Turn a mobile app's private API into a Python library by capturing your own traffic.
Automate an app that has no public API by replaying your own captured session.
Build a script against a web app using a HAR file instead of an official API.
| littledivy/mimic | anthropics/jacobian-lens | vibeforge1111/keep-codex-fast | |
|---|---|---|---|
| Stars | 1,445 | 1,434 | 1,456 |
| Language | Python | Python | Python |
| Last pushed | — | 2026-07-17 | 2026-05-06 |
| Maintenance | — | Active | Maintained |
| Setup difficulty | moderate | moderate | easy |
| Complexity | 3/5 | 4/5 | 2/5 |
| Audience | developer | researcher | developer |
Figures from each repo's GitHub metadata at analysis time.
iOS capture needs installing a mitmproxy certificate and trusting it on the device.
mimic is a Python tool that turns any app's private API into a Python library you can call directly, without writing the client code by hand. Instead of reading network requests yourself and guessing how an app talks to its servers, you capture real traffic from your own use of the app, and mimic uses AI to generate a working Python client from what it saw. The idea behind it is that most apps send the same set of authentication values with every request: a token, device identifiers, a session id, cookies. These values stay stable across calls, so if you capture them once from a real request, you can reuse them to make new requests to the same API. mimic captures this traffic, pulls out the authentication details, and reads the captured endpoints to build named Python methods, including the multi step call chains some mobile APIs need, such as fetching a token in one call and spending it in the next. There are three ways to capture traffic. mitmproxy is the default and works well for iOS apps by intercepting requests sent from your phone. Pasting a request copied as cURL from browser developer tools works for anything with a web version. Saving a HAR file from a browser's network tab also needs no proxy setup at all. Once you have captured traffic, commands let you list which hosts you captured, see what endpoints were seen for a given host, and generate a Python client file for it. The generated client is ordinary Python code built on a base class, so once it exists you can edit it like any other file. If a request fails because a token expired, the library tries to refresh it once automatically, but only for requests that are safe to repeat. Two situations get in the way of this approach. Apps that use certificate pinning, such as banking apps, block the capture step entirely, though mimic includes a workaround for that case. Apps that use DPoP, where each request is signed by a private key that never leaves the device, cannot be replayed at all, since the signature itself cannot be captured and reused later. The README says the project is meant for use on your own accounts and data, and you are responsible for following each app's terms of service. It is released under the MIT license.
mimic captures your own app's network traffic and uses AI to generate a Python client, so you can call any app's private API like a library.
Mainly Python. The stack also includes Python, mitmproxy, uv.
Use freely for any purpose, including commercial use, as long as you keep the copyright notice.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly developer.
This repo across BitVibe Labs
double-check against the repo, no cap.