The archive · Developer & Business Tools · Product decision · 2022–2026
Mitmproxy2swagger bets app traffic can auto-write API specs; HN 691 pts, 9.6k stars
An open-source Python tool turns captured app traffic into OpenAPI 3.0 specs, so undocumented REST APIs get reverse-engineered just by running the app.
mitmproxy2swagger
What the business is
A free MIT-licensed open-source Python tool that converts mitmproxy traffic captures — and HAR files exported from browser DevTools — into OpenAPI 3.0 specifications, letting developers reverse-engineer undocumented REST APIs by running an app and capturing its traffic.
How it started
Developer alufers released mitmproxy2swagger as open source and posted it to Hacker News on 2022-05-12, where it drew 691 points and 85 comments. The pitch was that undocumented REST APIs could be reverse-engineered by just running the app through mitmproxy, saving the flows, and pointing the tool at them to emit an OpenAPI 3.0 specification.
What happened
The project kept evolving after launch: it added support for HAR files exported from browser DevTools (so APIs could be documented without a proxy at all), a Docker install path, options to include example payloads and headers, and safe merging of multiple captures into an existing schema. The README also shows generated documentation rendered via redoc-cli, and by 2026 the repository had 331 commits and an active toolchain (uv, pytest, prek linters).
No ending yet — it is still running.
Background
mitmproxy2swagger is a bet that REST API documentation is a solved problem once you treat captured traffic as the source of truth. The free open-source tool, released by developer alufers, converts mitmproxy flow captures into OpenAPI 3.0 specifications, which means an undocumented API can be reverse-engineered by running its app, capturing the traffic, and letting the tool write the schema.
The design is deliberately two-pass. The first pass scans a capture and emits a schema whose every discovered path starts with an 'ignore:' prefix; the developer edits that file to keep the endpoints they care about. The second pass then regenerates the schema with full request and response descriptions built from real captured examples, merging safely with any existing schema so repeated captures accumulate coverage. Later releases added HAR support, so APIs called from a browser could be documented straight from DevTools exports without a proxy.
Posted to Hacker News as a Show HN on 2022-05-12, the project drew 691 points and 85 comments — a level of attention that marked it as one of that week's most popular developer tools. It stayed a one-person open-source project rather than a company: no pricing page, no venture funding, no commercial tier.
By 2026-09-05 the repository had grown to 9.6k stars, 374 forks and 331 commits, with the README describing an actively maintained toolchain. The bet that developers would rather generate API specs from real traffic than read minified client code held up as a tool, even though it never became a business.
What has to be true
- Captured traffic is ground truth: an app's real requests include endpoints, parameters, headers and examples that documentation often omits or gets wrong.
- The two-pass workflow gives automation room to be wrong cheaply — the developer edits a generated list of endpoints instead of writing schemas by hand.
- Adding HAR support removed the proxy requirement and widened the tool from mobile-app reverse engineering to any browser-driven API.
- The 691-point Show HN on 2022-05-12 showed the pain was widespread; sustained growth to 9.6k GitHub stars over four years confirmed the tool kept earning attention.
What can be applied
Automate the boring parts but keep one human checkpoint: a first pass that proposes endpoints and a second that fills details lets one developer document an entire API with minutes of judgment.
Aftermath
As of 2026-09-05, mitmproxy2swagger remains live as a free, MIT-licensed open-source project maintained by alufers. The GitHub repository read 9.6k stars, 374 forks and 331 commits on that date, with support for both mitmproxy captures and HAR exports, example-generation flags, Docker installation and an active test and linting setup. It never became a commercial product or company, and no revenue or funding information exists in the public record.
Sources
spotted an error? The archive wants to know.
Your turn
You just read one. Describe what you are building, and see who is betting on the same thing.
Free account · 3 free questions · no card