3.8K ·GitHub
What is this?
Anything Analyzer is an all-in-one traffic capture and protocol analysis toolkit: it captures HTTP/HTTPS traffic from a browser, desktop apps, terminal commands, scripts, mobile devices, and IoT devices into one session, then uses an LLM to automatically reverse-engineer and explain the protocol.
Anything Analyzer is an all-in-one traffic capture and protocol analysis toolkit: it captures HTTP/HTTPS traffic from a browser, desktop apps, terminal commands, scripts, mobile devices, and IoT devices into one session, then uses an LLM to automatically reverse-engineer and explain the protocol.Is this a desktop app or a command-line tool?It is a cross-platform Electron desktop application (Electron 35 + React 19 + Ant Design), not a CLI, with a built-in browser, MITM proxy, and local SQLite storage.
It is a cross-platform Electron desktop application (Electron 35 + React 19 + Ant Design), not a CLI, with a built-in browser, MITM proxy, and local SQLite storage.How do I get it running and start capturing traffic?Download the prebuilt installer for your OS from Releases, then in Settings configure an LLM API key, create a new Session, operate the target (website in the embedded browser, or point other apps/terminal/phones at the built-in MITM proxy), click Start Capture, then Analyze.
Download the prebuilt installer for your OS from Releases, then in Settings configure an LLM API key, create a new Session, operate the target (website in the embedded browser, or point other apps/terminal/phones at the built-in MITM proxy), click Start Capture, then Analyze.Do I need my own LLM API key?Yes, the app has no built-in AI model - you must supply your own key for OpenAI, Anthropic, or any compatible LLM API in Settings before analysis works.
Yes, the app has no built-in AI model - you must supply your own key for OpenAI, Anthropic, or any compatible LLM API in Settings before analysis works.Does the MITM proxy modify my traffic, and are there capture limits?No, the MITM proxy is strictly read-only capture - it never modifies requests or responses, WebSocket traffic is just tunneled without decryption, and each captured body is capped at 1MB with binary content auto-skipped.
No, the MITM proxy is strictly read-only capture - it never modifies requests or responses, WebSocket traffic is just tunneled without decryption, and each captured body is capped at 1MB with binary content auto-skipped.Who is this built for?It targets reverse engineers, API researchers, and security auditors who need to inspect hidden App/website APIs, JS crypto routines, or microservice call chains, since the use-case table lists website API reverse engineering, app protocol reverse engineering, JS crypto reverse engineering, security audits, and CLI/microservice debugging.
It targets reverse engineers, API researchers, and security auditors who need to inspect hidden App/website APIs, JS crypto routines, or microservice call chains, since the use-case table lists website API reverse engineering, app protocol reverse engineering, JS crypto reverse engineering, security audits, and CLI/microservice debugging.What AI analysis modes does it support?Five modes - auto-detect, API reverse engineering, security audit, performance analysis, and JS encryption reverse engineering - run through a two-phase pipeline where Phase 1 filters out noise requests and Phase 2 does the deep analysis.
Five modes - auto-detect, API reverse engineering, security audit, performance analysis, and JS encryption reverse engineering - run through a two-phase pipeline where Phase 1 filters out noise requests and Phase 2 does the deep analysis.What does the built-in MCP server do?It exposes the capture and analysis engine as MCP tools so external agents like Claude Desktop or Cursor can drive capture and analysis directly, and the app also acts as an MCP client to connect to outside MCP servers for extra capabilities.
It exposes the capture and analysis engine as MCP tools so external agents like Claude Desktop or Cursor can drive capture and analysis directly, and the app also acts as an MCP client to connect to outside MCP servers for extra capabilities.How does it capture traffic from a phone or an IoT device?You point the device's Wi-Fi or gateway proxy at the built-in MITM proxy (default port 8888) and install the generated CA certificate; traffic from phones, smart home devices, or embedded systems then merges into the same session as browser traffic.
You point the device's Wi-Fi or gateway proxy at the built-in MITM proxy (default port 8888) and install the generated CA certificate; traffic from phones, smart home devices, or embedded systems then merges into the same session as browser traffic.Why not just use DevTools, Fiddler, or Wireshark?Those tools are siloed - DevTools only sees the browser, Fiddler/Charles only proxy traffic, and Wireshark cannot decrypt HTTPS - and none of them explain hundreds of captured requests for you; Anything Analyzer unifies every capture source into one session and hands it to an AI for automatic analysis.
Those tools are siloed - DevTools only sees the browser, Fiddler/Charles only proxy traffic, and Wireshark cannot decrypt HTTPS - and none of them explain hundreds of captured requests for you; Anything Analyzer unifies every capture source into one session and hands it to an AI for automatic analysis.What are similar projects?evenfire, astron-rpa, strix, casbin-gateway, Codex-X, openwhispr, Prism-Browser-Community, LobsterAI
evenfire, astron-rpa, strix, casbin-gateway, Codex-X, openwhispr, Prism-Browser-Community, LobsterAIWhich topics is it in?network-analysis, automation-tools, ai-tools, penetration-testing, node, websocket, reverse-engineering, electron, security-tools, sqlite, proxy, mcp-server
network-analysis, automation-tools, ai-tools, penetration-testing, node, websocket, reverse-engineering, electron, security-tools, sqlite, proxy, mcp-server