mimic

Mimic turns any app into a Python library. Point it at an app, it captures the traffic through mitmproxy, pulls out the auth tokens and session data, and uses Claude to generate a plain Python client for the endpoints it saw. Then you import that client and call the app's private API from your own code. MIT, free, from a well-regarded developer.

Setup is one script: `sh install.sh` grabs uv, sets up an isolated environment, and bundles mitmproxy so you do not install it separately. The flow is `mimic record` to capture, `mimic hosts` to see what it found, and `mimic gen` to write the client. It works against iOS apps through the proxy and web apps via cURL requests copied from your browser's dev tools. Getting the proxy and device trust set up is the fiddly part; the generation itself is quick.

For a developer who needs to script against an app that has no public API, this is a clever shortcut, and it costs nothing. It is a personal-scale tool, not a team platform: no seat model, no hosted service. Solo use is the whole story.

The catch is two-fold. Technically, certificate pinning and sender-constrained tokens (DPoP) will block capture on hardened apps, so it will not work everywhere. Legally, replaying an app's private API can violate its terms of service, and the project is explicit that it is for your own accounts only. Use it where you have the right to; the tool will not make that judgment for you.