The Problem When a mobile or web app hits a protected API, each request carries a bundle of static credentials (bearer token, device ID, session cookie). Capturing this traffic once and replaying it is the fastest way to get an API client without reverse‑engineering the app. Developers still need a mechanism to record traffic, extract the auth bundle, and generate a usable Python library that can be imported and called like any other module.

What This Does mimic intercepts traffic, pulls the shared auth data, and outputs a pure‑Python client that exposes named methods for each endpoint.

  • mimic/cli.py is the user‑facing command line.
  • mimic/session.py implements Session, a thin wrapper over requests that auto‑refreshes stale tokens.
  • mimic/extract.py pulls auth values from mitmproxy flows or HAR files.
  • mimic/codegen.py consumes the extracted data and writes a self‑contained client module.
  • mimic/sources/*.py contain adapters for mitmproxy, cURL, and HAR files.
  • mimic/unpin.py sets up a Frida bypass for certificate‑pinning apps.

How It Is Wired The entry point is mimic/cli.py which uses argparse to dispatch subcommands: record, hosts, learn, gen, unpin, and doctor.

  1. record → mimic.sources.mitm.start_proxy() → spawns mitmproxy via uvx, writes flow JSON to a temporary file.
  2. hosts → mimic.extract.extract_hosts() → scans the flow JSON for distinct hostnames and prints them.
  3. learn <host> → mimic.extract.Extractor(host).run() → builds a list of endpoint signatures.
  4. gen <host> → mimic.codegen.generate_code(host, extractor) → writes hinge_client.py (or similar) to the current directory.
  5. unpin <ipa|bundle-id> → mimic.unpin.bypass() → installs a Frida script to override certificate checks.

Each subcommand touches the filesystem: flow JSON, generated client file, and log output. Network activity occurs only in Session methods (Session.get, Session.post, etc.) which are called by the generated client or directly by the user.

How To Use It

git clone https://github.com/moses-y/mimic
cd mimic
sh install.sh          # installs uv and registers the mimic CLI tool
mimic doctor           # verifies mitmproxy and Claude are available
mimic record           # starts the proxy and walks through iPhone configuration
mimic hosts            # list captured hosts, e.g. prod-api.hingeaws.net
mimic learn prod-api.hingeaws.net
mimic gen prod-api.hingeaws.net
# now a hinge_client.py file exists
python
>>> from hinge_client import Hinge
>>> Hinge().get_recommendations()

No additional environment variables are required beyond what uv uses.

Real‑World Use A data‑science team wants to pull the latest recommendations from a mobile‑only service. By running mimic record on a developer’s iPhone, they capture the bearer token. After mimic gen, the team imports the generated hinge_client.py, runs Hinge().get_recommendations(), and streams the data into a Jupyter notebook for analysis.

Code Health & Issues

  • Low – No lockfile (pyproject.toml only) → non‑reproducible dependency installs.
  • Medium – No CI/CD configuration → no automated build/test gate.
  • Low – Only two unit tests (tests/test_har.py) → limited coverage of extraction logic.
  • Low – Missing documentation for Session’s public API beyond the README.

The Bottom Line mimic provides a focused, pragmatic workflow for turning intercepted traffic into a reusable Python client. The code base is lightweight and easy to understand, but it lacks automated tests and reproducible builds. Teams that need quick access to a mobile‑only API and are comfortable managing dependency versions will benefit most.