mitmproxy

The recurring problem when debugging APIs is that you cannot see: a mobile app errors without showing its request, the front end blames the back end's response, a third-party SDK quietly ships data somewhere, or you want to reuse a site's endpoint but do not know its parameter format.

mitmproxy is the pair of glasses. 44,695 stars, MIT, written in Python, functionally comparable to Charles and Fiddler but entirely free and open source.

It works as a man-in-the-middle proxy: point a device's network proxy at it and all traffic flows through. To see HTTPS content you install its generated root certificate on the device so it can decrypt and re-encrypt — hence the name.

Three modes cover different situations:

• mitmproxy: a terminal UI, keyboard-driven, listing flows and expanding request details. Good for capturing over SSH on a server.
• mitmweb: a browser-based UI, mouse-driven, friendlier for anyone uncomfortable in a terminal.
• mitmdump: headless command-line output or file capture, suited to scripting and automation.

What truly separates it from its peers is that it is programmable. Attach a Python script of a few dozen lines and do anything to the traffic: rewrite a field in every response, inject authentication headers, count requests to a domain, save matching requests, or simulate server failures and slow responses. For API testing and reverse engineering, this beats clicking around a GUI by a wide margin.

To be clear about:

• Installing the certificate has security implications. Once the root certificate is trusted, that device's HTTPS traffic is transparent to mitmproxy. Remove the certificate when you finish debugging, never leave your root certificate on someone else's device, and never install certificates of unknown origin.
• Many apps cannot be intercepted. Modern apps commonly use certificate pinning to reject non-official certificates, which is correct security design. Bypassing it requires modifying the app or using tools like Frida, and should only be done on applications you own or are explicitly authorized to test.
• It only handles HTTP-family protocols. For lower-level TCP/UDP inspection, use Wireshark.
• Only analyze traffic you have the right to analyze. Your own apps, devices and APIs are fine; intercepting other people's traffic on a network without authorization is illegal.

Who it suits: front-end and back-end developers debugging APIs, mobile developers and testers, and privacy researchers who need to establish what a piece of software actually sends.