ApiTap MCP
CLI and MCP server that capture a website's internal API from real traffic and replay it through fetch, with no browser or DOM.
- 132 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- Traffic and cookies of your browser are intercepted on `attach` and tokens are stored to replay requests on your behalf.
- Automated access to internal site APIs may breach site terms and get an account blocked.
Install
- Works in
Manual install
npm install -g @apitap/core
claude mcp add -s user apitap -- apitap mcpThe second command registers the MCP server for Claude Code. `capture` and `browse` also need `npx playwright install chromium`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Traffic and cookies of your browser are intercepted on `attach` and tokens are stored to replay requests on your behalf.
- Automated access to internal site APIs may breach site terms and get an account blocked.
This is third-party code. Review the repository files before installing.
What it does
ApiTap opens a site in a browser, intercepts network calls over CDP and builds a signed skill file: a map of endpoints with parameters and response shapes. The agent then replays requests with a direct `fetch()`, without a DOM, selectors or waits. OpenAPI specs import without capture, and the APIs.guru directory is built in. For reading pages without a browser there are `peek` and `read` with decoders for Reddit, YouTube, Wikipedia, Hacker News and Twitter/X. The MCP server exposes 12 tools, including `apitap_capture` and `apitap_replay`.
Who it is for. Developers and analysts whose agents read data from sites without an official API and spend many tokens on browser automation.
Good fit when
- You need data from a site without a public API but with internal JSON calls.
- An agent reads Wikipedia articles or Reddit threads and the context must shrink.
- An OpenAPI spec is turned into a set of calls for the agent.
- The same request to your own service repeats regularly and a browser is overkill.
Not a fit when
- Endpoints sign requests or sit behind anti-bot protection: ApiTap marks them red and does not replay them without a browser.
- The site terms forbid automated access to its internal API.
- An official API with a key is enough.
Example request
Read the Wikipedia article on Node.js through ApiTap and show its structure without launching a browser.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
`capture` and `browse` need Chromium, installed separately with `npx playwright install chromium`. The `read`, `peek`, `discover` and `import` tools work without it. Node.js 20 or later is required. Endpoints with CSRF tokens and session binding are fragile, and those with request signing or anti-bot need a full browser. The Chrome extension is optional and loads unpacked in developer mode because it is not in the store yet. The replayability tier of an endpoint shows what to expect from a replay, from green to red.
How to disable. Remove the apitap entry from the MCP configuration and run `npm uninstall -g @apitap/core`. Skill files and encrypted sign-in data live in `~/.apitap/` and are removed separately.
FAQ
How do I connect ApiTap to Claude Code?
Run `npm install -g @apitap/core`, then `claude mcp add -s user apitap -- apitap mcp`. The server exposes 12 tools.
How do I connect ApiTap to Cursor or VS Code?
Add a server with `command` set to `apitap` and `args` set to `["mcp"]`. For VS Code the file is `.vscode/mcp.json`.
Where are tokens and cookies stored?
Separately from skill files, encrypted with AES-256-GCM, and injected at replay time.
What does a red endpoint tier mean?
Requests are signed or anti-bot protection such as Cloudflare is active. A replay through `fetch` will not work and a full browser is needed.
Is the Chrome extension required?
No, it is optional. The extension passively maps the APIs of sites you visit and captures traffic from an already signed-in session.
Discussion
No questions or reviews yet.
Related
MCP serversOfficial Apify MCP server: the agent runs ready-made Apify Store scrapers for social media, maps, search and shops
An MCP server that opens pages in headless Chromium through Playwright and hands the agent the main text as Markdown, even from JavaScript-heavy sites
Browserless.io MCP server: a cloud browser for the agent with page reads, site crawls, Lighthouse audits and click-driven sessions
The official Search1API MCP: web search, news, page crawling, sitemaps and trends with OAuth sign-in or an API key.
An MCP server that records your browsing and network traffic so an agent can build a browserless HTTP script from the recording.
A skill, MCP and CLI that give an agent ready-made calls to sites' internal APIs instead of driving a browser; works through the unbrowse.ai cloud service
README in short
Each endpoint gets a replayability tier and a confidence score based on how it was discovered. When a response drifts from the recorded shape, ApiTap reports it before the task fails.