mitmproxy — The Interactive HTTPS Proxy for Debugging and Reverse Engineering

What it is

mitmproxy is a free, open-source interactive HTTP/HTTPS/HTTP2/WebSocket proxy. It sits between your device and the internet, decrypts HTTPS traffic (after CA certificate installation), and displays every request and response. You can inspect, modify, and replay traffic on the fly.

mitmproxy serves three audiences: mobile developers inspecting app traffic, QA teams simulating broken or slow networks, and security researchers reverse-engineering protocols. It ships with three interfaces: a terminal TUI (mitmproxy), a web dashboard (mitmweb), and a headless capture tool (mitmdump).

How it saves time or tokens

Without a proxy, debugging API calls requires adding logging to application code, rebuilding, and redeploying. mitmproxy lets you see real traffic instantly without code changes. The Python scripting API means you can write custom interceptors -- blocking certain requests, injecting headers, or modifying response bodies -- in a few lines. For AI development workflows, this is particularly useful when debugging LLM API calls to see exact token usage and response timing.

How to use

1. Install mitmproxy: brew install mitmproxy (macOS) or pip install mitmproxy.
2. Launch the proxy: run mitmproxy for terminal UI, mitmweb for browser UI, or mitmdump -w traffic.mitm for headless capture.
3. Configure your device or browser to use 127.0.0.1:8080 as HTTP proxy.
4. Install the CA certificate by visiting http://mitm.it while the proxy is running.

Example

# custom_script.py -- log all API calls to OpenAI
from mitmproxy import http

def response(flow: http.HTTPFlow):
    if 'api.openai.com' in flow.request.pretty_host:
        print(f'[OpenAI] {flow.request.method} {flow.request.path}')
        print(f'  Status: {flow.response.status_code}')
        print(f'  Size: {len(flow.response.content)} bytes')

# Run with the script
mitmdump -s custom_script.py

Related on TokRepo

• AI tools for security -- explore security and auditing tools curated on TokRepo.
• AI tools for testing -- find tools for API testing and quality assurance.

Common pitfalls

• HTTPS interception requires installing mitmproxy's CA certificate on the client device. Without it, you only see encrypted traffic. Certificate pinned apps will reject the proxy entirely.
• Some applications detect proxy usage and refuse connections. Mobile apps with certificate pinning need additional tools like Frida to bypass.
• Running mitmproxy on a shared network without consent is illegal in most jurisdictions. Use it only on traffic you own or have permission to inspect.