Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

We opened chrome, navigated the entire website, the downloaded the network tab as an har file. The asked claude to analyze and document the apis as an openapi json. Worked amazing.

Next step - we wrote a small python script. On one side, this script implements stdio mcp. On the other side, it calls the Internal apis exposed by the 3rd party app. Only thing missing is the auth headers..

This is the best part. When claude connects to the mcp, the mcp launches a playwright controlled browser and opens the target web apication. It detects if the user is logged in. Then it extracts the auth credentials using playwright, saves them to a local cache file and closes the browser. Then it accesses the apis directly - no browser needed thereafter.

In about an hour worth of tokens with claude, we get a mcp server that works locally with each users credentials in a fairly reliable manner. We have been able to get this working in otherwise locked down corporate environments.

How do you handle SSL pinning ? Most of the apps I interact with have some sort of SSL pinning, which is the hard part to circumvent. I tried Kampala but got stuck at the usual place; as soon as I enable it, chatGPT stops working. Most of my iPhone apps stop responding etc.

I would love to try using this tool to build an agent that can simply subscribe me to my gym lessons instead of me having to go on the horrible app. But even that relatively simple (iOS) app stopped working as soon as I enabled the proxy.

I tried my hand at this once from har file, build a DAG of the requests and responses and how their parameters map into each other, and then try to build a spec.

But it was very brittle. I imagine now with LLMs its much more viable. I always thought generating clients and load tests would be a cool use case.

just looking for what is USP(unique selling point) here

happy for you though if this actually works

Totally unrelated, I am just curious about why you chose the name, as someone who is Ugandan and was born in raised in Kampala (which is the Capital City of Uganda BTW).

Congratulations again.

I've tested it against YouTube, Twitch, Ticketmaster, and Yahoo Finance. It will detect any transport like JSON, WebSocket, GraphQL, SSE, Protbuf, UDP, WebRTC, ect.. It after 3 hours and some coaching succeeded in reverse engineering ChatGPT + Cloudflare Turnstile but I didn't merge that into it yet.

It works by Claude using the Chrome DevTools Protocol (CDP) intercepting all traffic.

[0] https://github.com/adam-s/intercept?tab=readme-ov-file#how-i...

Compared to your our approach, we are doing this entirely within a browser extension so meeting users where they already doing their existing work.

Within the extension just record doing a task, we reverse engineer the APIs and write a script. Then execute the script from within the webpage so that auth/headers/tokens get automatically added.

You can just prompt to reuse the tools at zero token cost.

Seems like a great product, potentially quite powerful for automated testing of SPAs.

Also not clear on the page if it is apps from the local machine or on the network. Maybe some clearer examples and use cases would help?

Fingerprinting is also a hard thing to match perfectly, I would be curious to know what your strategy is on that. My experience has been that unless you bundle multiple TLS lib it is almost impossible to do at 100% because none of the lib cover all the TLS extensions.

Kampala (had to double check it wasn’t Harris)

Just mulling these names over, how’d you come up with them?

PS: clear value prop!

and if API is not published, and you MITM with self-compromised CAs, and then use it (commercially?) you ~100% breaking ToS.

this is just un-ethical. or YC does not have regard anymore for such things?

Think this is really interesting especially for creating datasets. Proxyman was always hard to use for me, so connecting it to a MCP was something I have been waiting for.

Quick question: How do you handle session re-auth mid-script?

Congrats on the launch.. I need that conference script!

It’s pretty funny to see that in their demo video given it’s a blatant violation of their ToS.

If a web property has implemented anti-bot mechanisms, what ethical reasons do you have for providing evasion as a service?

side note, YC25/YC26 batches have multiple startups that blantly violate ToS and sitting on a timebomb just pending a lawsuite and Cease and Desist Letters.