Skip to main content
Glama
lucasoeth

mitmproxy-mcp MCP Server

by lucasoeth

mitmproxy-mcp MCP server

A MCP server project

Components

Resources

The server implements a simple note storage system with:

  • Custom note:// URI scheme for accessing individual notes

  • Each note resource has a name, description and text/plain mimetype

Prompts

The server provides a single prompt:

  • summarize-notes: Creates summaries of all stored notes

    • Optional "style" argument to control detail level (brief/detailed)

    • Generates prompt combining all current notes with style preference

Tools

The server implements one tool:

  • add-note: Adds a new note to the server

    • Takes "name" and "content" as required string arguments

    • Updates server state and notifies clients of resource changes

Related MCP server: Datetime MCP Server

Configuration

[TODO: Add configuration details specific to your implementation]

Quickstart

Install

Claude Desktop

On MacOS: ~/Library/Application\ Support/Claude/claude_desktop_config.json On Windows: %APPDATA%/Claude/claude_desktop_config.json

Development

Building and Publishing

To prepare the package for distribution:

  1. Sync dependencies and update lockfile:

uv sync
  1. Build package distributions:

uv build

This will create source and wheel distributions in the dist/ directory.

  1. Publish to PyPI:

uv publish

Note: You'll need to set PyPI credentials via environment variables or command flags:

  • Token: --token or UV_PUBLISH_TOKEN

  • Or username/password: --username/UV_PUBLISH_USERNAME and --password/UV_PUBLISH_PASSWORD

Debugging

Since MCP servers run over stdio, debugging can be challenging. For the best debugging experience, we strongly recommend using the MCP Inspector.

You can launch the MCP Inspector via npm with this command:

npx @modelcontextprotocol/inspector uv --directory /Users/lucas/Coding/mitmproxy-mcp run mitmproxy-mcp

Upon launching, the Inspector will display a URL that you can access in your browser to begin debugging.

Available Tools

4 tools
analyze_protectionC

Analyze flow for bot protection mechanisms and extract challenge details

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYesThe ID of the session
flow_indexYesThe index of the flow to analyze
extract_scriptsNoWhether to extract and analyze JavaScript from the response (default: true)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions analyzing and extracting details, but fails to describe key traits such as whether this is a read-only operation, potential side effects, performance considerations (e.g., time-intensive due to script extraction), or error handling. This leaves significant gaps in understanding how the tool behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose without unnecessary words. Every part earns its place by clearly stating the action and target, making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of analyzing bot protection mechanisms and the lack of annotations and output schema, the description is incomplete. It doesn't explain what 'challenge details' include, how results are returned, or any limitations (e.g., only works with certain flow types). For a tool with no structured behavioral or output information, more context is needed to be fully helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents all three parameters. The description adds no additional meaning beyond what's in the schema (e.g., it doesn't explain how 'session_id' or 'flow_index' relate to protection analysis). With high schema coverage, the baseline score of 3 is appropriate as the description doesn't compensate but also doesn't detract.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('analyze', 'extract') and resources ('flow', 'bot protection mechanisms', 'challenge details'), making it easy to understand what the tool does. However, it doesn't explicitly differentiate from sibling tools like 'get_flow_details' or 'list_flows', which might also analyze or extract information from flows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'get_flow_details' or 'extract_json_fields'. It lacks context on prerequisites (e.g., needing a session or flow index), exclusions, or specific scenarios where this tool is preferred, leaving usage decisions ambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extract_json_fieldsC

Extract specific fields from JSON content in a flow using JSONPath expressions

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYesThe ID of the session
flow_indexYesThe index of the flow
content_typeYesWhether to extract from request or response content
json_pathsYesJSONPath expressions to extract (e.g. ['$.data.users', '$.metadata.timestamp'])

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the tool extracts fields but doesn't describe what happens if JSON content is missing, invalid, or if JSONPath expressions fail. It lacks details on permissions, rate limits, or output format, leaving key behavioral traits unspecified for a tool that manipulates data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose ('extract specific fields from JSON content in a flow') and method ('using JSONPath expressions'). There is no wasted text, and it directly communicates the tool's function without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of a 4-parameter tool with no annotations and no output schema, the description is incomplete. It doesn't explain the return values, error handling, or behavioral nuances like what happens with invalid inputs. For a tool that processes JSON data, more context on output format and limitations is needed to be fully helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all four parameters. The description adds minimal value beyond the schema by mentioning 'JSON content in a flow' and 'JSONPath expressions', which align with parameters like 'content_type' and 'json_paths'. However, it doesn't provide additional syntax, examples, or constraints beyond what's in the schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('extract specific fields') and resource ('JSON content in a flow'), specifying the method ('using JSONPath expressions'). It distinguishes from sibling tools like 'get_flow_details' or 'list_flows' by focusing on field extraction rather than retrieval or analysis. However, it doesn't explicitly contrast with 'analyze_protection', which might involve similar data handling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention prerequisites (e.g., needing a valid session or flow), exclusions, or compare to siblings like 'analyze_protection' for JSON analysis. Usage is implied only by the action, with no explicit context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_flow_detailsC

Lists HTTP requests/responses from a mitmproxy capture session, showing method, URL, and status codes

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYesThe ID of the session
flow_indexesYesThe indexes of the flows
include_contentNoWhether to include full content in the response (default: true)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes the tool as listing data, implying a read-only operation, but doesn't cover critical aspects like whether it's safe (e.g., no side effects), performance characteristics (e.g., handling of large datasets), or error conditions. For a tool with no annotation coverage, this is a significant gap in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that directly states the tool's purpose without unnecessary details. It is front-loaded and wastes no words, making it easy for an agent to parse quickly and understand the core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of handling HTTP flows and the lack of annotations and output schema, the description is incomplete. It doesn't explain the return format (e.g., structure of listed data), potential limitations (e.g., pagination or size constraints), or how parameters like 'include_content' affect behavior. For a tool with 3 parameters and no structured output, more context is needed for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage, clearly documenting all parameters. The description adds no additional meaning beyond the schema, such as explaining parameter interactions or usage nuances. With high schema coverage, the baseline score is 3, as the description doesn't compensate but also doesn't detract from the schema's information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Lists HTTP requests/responses from a mitmproxy capture session, showing method, URL, and status codes.' It specifies the verb ('Lists'), resource ('HTTP requests/responses'), and scope ('from a mitmproxy capture session'), making the function evident. However, it doesn't explicitly differentiate from sibling tools like 'list_flows', which might have overlapping functionality, preventing a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It doesn't mention sibling tools like 'list_flows' or specify contexts, prerequisites, or exclusions for usage. This lack of comparative or contextual advice leaves the agent without clear direction for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_flowsC

Retrieves detailed HTTP request/response data including headers, content (or structure preview for large JSON), and metadata from specified flows

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYesThe ID of the session to list flows from

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions retrieving 'detailed HTTP request/response data' including headers, content, and metadata, but lacks critical behavioral details such as whether this is a read-only operation, potential rate limits, error handling, or how large JSON is handled ('structure preview'). This leaves significant gaps for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the key action ('Retrieves detailed HTTP request/response data'). It could be slightly more structured by separating scope details, but it avoids unnecessary fluff and earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is incomplete. It hints at behavioral aspects like handling 'large JSON' but doesn't fully explain return values, error cases, or operational constraints. For a tool with no structured support, more detail is needed to guide an agent effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the single parameter 'session_id' adequately. The description adds no additional meaning or context about the parameter beyond what the schema provides, such as format examples or how to obtain a session_id. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Retrieves') and resource ('detailed HTTP request/response data from specified flows'), making the purpose understandable. However, it doesn't explicitly differentiate from sibling tools like 'get_flow_details' or 'analyze_protection', which might have overlapping functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'get_flow_details' or 'analyze_protection'. The description mentions retrieving data from 'specified flows' but doesn't clarify prerequisites, such as needing a valid session_id or how this differs from other flow-related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.2/5.0
Disambiguation3/5

The tools have some overlap that could cause confusion. 'get_flow_details' and 'list_flows' both retrieve HTTP flow data, with 'get_flow_details' focusing on method/URL/status and 'list_flows' providing headers/content/metadata—these boundaries are unclear and might lead to misselection. However, 'analyze_protection' and 'extract_json_fields' are clearly distinct, targeting bot protection analysis and JSON field extraction respectively.

Naming Consistency4/5

The naming is mostly consistent with a verb_noun pattern, using snake_case throughout. 'analyze_protection', 'extract_json_fields', and 'list_flows' follow this well, but 'get_flow_details' deviates slightly by using 'get' instead of a more descriptive verb like 'show' or 'retrieve', which is a minor inconsistency in an otherwise predictable set.

Tool Count5/5

With 4 tools, the count is well-scoped for a mitmproxy server focused on HTTP flow analysis. Each tool appears to serve a distinct purpose within this domain, such as listing flows, analyzing protections, and extracting data, making the set neither too sparse nor overloaded for the intended functionality.

Completeness3/5

The tool surface has notable gaps for a mitmproxy domain. It covers flow retrieval, protection analysis, and JSON extraction, but lacks operations for modifying or intercepting flows (e.g., add, edit, block), which are core to proxy functionality. Agents can work around this by using existing tools for analysis, but the absence of manipulation tools limits completeness.

Maintenance

ActivityInactive
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Appeared in Searches

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/lucasoeth/mitmproxy-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server