fiddler-mcp

# fiddler-mcp MCP server for HTTP/HTTPS proxy capture and credential extraction. The proxy **auto-starts** when needed - just use the tools and the proxy comes up automatically. ## Use Cases - **Capture API credentials**: Intercept browser traffic to extract API keys, Bearer tokens, and cookies - **Reverse engineer APIs**: Record HTTP flows from any application to understand API structure - **Replay requests**: Capture a working request and replay it with modifications - **Access authenticated APIs**: Use credentials captured from browser sessions to make API calls through Claude ## Prerequisites - **mitmproxy**: Install with `brew install mitmproxy` (macOS) or `pip install mitmproxy` - **Node.js**: v18+ ## Quick Start 1. **Restart Claude** to load the MCP (already registered in `~/.claude/user-mcps.json`) 2. **Use any fiddler tool** - the proxy auto-starts: ``` list_flows # Proxy starts automatically on port 8080 ``` 3. **Configure your browser** to use proxy `127.0.0.1:8080` 4. **Install HTTPS cert** (one-time): Visit http://mitm.it in your proxied browser 5. **Browse normally** - all traffic gets captured 6. **Extract and use credentials**: ``` extract_credentials: { domain: "api.example.com" } make_request: { url: "https://api.example.com/data", use_credentials_from: "api.example.com" } ``` ## Available Tools | Tool | Description | |------|-------------| | `start_proxy` | Manually start proxy (optional - auto-starts when needed) | | `stop_proxy` | Stop the proxy | | `proxy_status` | Check proxy status and flow count | | `list_flows` | List captured HTTP flows (auto-starts proxy) | | `get_flow` | Get full details of a specific flow | | `extract_credentials` | Extract all auth tokens, API keys, cookies (auto-starts proxy) | | `replay_request` | Replay a captured request | | `make_request` | Make a request using captured credentials | | `clear_flows` | Clear all captured flows | | `export_flows` | Export flows to JSON or HAR format | | `setup_proxy_cert` | Get CA certificate installation instructions | ## How It Works 1. The MCP uses **mitmdump** (headless mitmproxy) as the capture engine 2. All captured flows are stored in `~/.fiddler-mcp/flows.json` 3. When you call `list_flows` or `extract_credentials`, the proxy auto-starts if not running 4. Credentials are extracted from Authorization headers, API-Key headers, and cookies ## Security Note This tool is designed for legitimate use cases: - Debugging your own APIs - Capturing credentials for services you own/have permission to access - Development and testing ## Troubleshooting ### HTTPS not being captured 1. Install the mitmproxy CA certificate (visit http://mitm.it with proxy configured) 2. Trust the certificate in your system keychain 3. For Firefox, import via Settings > Privacy & Security > Certificates ### Proxy won't start - Check if port 8080 is already in use - Try a different port: `start_proxy: { port: 8888 }` ### mitmproxy not found - Install with: `brew install mitmproxy` (macOS) or `pip install mitmproxy`