mitmproxy MCP Server

A Model Context Protocol (MCP) server that transforms mitmproxy into a powerful toolset for AI agents. This allows LLMs (like Claude, GPT-4, or local models) to inspect, modify, and replay HTTP/HTTPS traffic in real-time.

New in this build (the fun stuff)

This project has grown beyond simple capture + replay. You can now:

• Search traffic quickly with filters by domain/method/body text.
• Extract data from responses using JSONPath or CSS selectors.
• Use session variables to grab tokens from one response and reuse them in later replays.
• Run lightweight fuzzing against query params or JSON body fields for quick DAST checks.
• Reconstruct API patterns and export an OpenAPI-style spec from captured traffic.
• Detect auth patterns (Bearer/JWT/API key/session cookie/CSRF/OAuth hints).
• Generate starter scraper code from real captured flows.

Why use this?

Standard "web search" or "fetch" tools are stateless and easily detected. mitmproxy-mcp provides:

• Deep Debugging: The agent can inspect full request/response cycles (headers, payloads, cookies) to identify why a frontend is failing or why an API is returning a 4xx/500 error.
• API Reverse Engineering: Let the LLM observe undocumented internal APIs, map out JSON schemas, and generate client libraries or documentation automatically.
• Automated Security Testing: Perform DAST (Dynamic Application Security Testing) by allowing the agent to inject payloads into specific parameters and analyze the response.
• Live Interception: Modify traffic on the fly: inject headers, mock responses for testing, or block tracking pixels to reduce noise.
• Stealth Replay: Uses curl-cffi to mimic Chrome/Safari TLS fingerprints, bypassing basic anti-bot measures that standard Python libraries trigger.

Key Features

• Lifecycle Control: Start and stop the mitmproxy instance directly from the LLM.
• Deep Inspection: Capture full request/response cycles, including headers, bodies, and timing.
• Traffic Search & Filtering: Scope by domain, then search flows by query/method so context stays clean.
• Active Interception: Dynamic rules to inject headers, replace body content via regex, or block requests.
• Stealth Replay: Re-execute flows using curl-cffi to impersonate modern browser TLS fingerprints (e.g., Chrome).
• Session-Aware Workflows: Extract dynamic values (like CSRF tokens) and re-inject them into replayed traffic.
• Response Data Extraction: Pull structured values from HTML/JSON responses via CSS selectors and JSONPath.
• API Discovery: Group similar endpoints, identify path/query params, and export OpenAPI JSON.
• Security Recon Helpers: Detect common auth patterns and run targeted fuzz payloads.
• Scraper Bootstrapping: Generate executable curl-cffi automation code from observed traffic.

Quickstart

Option 1: Using uvx (Recommended)

Add this to your MCP client configuration (e.g., Claude Desktop, Cursor, or AntiGravity):

{
  "mcpServers": {
    "mitmproxy-mcp": {
      "command": "uvx",
      "args": ["mitmproxy-mcp"]
    }
  }
}

Option 2: From a Cloned Repository

If you want to run from a local clone (useful for development or testing unreleased changes):

git clone https://github.com/snapspecter/mitmproxy-mcp.git

Then add this to your MCP client configuration, replacing the path with your clone location:

{
  "mcpServers": {
    "mitmproxy-mcp": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "--directory", "/path/to/mitmproxy-mcp", "mitmproxy-mcp"]
    }
  }
}

Installation

Option 1: Global Install (with uv)

uv tool install mitmproxy-mcp

Option 2: Docker (Isolated Environment)

# Build and run
docker build -t mitmproxy-mcp .
docker run -p 8080:8080 mitmproxy-mcp

Option 3: Manual Pip Install

python -m venv venv
source venv/bin/acti

... [View full README on GitHub](https://github.com/snapspecter/mitmproxy-mcp#readme)