http-evidence

Use `http_audit` (mantis_http_audit MCP server) whenever you have a captured HTTP exchange that proves a web finding, before attaching it as evidence. It converts raw request/response text into a bounded, redacted evidence pack and a stable `request_ref`/`response_ref` hash. Why go through it instead of pasting the raw exchange into the finding: - It strips secret-bearing headers (`Authorization`, `Cookie`, `Set-Cookie`, `X-Api-Key`, CSRF tokens, ...) and inline secrets (AWS keys, GitHub/Slack tokens, JWTs, private keys, `user:pass@` in URLs). Raw secrets must never land in a finding, artifact, report, or prompt (PRD section 9/11). - It bounds the body: full bodies are hashed and previewed (first 512 bytes), never stored whole. - The `request_ref` is a stable hash of the exchange, so the same request always maps to the same id -- use it to cross-reference and dedup evidence across findings. Workflow: capture the request (and response) text -> call `http_audit({ request, response })` -> attach the returned `request_ref`/`response_ref` and the redacted pack to the finding via `mantis_findings` `finding_update` `evidence`. The tool makes NO network call itself; you pass in traffic you already captured under authorized, scoped testing. Do not defeat the redaction by separately pasting the raw header/body you just redacted into the finding or report. If you need to prove a specific secret was exposed, reference it by its redaction label and location, and follow the `secrets-sc...