mitmproxy MCP Server
MCP server on mitmproxy: the agent reads HTTP traffic, rewrites responses, replays requests and builds an API spec.
- 134 ★ on the repository
- Last commit
Broad access
Why this level
- The agent intercepts and rewrites HTTP traffic, including tokens and personal data that enter model context.
- Fuzzing, response rewriting and browser-fingerprint impersonation against third-party systems break the law and service rules.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add mcp/mitmproxy-mcp-serverDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent intercepts and rewrites HTTP traffic, including tokens and personal data that enter model context.
- Fuzzing, response rewriting and browser-fingerprint impersonation against third-party systems break the law and service rules.
This is third-party code. Review the repository files before installing.
What it does
mitmproxy MCP Server launches the mitmproxy proxy and hands its control to an agent as tools. The agent starts and stops the proxy, scopes recording to chosen domains, searches flows by keyword, method and domain, and opens any request with headers, body and a `curl` equivalent. Then comes work with the traffic: interception rules add headers, rewrite a response body by regular expression or block requests. `replay_flow` re-sends a request with a real browser TLS fingerprint through `curl-cffi`. The server extracts values from responses by JSONPath and CSS selectors, keeps session variables, groups endpoints, exports an OpenAPI spec, detects the authentication scheme, runs trial parameter fuzzing and generates scraper code.
Who it is for. Developers building clients for undocumented APIs and testers who analyze an application network exchange together with an agent.
Good fit when
- A frontend gets a 500 and the cause is sought in request headers and bodies.
- An internal service has no docs and the agent rebuilds the JSON schema from traffic.
- A backend response is replaced with a stub to test the interface without a ready server.
- A quick DAST pass runs on your own application: trial payloads in request parameters.
Not a fit when
- You test someone else system without the owner written permission.
- You need to intercept encrypted device traffic where the mitmproxy certificate cannot be installed.
- The service terms forbid scraping.
Example request
Start the proxy, scope recording to `api.example.com`, find the authorization requests and build an OpenAPI spec from them.MCP
- Transport
- stdio
- Authentication
- not required
Limitations
To read HTTPS, install the mitmproxy certificate in the browser or application and route traffic to `localhost:8080`; without it no flows appear. Captured headers, tokens and response bodies enter the model context and its logs, so limit domains with `set_scope`. `replay_flow` spoofs a browser TLS fingerprint and bypasses simple anti-bot checks, which breaks the rules of many services. Fuzzing and response rewriting are acceptable only on your own systems. The README gives no limits on mitmproxy or Python versions.
How to disable. Call `stop_proxy`, then remove the server entry from the client settings. Remove the mitmproxy certificate from the trust store and reset the browser proxy settings.
FAQ
Where do I start?
Call `start_proxy`, then `set_scope` with the needed domains and point a browser at `localhost:8080`. After that `get_traffic_summary` shows the first flows.
How do I replay a request with another body?
Use `replay_flow` with the flow id and new `headers_json` or `body`. The request goes out with a browser fingerprint through `curl-cffi`.
How do I take a token from a response and reuse it?
Save the value with `extract_session_variable` and a regular expression, then reference the variable name in the replay. This carries CSRF tokens and session keys.
What does `export_openapi_spec` give?
It groups similar endpoints, extracts path and query parameters and returns an OpenAPI v3 spec as JSON. Quality depends on how much traffic was captured.
Is there an install route without `uvx`?
Yes, there is `uv tool install mitmproxy-mcp`, Docker and a manual `pip install`. A clone runs through `uv run --directory`.
Discussion
No questions or reviews yet.
Related
MCP serversCLI mediator scans agent network requests and MCP calls for secret leaks, unsafe destinations and injected instructions
70 tools for the Caido proxy: request history, replay, fuzzing and findings for an agent during authorized security testing.
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
RE-MCP opens IDA Pro and Ghidra to an agent in headless mode: functions, decompiler, cross-references, types and patching.
A gateway for MCP servers with plugins for masking known secret patterns in text responses, reputation checks and call logging
An intercepting HTTP proxy with a terminal UI and MCP server: the agent reads captured traffic, replays requests and runs scans.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| mitmproxy MCP Server (this card) | no | not required | 134 | |
| Burp Suite MCP Server | yes | not required | 1 | connects an agent to Burp Suite for pentesting; mitmproxy MCP runs its own proxy and builds OpenAPI and code from traffic |
| BurpMCP-Ultra | no | API key | 297 | a Burp extension with pentest tools; here entry is simpler and the focus is API replay and scraping |
README in short
The README splits features into four groups: proxy control, traffic inspection and search, interception with rewriting, and API analysis with code generation. Each tool lists its parameters.