOS 12 or later · Apple Silicon

Sonar is a macOS app. Open this page on your Mac to install it.

Try it here

A small Next.js project, as Sonar shows it. Nothing was typed in by hand: the routes, the login and the error lines all come from the code.

WorkspaceTime capsule Projectcapsule-api Branchmain · your folder

Environmentlocal

Home

GET {{baseUrl}}/api/capsules

app/api/capsules/route.ts:5 cookie: sessionvia requireUser1 error path

limit	query	int · ≥ 1
cursor	query	string

Read from the zod schema in the handler.

Response

Press Send. You have not logged in yet, so expect a 401.

~/code/capsule-api → http://localhost:3000 no token · 0 cookies Sonar 0.8.0

Step 1 of 4 Press Send on GET /api/capsules. I will show you where it bounces.

Sonar is for developers who test their own API while they build it. Most API clients start from a collection that you write by hand and then keep in sync with the code. Sonar starts from the route files you already have, so the list of endpoints is never out of date and there is nothing to maintain.

Reads Next.js App RouterNext.js Pages RouterExpress, including route tablesHonoFastify in TypeScript or JavaScript.

Features

Three things Sonar does that a collection cannot, then the rest.

Routes and request bodies from your code

Open a folder and every route is listed, grouped by category with sub-groups for deeper paths. Each request is already filled in: path and query params, a sample body, and the rules each field must pass.

Bodies from zod schemas and from the fields the handler reads.
express-validator rules shown in words: int · ≥ 1, one of admin | staff, length 2–50.
Save a file and the list updates, with new and changed endpoints marked.

auth/api/auth3

users/api/users6

/:id4

GET/api/users

POST/api/users

orders/api/orders9

Body · from routes/users.js

name required	string · length 2–50
role required	one of admin \| staff
email required	email
age	int · ≥ 1

{
  "name": "Ada",
  "role": "admin",
  "email": "ada@example.com",
  "age": 1
}

Errors traced to the line, ready to hand to AI

When a request fails, Sonar matches the status and message to the place in your code that sent them. You see the lines, the condition that led there, and a button that opens the file at that line in your editor.

Copy for AI puts the request, the response and the matching code into one prompt for the assistant you already use.
Secrets are masked before anything reaches the clipboard. Sonar itself sends the prompt nowhere.

403 from middleware/role.js:14 (in requireRole)Copy for AI

12const user = req.user

13if (user.role !== 'admin') {

14 return res.status(403).json({ error: 'admin_only' })

15}

Condition that leads here: user.role !== 'admin'

Open this line in your editor

## Request I sent
DELETE http://localhost:3000/api/users/42
Authorization: Bearer ***

## What came back
403 Forbidden in 12 ms

## Where the code sends this error
middleware/role.js:14  (runs when: user.role !== 'admin')

Docs and branch compare

Each endpoint has a Docs tab built from the @swagger / OpenAPI blocks and comments in your code: description, auth, parameters, body rules and every error path with its file and line.

Read another branch's routes without checking it out.
Compare with a base branch and see which endpoints are new, changed (and what changed) or removed. Useful before a review.

vs main · 1 new, 1 changed, 1 removed

capsules/api/capsules3

GET/api/capsules

POST/api/capsuleschanged

POST/api/capsules/:id/sealnew

Removed in this branch 1

DELETE/api/capsules/:idremoved

Changed in this branch · compared with main

Body field added: openAt
Body field title is now required
Error added: 409 already_sealed

Create a capsule

Authentication

cookie: session · checked in requireUser

Errors in the code

401	not_signed_in	lib/auth.ts:9
409	already_sealed	route.ts:31

And the rest

Auth and CSRF without setup After a login route answers, the token goes to the Keychain and the cookies are kept, then both are sent where the code reads them. The CSRF header is fetched and added on its own. For a sign-in that needs a browser, such as Google, Sonar says so and lets you bring the session cookie over.
The request path A line of stops shows the checks the code makes on the way to the handler: sign-in, CSRF, validation, handler, response. Before you send, Sonar tests your inputs against the rules in the code and says where the request would stop. After you send, the stop that answered is marked.
Flows Chain requests that run in order and pass values along: log in, list, open one. Record a flow by sending requests as usual, then run it again with one click. Each step has checks, and a failed step says why. Run the same flow as several roles to see what an admin gets and a staff member does not.
Run your dev server A Server panel starts and stops the project's dev command and shows its log. When a request fails, the log lines around it appear in the error card. The status bar always shows how many servers are running, so none is left on by accident.
Forms and file uploads Send JSON, urlencoded forms, multipart with files, or raw text. Binary answers can be saved to a file.
HTTP status and business status, apart A 200 whose body says "status": false is shown as an HTTP success with a business failure. Sonar reads the envelope from your code, or you name your own field. You decide per project whether it counts as a failed request.
Answers your AI agent Turn on MCP in Settings and Claude Code can ask Sonar what routes a project has, what a route needs, what changed against a branch, and why your last request failed, with the file and line. It reads, and sends only if you allow each request. On your Mac only, off until you turn it on.
What each route returns Sonar reads the fields a route sends on success from the code, through services and wrappers, and lists them in Docs. A branch compare says when a response field was added or removed.
The same .env for the whole team Check .env lists the variables your code reads against the .env on your Mac: what is missing, what is empty, what a teammate cannot know about because it is not in the example file. Each one shows who added it. Only names are read, never values.
Values from the list route Beside :id, pick from what GET /users just returned, with a name next to each id. No copying ids between tabs.
Copy as curl The request as a command that runs as it is, with the token and cookies filled in.
Tabs and past sends Endpoint tabs with a preview tab, like an editor. Drag to reorder them and pin the ones you keep coming back to. ⌘[ and ⌘] step through earlier sends and bring back what you filled in and what came back.
Layout and session panel Put the response beside or below the request. A side panel shows the token, cookies, CSRF, variables and sends, and the status bar shows where requests go.
Themes Light and dark, or follow the system. A choice of syntax colours for request and response bodies, and one click brings in the theme you use in VS Code or Cursor.
Explanations in English or Thai The error card and the Copy for AI prompt can speak Thai (ภาษาไทย). Sonar follows your Mac's language, and you can switch in Settings.
Environments and Keychain A base URL and variables per environment. Secret values live in the macOS Keychain, never in a file you might commit.
Workspaces Keep several projects in one workspace. Home searches every project and endpoint by name, path, method or file.
Clone a repository Clone from inside the app and pick from your own GitHub list through the gh sign-in already on your Mac.
In-app updates When a newer signed build is out, the status bar offers it. One click installs it and restarts.

What leaves your Mac

Three things, and you start two of them yourself.

The requests you send They go to the URL you set, and nowhere else.
An update check Sonar asks sonar.parieaw.cloud whether a newer version exists.
git and gh, when you clone Cloning runs the git and gh already on your Mac, with your own sign-in.

No telemetry and no account. Your code is read on your Mac and stays there. Tokens and secrets are kept in the macOS Keychain, and "Copy for AI" only puts text on your clipboard: you decide where it goes. If you turn on MCP for an AI agent, what that agent asks for (routes, code excerpts, your last response with secrets masked) goes to the agent. It is off until you turn it on.

Use it from your AI agent

Sonar answers Claude Code and other MCP clients about the projects you have open. Off until you turn it on, and nothing is sent without your yes.

Connect Claude Code

1. Turn it on. In Sonar, open Settings (the cog) and set AI agents to On (MCP).
2. Copy the command. Press Copy command there and run it once in Terminal. It looks like this, with your own token:

claude mcp add --transport http sonar http://127.0.0.1:47821/mcp --header "Authorization: Bearer …"

3. Ask. Keep Sonar open with your project in it, then ask the agent things like "which routes does this project have?" or "why did my last request to POST /api/orgs fail?". The status bar shows each time the agent reads something.

The token is a password for this endpoint: don't share or commit it. New token in Settings replaces it.

What an agent can ask

sonar_list_routes The routes of a project: method, path, how each is protected, file and line.
sonar_describe_route What one route needs: parameters, body and validation rules, sign-in and permission guards, and every error it can send with the file, line and condition.
sonar_compare_routes Routes that are new, changed or removed compared with another branch.
sonar_explain_error The last response you got for a route: HTTP status, business status, and the line of code that sent it. Secrets are masked.
sonar_server_log What your dev server printed: the stack trace behind a 500, a startup error. For a server started from Sonar's Server panel. A failed request already comes with the error the server logged for it.
sonar_check_env Which environment variables the code needs and your .env does not set, and who added each one. Names only.

These six only read. The endpoint listens on your Mac only (127.0.0.1), needs the token, refuses web pages, and stops when Sonar closes.

Let it send, if you want

With Sending on "Ask me" (the default once MCP is on; set it to Off if you want reading only), two more tools work: sonar_send_request sends one request to a route, and sonar_run_flow runs a flow you saved.

You approve each one. Sonar shows the method, the full URL and the body, and waits for your yes. A notification tells you when Sonar is behind another window. No answer is a no.
Only to your environment. The address is the base URL you set. An agent cannot give a URL of its own, and an address that is not on your Mac is called out.
Or let it run on your Mac. Set Sending to Auto and requests to a local address go without the dialog. Anything that is not on your Mac still asks.
You see what happened. The response, the past sends and History show it like a request you sent yourself.

Nothing is sent without your yes. No tool uploads a file or starts a server.

Install

Free. macOS 12 or later on Apple Silicon.

One command recommended

Paste it into Terminal. No "unidentified developer" warning, and the same command updates Sonar later.

curl -fsSL https://sonar.parieaw.cloud/install.sh | bash

It downloads the release, checks its sha512 and copies Sonar.app into Applications. Read the script first if you like.

Or the DMG

Download Sonar (.dmg)

Open it and drag Sonar into Applications. Sonar isn't signed by Apple yet, so macOS blocks the first launch. Run this once, or use System Settings → Privacy & Security → Open Anyway:

xattr -dr com.apple.quarantine /Applications/Sonar.app

No project at hand? Try the demo API

A small API made to try Sonar on: three ways to sign in, roles, validation, a file upload, a route that crashes on purpose, and a .env to check. It runs anywhere Node does, with no database.

git clone https://github.com/parieaw/sonar-demo-api.git

Or paste that address into Clone repository in Sonar. Then npm install, press Run in the Server panel, and follow the twelve things to try in its README.

Good to know first

Apple Silicon Macs only. There is no Intel, Windows or Linux build.
Not notarized by Apple yet. That is why the first launch needs the step above, or the one-command install.
Node backends for now. Routes are read from Next.js, Express, Hono and Fastify projects.