What is this?
mimic intercepts traffic from any app (mobile or web) and turns it into a plain Python client you can call like a library — you capture one real request and an AI generates the named methods for you instead of you writing them by hand.
mimic intercepts traffic from any app (mobile or web) and turns it into a plain Python client you can call like a library — you capture one real request and an AI generates the named methods for you instead of you writing them by hand.Is this a CLI tool, a Python library, or both?Both: the mimic CLI records traffic and generates a client file, and that generated file is plain Python built on mimic.App that you import and edit like any normal module.
Both: the mimic CLI records traffic and generates a client file, and that generated file is plain Python built on mimic.App that you import and edit like any normal module.How do I install mimic and start capturing traffic?The installer sets up uv if you don't have it and installs mimic into an isolated tool env (or run `uv tool install mimic-client` manually); mitmproxy is launched automatically via uvx the first time you record, so there's no separate mitmproxy install step.
The installer sets up uv if you don't have it and installs mimic into an isolated tool env (or run `uv tool install mimic-client` manually); mitmproxy is launched automatically via uvx the first time you record, so there's no separate mitmproxy install step.Do I need to install mitmproxy myself before recording?No — mimic launches mitmproxy for you via uvx on first record, you just need to point your iPhone's proxy settings at your Mac and trust the mitmproxy certificate.
No — mimic launches mitmproxy for you via uvx on first record, you just need to point your iPhone's proxy settings at your Mac and trust the mitmproxy certificate.Does mimic work on apps that use certificate pinning or rotating DPoP tokens?Certificate pinning (banking apps, Instagram) blocks capture because the app rejects the mitmproxy cert, but mimic ships a Frida-based 'unpin' bypass for that. DPoP / sender-constrained tokens are a dead end: each request carries a fresh proof signed by a key that never leaves the device, so captured requests simply don't replay.
Certificate pinning (banking apps, Instagram) blocks capture because the app rejects the mitmproxy cert, but mimic ships a Frida-based 'unpin' bypass for that. DPoP / sender-constrained tokens are a dead end: each request carries a fresh proof signed by a key that never leaves the device, so captured requests simply don't replay.Can I capture traffic from web apps too, or only iOS?iOS apps go through mitmproxy by default, but for web apps you can skip the proxy entirely: copy a request as cURL from devtools into Session.fromcurl(), or export a HAR file from the browser's Network tab and run mimic against it.
iOS apps go through mitmproxy by default, but for web apps you can skip the proxy entirely: copy a request as cURL from devtools into Session.fromcurl(), or export a HAR file from the browser's Network tab and run mimic against it.Is it okay to point mimic at any app's traffic?mimic is meant for replaying your own session on your own account, not for accessing someone else's data, and you're expected to follow each app's terms of service.
mimic is meant for replaying your own session on your own account, not for accessing someone else's data, and you're expected to follow each app's terms of service.What happens if my auth token rotates mid-session?A 401 on an idempotent request triggers one automatic re-pull from mitmweb and a retry. Non-idempotent requests (like POSTs) are only retried if you explicitly pass refresh=True.
A 401 on an idempotent request triggers one automatic re-pull from mitmweb and a retry. Non-idempotent requests (like POSTs) are only retried if you explicitly pass refresh=True.Can I build a client by hand instead of using the AI codegen?Yes — mimic.App exposes .get(), .post() and other HTTP verb helpers that return parsed JSON and raise requests.HTTPError on failure, so you can assemble a session manually without generating any code.
Yes — mimic.App exposes .get(), .post() and other HTTP verb helpers that return parsed JSON and raise requests.HTTPError on failure, so you can assemble a session manually without generating any code.What does `mimic unpin` do?It sets up a Frida-based bypass for apps that use certificate pinning, so the mitmproxy certificate can be trusted and traffic becomes visible for capture.
It sets up a Frida-based bypass for apps that use certificate pinning, so the mitmproxy certificate can be trusted and traffic becomes visible for capture.Why use mimic instead of reverse-engineering the API myself?Most mobile APIs reuse the same stable bundle (bearer token, device IDs, session ID) across calls; mimic captures that once from a real request and has an AI generate named methods and multi-step call chains, skipping the manual reverse-engineering work.
Most mobile APIs reuse the same stable bundle (bearer token, device IDs, session ID) across calls; mimic captures that once from a real request and has an AI generate named methods and multi-step call chains, skipping the manual reverse-engineering work.Which topics is it in?certificate, mitm, http-client, code-generation, hacking, http, reverse-engineering, cybersecurity, security-tools, proxy, rest-api, mobile
certificate, mitm, http-client, code-generation, hacking, http, reverse-engineering, cybersecurity, security-tools, proxy, rest-api, mobile