apiless

One-shot integrations with web apps that have no API.

Give apiless a URL and a login. An autonomous agent explores the app in a real Chrome window while every network request is recorded, reverse-engineers the app's internal API from that traffic, verifies each endpoint by replaying it, and hands you an MCP server with one tool per endpoint: list_reservations, get_messages, send_message…

export ANTHROPIC_API_KEY=…
export APILESS_USERNAME=me@example.com APILESS_PASSWORD=…

# Targeted: say what you need
npx apiless explore https://app.example.com "read guest messages and reply to them"

# Or no instructions: the agent maps and covers the whole app (this can take hours)
npx apiless explore https://app.example.com

# Serve the result to any MCP client
npx apiless serve integrations/app.example.com

// e.g. Claude Code / Claude Desktop MCP config
{ "mcpServers": { "example": { "command": "npx", "args": ["apiless", "serve", "/abs/path/integrations/app.example.com"],
  "env": { "APILESS_USERNAME": "…", "APILESS_PASSWORD": "…" } } } }

Requires Node ≥ 22.13 and Google Chrome. Not on npm yet: until it is, replace npx apiless with npx github:pkrzekotowski/apiless.

The app

npx apiless ui

opens a local app in your browser (it listens on 127.0.0.1 only and the link carries a one-time token). It does everything the CLI does, with a screen for each part of the job:

• Integrations and New integration: URL, login, goal, write policy, model, budget cap.

• Live run: the agent's activity feed (each action with the API requests it triggered), a live view of its Chrome window, and the catalog filling in as endpoints are found and verified. Steer it by typing at any time. When the site wants a CAPTCHA or 2FA code, a banner asks you to complete it in the browser window; when the agent wants a real write, a dialog shows the exact request and you allow or deny it.

• Catalog and Endpoint: parameters, a captured request example with secrets masked, the inferred response schema, and Try it (writes ask for confirmation first).

• Auth & session: how login works on the site, session health over 14 days, and which step of the renewal ladder was last needed.

• Traffic: every captured request, grouped by the action that caused it, searchable by path, header or body.

• Connect: copy-paste MCP config for Claude Desktop, Claude Code and Cursor.

• Settings: API key and site credentials go to the macOS keychain (a user-only file elsewhere); defaults; delete all captured data.

Integrations made in the app live in ~/.apiless/integrations/ (--data <dir> changes that). The CLI's explore defaults to ./integrations/<host>; pass --dir to share one location.

Related MCP server: Clarity MCP Server

How it works

             ┌──────────────────────── explore ────────────────────────┐
 you ⇄ agent │ Chrome (persistent profile) ── CDP ──▶ traffic.db       │
 (steer any  │   ▲ navigate / click / type             │               │
  time)      │   │                        deterministic analysis       │
             │ Claude Agent SDK ◀── endpoints, schemas, dependencies   │
             │   │ save_endpoint / set_auth_model / test_endpoint      │
             └───▼─────────────────────────────────────────────────────┘
              catalog.json ──▶ apiless serve ──▶ MCP tools
                                   └─ session broker: HTTP → headless renew → form login → human

• Explore: run apiless explore <url> "optional instructions". A Claude agent drives a real Chrome window with a persistent profile. Every request is recorded to SQLite with full request and response bodies, the real cookies and WebSocket frames. Each request is linked to the click that triggered it.

• Analyze: the code groups requests into endpoints, handles GraphQL operations, and infers schemas from the samples. The model only names and documents the endpoints.

• Verify: each endpoint is replayed over plain HTTP. If the server rejects that, it is replayed from inside the logged-in page, and the working method is saved with the endpoint.

• Learn write endpoints safely: the agent submits a form in a dry-run mode. The outgoing request is captured and aborted before it reaches the server, so a real guest never gets a test message.

• Keep secrets away from the model: credentials are filled in by name, and cookies and tokens are masked as placeholders in everything the model reads.

• Serve: apiless serve <dir> runs the catalog as an MCP server. When a session expires it escalates step by step:

  1. It tries the stored cookies.

  2. It makes a headless visit with the saved profile.

  3. It uses the recorded login form.

  4. It opens a visible window for you only as a last resort.

• Steer: type in the terminal mid-run to redirect the agent; your message is fed straight into the running session.

Notes and the catalog persist on disk; --resume <sessionId> continues a run.

Under the hood

1. Capture. Chrome is driven through Playwright; a separate CDP session records every request with full bodies, the real cookies (including HttpOnly), WebSocket frames, and the JS initiator. API responses are paused for an instant so bodies can never be evicted before they are read. Everything is appended to SQLite as it happens, so a crash five hours in loses nothing. No MITM proxy: the browser already sees everything decrypted, and a proxy would change the TLS fingerprint.

2. Attribute. Each request is tied to the UI action that caused it ("this POST is what Archive does"), which is what makes naming endpoints reliable.

3. Analyse deterministically. Requests are clustered into path templates (/api/reservations/{reservationId}), GraphQL is split by operation, and request/response schemas are merged across all samples (optional fields, enums, formats). The model reads these summaries instead of guessing structure from raw bodies.

4. Model auth. The agent traces where each session value comes from (cookie, localStorage, meta tag, earlier response) and records it, so replay outside the browser sends the right CSRF/bearer headers.

5. Verify. Every endpoint is replayed over plain HTTP and compared with the shape the app received. If the server rejects plain HTTP, the call is executed from inside the logged-in page instead, and the endpoint is pinned to that tier.

6. Serve. apiless serve exposes the catalog over MCP and keeps the session alive on its own (see below).

Safety model

• Credentials never reach the model. The agent fills them by name (fill_credential); cookies, tokens and passwords are masked as «placeholders» in everything the model reads, and endpoint definitions containing a placeholder are rejected.

• Writes are opt-in. --writes never | ask (default) | allow. Clicks whose label suggests a change (delete, send, pay, confirm…) are refused unless declared as a write.

• Dry-run writes. To learn a create/update/delete/send endpoint, the agent submits the form in write_dry_run mode: the outgoing request is captured and aborted before it reaches the server. You get method, URL, headers and body shape without touching real data. Such endpoints stay unverified until you approve one real test.

• Humans handle human checks. On CAPTCHA, 2FA or a new-device email the agent pauses and asks you to complete it in the visible window. apiless does not solve CAPTCHAs or spoof fingerprints; it relies on a real headed Chrome with a persistent profile and human-like pacing.

• Prompt-injection hygiene. The agent has no file, shell or web tools, only the browser and catalog tools, and is told that page content is data, not instructions.

Staying connected

The served integration has to survive expired sessions without anyone watching. The session broker escalates only as far as needed:

1. plain HTTP with the exported cookies and session headers,

2. a headless visit with the saved Chrome profile to renew them,

3. the login form (recorded automatically during exploration) with APILESS_USERNAME / APILESS_PASSWORD,

4. a visible window for a person, as the last resort (--no-human disables this for servers and CI).

Workspace

integrations/<host>/
  catalog.json   # the deliverable: auth model + endpoints. Safe to commit and share.
  notes.md       # the agent's site map and exploration frontier
  traffic.db     # everything captured (contains secrets; gitignored)
  session.json   # exported cookies/tokens (secrets; gitignored)
  profile/       # Chrome profile (secrets; gitignored)
  run.log        # redacted transcript of tool calls

apiless endpoints <dir> [--schemas] prints what was observed and what is in the catalog.

Options

Limitations and roadmap

• Requests signed in JavaScript or guarded by anti-bot sensors cannot be replayed over plain HTTP; they fall back to the in-browser tier, which needs Chrome running.

• Traffic from service workers and cross-origin iframes is not captured yet.

• WebSocket frames are captured and shown to the agent, but realtime subscriptions are not yet exposed as MCP tools (poll the list endpoint instead).

• Planned: typed TypeScript client and OpenAPI export from catalog.json; drift detection (apiless check) that re-verifies endpoints on a schedule and re-learns the ones that changed; parallel exploration with sub-agents; JS-bundle analysis for routes never triggered in the UI.

Responsible use

apiless is for integrating with your own accounts and data where the vendor offers no API. Internal APIs change without notice, and some services prohibit automated access in their terms: check them, keep request rates human, and do not use this to access data you are not entitled to.

Development

npm install
npm run build                  # CLI to dist/, app to dist/app
npm test                       # unit + end-to-end tests against a local fixture app in headless Chrome (no LLM needed)
npx tsx test/run-fixture.ts    # start the fixture app to try `explore` against it
npm run dev -- explore http://127.0.0.1:<port> --writes never

# working on the app: API on 4174, Vite dev server with hot reload on 5173
npm run dev -- ui --port 4174 --no-open      # prints a link with #token=…; open it on port 5173 instead
npm run dev:ui
npx tsx test/seed-demo.ts /tmp/apiless-demo http://127.0.0.1:<port>   # a realistic integration without spending on a model

design/ref/ holds the Claude Design export the landing page (site/) and the app (ui/) were built from.

See RESEARCH.md for why it is built this way and HANDOFF.md for current status and what is not yet verified.

MIT licensed.