Table of Contents

• About The Project
  • Built With
• Getting Started
  • Prerequisites
  • Installation
  • Portable Bundle
• Usage
  • How Capture Works
  • Local Automation
• Security and Data
• Documentation
• Development
• Roadmap and Validation
• Contributing
• Support the Project
• License
• Acknowledgments

About The Project

Mobile API Studio helps mobile developers inspect what their app sends, reproduce a failing request, test response changes, and compare behavior between sessions. Start with an iOS Simulator or Android Emulator; additional capture targets depend on the host and capture mode.

Source status: All eight expansion milestones are integrated on main through PRs #19–26. Recorded bounded Simulator/Emulator HTTP(S), protocol, proxy recovery and network-profile checks passed, alongside Linux container/Cloud userspace checks and Windows cross-compilation. Mac process capture, physical devices, native Windows/Linux capture and the final rendered gRPC/Connection Doctor check were owner-excluded and remain unverified. See the completion review and acceptance record. No signed installer or certified public release is offered.

Built With

• Rust and Axum — local service, capture coordination, replay and comparison.
• React, TypeScript and Vite — browser workspace.
• SQLite — local sessions, metadata and workspace persistence.
• mitmproxy / mitmdump — capture engine with the repository's Python bridge.
• Swift Package and Kotlin/OkHttp — optional development SDKs.
• QuickJS — isolated JavaScript rule workers.

The localhost service is the current entry point. The earlier Tauri source remains for historical parity comparison. See the architecture.

Back to top

Getting Started

Build from source or create a portable bundle for your host. No prebuilt release is currently published. macOS has recorded bounded mobile runtime checks; Linux userspace builds and Windows GNU cross-compilation have narrower evidence. Consult the platform support matrix before choosing a host.

Prerequisites

iOS Simulator workflows require macOS. Windows native runtime and Linux host capture remain unverified; additional mode-specific permissions are documented in Platform support.

Installation

Clone the repository, then install its locked JavaScript dependencies:

git clone https://github.com/DagerottDev/mobile-api-studio.git
cd mobile-api-studio
pnpm install --frozen-lockfile

On macOS or Linux, start the workspace from the repository root:

./scripts/run-local.sh

On Windows PowerShell:

.\scripts\run-local.ps1

Both launchers build the React UI and QuickJS worker, then compile and start the Rust service. Open the printed URL if the browser does not open automatically; the default is http://127.0.0.1:8180. Capture and SDK ingestion use 8181 and 8182.

To use another UI port, a separate data directory, and open the browser yourself:

./scripts/run-local.sh --port 8191 --data-dir /absolute/path/to/separate-workspace --no-open

The PowerShell launcher accepts the same flags. Changing --port changes only the UI port. Run one service per workspace and keep the earlier desktop app closed when using the same data directory. Stop with Ctrl+C to end capture and restore supported Android or automatic Simulator proxy settings. Source launchers need the checkout assets to remain in place.

If mitmdump is not on PATH, the service can discover a standard Homebrew install, or you can set its absolute path in Settings. No AI provider or sharing service is required for local debugging.

Portable Bundle

After installing the prerequisites and dependencies, choose an empty output directory:

python3 scripts/package-local.py /absolute/path/to/empty-bundle
/absolute/path/to/empty-bundle/start.sh

Windows uses the bundle's start.ps1. The bundle includes the service, worker, UI, capture addon and CLI, and can run outside the checkout. Python, mitmdump and device tools remain separate host prerequisites. Packaging does not produce a signed installer. See Platform support.

Back to top

Usage

How Capture Works

1. Boot an iOS Simulator or Android Emulator and run your development app.
2. Open Connect and select the runtime. For iOS automatic routing, select the current Mac network service and choose Set up Simulator & start capture; approve macOS network authorization if prompted. Android uses Start capture with its CA guidance.
3. Generate a request in your app. Open Traffic, select the session, and inspect its headers, body, timing, TLS and errors.
4. Open Replay to edit and resend a captured request to a server you control. Use Mocks, Network and Compare to change responses, simulate conditions and compare sessions.
5. For automatic iOS capture, Disable routing restores prior Mac proxy settings while keeping the session open; Enable routing resumes routing. Disconnect restores supported settings and ends capture. Remove manually configured proxies when ending a manual workflow.

Automatic Simulator routing temporarily changes HTTP/HTTPS proxies on the selected Mac network service and can also route other proxy-aware Mac apps. The CA is installed only in the selected Simulator. Existing active proxies/PAC block automatic setup. Uncheck Set up Mac network routing automatically for a manual app-scoped workflow. The SDK adds context; it does not automatically route every custom URLSession through a regular proxy. See Simulator setup for trust, scope and recovery.

Android HTTPS requires development CA trust; prefer app-scoped debug trust. Android API 37 also needs the appropriate local-network permission. Apps with certificate pinning need their own debug configuration; Mobile API Studio does not bypass pinning. Optional SDK integration adds app, screen, feature and source context.

Open Settings → Connection Doctor for prerequisite, routing and TLS diagnostics. HTTP/3 is limited to supported local/reverse modes and has no Replay support. WebSocket replay and ping/pong payload inspection are unavailable; Protobuf decoding requires your descriptor and supports bounded uncompressed messages. See Protocol inspection for details, including engine-specific trailer limits.

Local Automation

With the service running, use another terminal from the repository root:

printf '{}' | python3 scripts/mas-cli.py health
printf '{}' | python3 scripts/mas-cli.py list_sessions

The CLI uses a private Unix socket on macOS/Linux or a current-user named pipe on Windows. MCP clients can run python3 /absolute/path/to/repository/scripts/mas-cli.py --mcp. Arguments come from stdin; custom socket paths, supported commands and JavaScript hook examples are in Scripting and automation and the usage guide.

Back to top

Security and Data

Traffic and workspace data stay on your computer by default. Replay sends requests to your chosen target; sharing and AI require explicit preview and send. Signing in starts no capture or background synchronization. Redaction covers known secrets, but bodies and scripts can contain application secrets that need your review.

The browser service binds only to 127.0.0.1, checks Host and Origin, and requires a process-lifetime command token held in browser memory, outside URLs and logs. Optional paired LAN capture listeners have separate controls; they do not expose the browser API.

Default workspace locations:

Back up app.db with the service stopped before schema migrations. Settings imports a selected JSON workspace file and exports a redacted bundle. After a forced stop, use Connect's pending rollback recovery control before another capture; recovery preserves unexpected external proxy changes. CA private material stays local and is omitted from normal exports.

Read Security and privacy for implemented boundaries and pending security/release review. Report vulnerabilities through SECURITY.md.

Back to top

Documentation

Back to top

Development

After installing dependencies, these contributor commands are available from the repository root:

pnpm typecheck
pnpm build
cargo check --workspace --locked
cargo test -p mobile-api-studio-server --locked
cargo test -p app-core --locked

These are local checks; the repository has no CI gate. Match checks to the change and record what you actually verified. The launcher also builds the separate script worker. Focused runtime scripts in scripts/ have their own fixture and environment requirements; consult the local validation record and platform acceptance record before running them.

Back to top

Roadmap and Validation

The roadmap records completed implementation Phases 0–5 and the eight integrated expansion milestones. Phases 0–5 were merged without automated tests or CI as phase gates. Later migration and expansion work has focused deterministic checks and bounded runtime/browser evidence; it does not retroactively validate those implementation phases.

The owner controls the separate final validation and release decision. Physical-device, Mac process, native Windows/Linux capture and the final rendered gRPC/Connection Doctor checks remain unverified after exclusion from the acceptance run. Cross-builds and userspace containers do not substitute for native device acceptance.

Documented deferred scope includes deeper OpenAPI workflows, a plugin marketplace, production APM integration and signed release/update infrastructure. See the completion review for conditional features and the completed acceptance scope.

Back to top

Contributing

Read CONTRIBUTING.md for focused branches, pull request expectations and validation policy. Use issues to report reproducible defects or discuss features, and include the platform and checks performed in your pull request. Keep credentials, captured private traffic and certificate keys out of issues and contributions.

Back to top

Support the Project

• Buy Me a Coffee — international support.
• Buy DagerottDev a Chai on Bondin — support from India.

Support is optional. Contributions, bug reports and documentation improvements are welcome too.

Back to top

License

Mobile API Studio is licensed under the Apache License 2.0. Third-party dependencies retain their own licenses.

Back to top

Acknowledgments

• mitmproxy for the capture engine.
• README layout inspired by Best-README-Template.

Back to top