mrbrutti/aitmproxy
aitmproxy — an intercepting proxy for authorized security testing. Capture, inspect, intercept and mutate, replay, and turn traffic into findings and proof-of-concept exploits, driven over MCP.
Build reproducible PoCs and record findings in aitmproxy during an AUTHORIZED security test. Use when the user has confirmed a vulnerability in captured/manipulated traffic and wants to turn it into a parameterized YAML PoC, run it with no agent to produce artifacts, and record a human-readable finding. Covers poc.build, poc.run, poc.list/get/artifact, findings.record/list/get, and the operator gate on agent-run PoCs.
Find and triage captured traffic in aitmproxy during an AUTHORIZED security test. Use when the user wants to list, filter, inspect, annotate or export captured HTTP/WebSocket flows — browse with flow.table, drill into one with flow.detail, mark and comment interesting flows, subscribe to live traffic, and export to native JSON or HAR. Covers flow.table vs flow.detail, filtering, marks/comments, and export/HAR.
Intercept and mutate live traffic in aitmproxy during an AUTHORIZED security test. Use when the user wants to park in-flight HTTP requests or responses and edit them, tamper WebSocket frames, replay or craft requests, or drop/kill a connection. Covers arming interception (flow.intercept, ws.intercept), editing parked flows (flow.mutate, flow.resume, flow.kill, ws.frame, ws.send), active egress (flow.replay, request.send) and the scope gating that guards it; tells HTTP interception apart from the Linux-only l4.intercept.* packet verdicts.
Drive aitmproxy — the intercepting HTTP/WebSocket proxy for AUTHORIZED security testing — end to end over MCP. Use when the user wants to inspect captured web traffic, intercept and mutate live requests or responses, replay or craft requests, or build reproducible PoCs and record findings against an engagement they are authorized to test. Explains the capture → intercept → replay → findings workflow, names the key MCP tools per stage, the scope gating and agent policy, the per-host decryption model (Scope is the decryption list; every CONNECT is a row), the raw L4 (TCP/UDP) packet family and its status/scope/gate rules when the core enables it, and how output renders across hosts.
Present aitmproxy MCP tool output cleanly in a text-only host such as Claude Code, which sees the tool's structuredContent JSON and renders no widget. Use whenever you call an aitmproxy tool (flow.table, flow.detail, findings.list, findings.get, proxy.status, scope.list, poc.run) and must show the result to the operator. Teaches turning structuredContent into tight markdown tables with short text badges for HTTP method, status class and finding severity, matching the widget palette.