mimic: Intercept Any App and Call Its API from Python Like a Library
mimic: Intercept Any App and Call Its API from Python Like a Library 🐍
What is it? mimic is an open-source tool that captures HTTP traffic from any app (mobile or web), extracts authentication tokens automatically, and optionally generates a Python client library so you can call the app's API like a regular Python module — no manual reverse-engineering, no packet inspection.
Why it's trending: mimic hit 900+ GitHub stars in its first week because it solves a pain point every developer has faced. You find a great mobile or web app and wish you could automate a workflow — batch an action, extract your data, build an integration. Normally this means hours of proxying traffic, manually extracting tokens, and reverse-engineering endpoints. mimic does the first 90% of that work in three commands. It's MIT licensed, uses mitmproxy under the hood, and is built by Divy Srivastava (Deno core team) — so the engineering quality is solid.
How It Works
The concept is elegantly simple. Most mobile and web apps authenticate every API request with a stable bundle of values: a bearer token, device identifiers, cookies, a session ID. Capture these values once from a real request, and you can replay them on any new request to the same API. mimic automates this entire pipeline:
- Capture traffic via mitmproxy (iPhone) or import a cURL/HAR export (browser)
- Extract auth — bearer tokens, cookies, device IDs, all session context
- Generate a Python client — using Claude (or your preferred LLM), it reads your captured endpoints and produces a clean Python module with named methods, body templates, and multi-step call chaining
The resulting client is plain Python on top of mimic.App, and you edit it like any other file.
Prerequisites
- macOS (for iPhone capture) or any OS (for web capture via cURL/HAR)
- Python 3.10+ with
uv(installed automatically by the setup script) - An iPhone (optional — only needed for mobile app capture)
- Claude API key or another LLM provider (optional — only needed for code generation)
- ~/1GB free disk for mitmproxy artifacts
Installation
Installation is a single command:
sh -c "$(curl -fsSL https://raw.githubusercontent.com/littledivy/mimic/main/install.sh)"This installs uv (the fast Python package manager) if you don't have it, then installs mimic in an isolated tool environment. mitmproxy isn't a separate install — mimic launches it via uvx on first use.
Verify the setup:
mimic doctorThis confirms the proxy is ready and Claude can be reached (if you configured an API key).
Quick Start: Capture an iPhone App
Step 1: Start the proxy
mimic recordThis starts mitmproxy and prints the configuration steps for your iPhone.
Step 2: Configure your iPhone
- Open Settings → Wi-Fi → tap your network → Configure Proxy → Manual
- Enter your Mac's LAN IP address and port
8080 - Open Safari and visit
http://mitm.it - Install the Apple profile
- Go to Settings → General → About → Certificate Trust Settings → enable full trust for the mitmproxy certificate
⚠️ Step 5 is easy to miss — nothing works without it.
Step 3: Use the app normally
Open the app you want to capture, browse around, perform actions. The proxy records all HTTP traffic silently.
Step 4: Inspect and generate
# List captured hosts
mimic hosts
# See the endpoints mimic discovered
mimic learn prod-api.yourapp.com
# Generate a Python client
mimic gen prod-api.yourapp.comThis creates yourapp_client.py in your current directory.
Step 5: Use the client
from yourapp_client import YourApp
api = YourApp() # reuses your captured session
data = api.get_feed()
api.like(post_id="abc123")That's it. You now have a programmatic Python interface to any mobile app.
Alternative: Web App Capture (No iPhone Needed)
If you're targeting a web app, you don't need a proxy or an iPhone:
Option A: Copy as cURL
- Open Chrome/Firefox DevTools → Network tab
- Right-click a request → Copy as cURL
- Paste into a file or directly into Python:
from mimic import Session
session = Session.from_curl(open("copied.txt").read())
response = session.get("/api/profile")Option B: HAR File Import
- In DevTools, right-click any request → Save all as HAR
- Use mimic with the HAR file:
mimic hosts --har traffic.har
mimic gen api.example.com --har traffic.harOr in Python:
from mimic import Session
session = Session.from_har("traffic.har", "api.example.com")Advanced Usage
Direct API Without Code Generation
If you don't want AI-generated code, mimic provides a Session class for direct control:
from mimic import Session
# From mitmweb capture
session = Session.from_mitm("api.example.com")
# From cURL paste
session = Session.from_curl("curl 'https://api.xxx' -H 'Authorization: Bearer ...'")
# Explicit
session = Session(base_url="https://api.example.com", headers={"Authorization": "Bearer xxx"})
# Standard HTTP methods
session.get("/users/me")
session.post("/posts", json={"title": "Hello"})Auto Token Refresh
If your session token rotates, mimic handles it automatically. A 401 on an idempotent request triggers one re-pull from mitmweb and a retry:
# Non-idempotent requests can opt in
session.post("/orders", json={...}, refresh=True)Bypassing Certificate Pinning
Some apps (banking, Instagram) reject the mitmproxy certificate. mimic includes a Frida-based bypass:
mimic unpin com.example.app.ipaHAR Import from CLI
mimic hosts --har traffic.harArchitecture
mimic's architecture is a clean pipeline with three capture backends converging into a unified session abstraction:
| Component | Role |
|---|---|
| mitmproxy | Intercepts HTTPS traffic from iOS/macOS apps via system proxy |
| cURL Import | Parses "Copy as cURL" strings from browser DevTools |
| HAR Import | Reads standard HAR (HTTP Archive) files exported from browsers |
| Session | Core abstraction — stores auth context, auto-refreshes tokens |
| Code Generator | Optional AI step that reads endpoints and generates a Python module |
The system supports three capture backends — mitmproxy for mobile apps, cURL for quick web captures, and HAR for full browser sessions — all feeding into the same Session object.
Limitations
- Certificate pinning blocks capture on some apps (banking, Instagram). The
mimic unpincommand with Frida can bypass this. - DPoP / sender-constrained tokens cannot be replayed — each request requires a fresh cryptographic proof from the device. There's no workaround.
- Rate limiting is your responsibility — replaying hundreds of requests too fast may get your account flagged.
- Terms of Service — use mimic only on your own accounts and data.
Resources
- GitHub: https://github.com/littledivy/mimic
- Docs: https://github.com/littledivy/mimic#readme
- Install:
sh -c "$(curl -fsSL https://raw.githubusercontent.com/littledivy/mimic/main/install.sh)" - License: MIT
- Author: Divy Srivastava (@littledivy) — Deno core team
Comparison with Alternatives
- mitmproxy / Charles Proxy — manual tools that capture traffic but require you to manually extract tokens and build clients. mimic automates the extraction and code generation steps.
- Browser DevTools — let you inspect requests individually but offer no programmatic replay or Python integration.
- Reverse-engineering — decompiling app binaries to find API endpoints is fragile, time-consuming, and may violate licenses. mimic works entirely at the network level.
mimic doesn't replace these tools — it automates the tedious parts so you can focus on building integrations with the captured API.