Anything Analyzer: Browser Capture, an MITM Proxy and MCP in One Electron App

What Anything Analyzer Actually Solves

The project's own framing is that the existing tools each cover one slice. DevTools sees only the browser. Fiddler and Charles are proxies but not analysis environments. Wireshark cannot read HTTPS without keys. After capturing, you still scroll through hundreds of requests by hand.

Anything Analyzer's answer is to funnel every source into one session object and then hand that session to an LLM. The README lists six capture targets: web pages through an embedded browser, desktop apps through system proxy settings, terminal commands such as curl and wget, scripts using Python requests or Node.js fetch, phones and tablets over Wi-Fi proxy settings, and IoT devices through a gateway proxy. All of them land in the same Session, and the AI analysis step processes them together.

The intended user is someone doing black-box protocol work: reverse-engineering a site's API, recovering a mobile app's request signing logic, or auditing a service for leaked tokens and CSRF issues. It is a desktop application, not a library, so the audience is the engineer at a keyboard, not a CI pipeline.

How the Capture Pipeline Is Wired

The repository layout in the README shows the architecture plainly. Under src/main, capture holds the CDP Fetch interception and JS hook injection, cdp manages the Chrome DevTools Protocol connection, proxy holds the MITM proxy with CA management and certificate issuance, ai holds a two-stage analysis pipeline with prompt templates and LLM routing, mcp holds both an MCP client and a built-in MCP server, db is a better-sqlite3 layer, and session manages session lifecycle.

Two capture channels feed one session. The embedded browser uses CDP Fetch interception to record every HTTP request and response including headers and body. The MITM proxy handles everything outside the browser. Requests are tagged with their origin so you can tell CDP traffic from proxy traffic.

The AI side is explicitly two-phase: Phase 1 filters noise, Phase 2 does the deep analysis, and the model can pull individual request details on demand rather than being handed the whole capture at once. That matters because a session can be large. There are five analysis modes (auto, API reverse engineering, security audit, performance, and JS crypto reverse engineering), streaming output, and follow-up questions after a report is generated.

The JS hook layer is the part worth calling out. It intercepts fetch, XHR, crypto.subtle, CryptoJS and SM2/3/4 calls, and the app can extract crypto-related code fragments out of JavaScript files. That is the mechanism behind the crypto reverse-engineering mode: instead of inferring the algorithm from ciphertext, the hook sees the call site.

Installing Anything Analyzer and Capturing Your First Request

The README points to GitHub Releases rather than a package registry. Installers are named per platform: Anything-Analyzer-Setup-x.x.x.exe for Windows, Anything-Analyzer-x.x.x-arm64.dmg and Anything-Analyzer-x.x.x-x64.dmg for macOS, and Anything-Analyzer-x.x.x.AppImage for Linux.

If you would rather build from source, the README gives these commands. Note the capitalised WW in the clone URL, which differs from the owner casing used elsewhere in the repository.

git clone https://github.com/MouseWW/anything-analyzer.git
cd anything-analyzer
pnpm install
pnpm dev        # development mode
pnpm test       # run tests

pnpm dev starts the Electron app in development mode. Building a distributable is a separate step, and the README shows the Windows form of it:

pnpm build && npx electron-builder --win

Once the app is open, the README's first-run sequence for a web target is four steps: configure an LLM under Settings then LLM with an API key (OpenAI, Anthropic or any compatible endpoint), create a new Session with a name and target URL, operate the site inside the embedded browser and click Start Capture, then stop capture and click Analyze to pick an analysis mode. The README does not document a rollback for a session once analysis has run.

Pointing External Traffic at the Proxy

The proxy listens on port 8888 by default. Enabling it is a Settings step, and the README requires installing the CA certificate first. The certificate lives under %APPDATA%/anything-analyzer/certs/ on Windows and ~/Library/Application Support/anything-analyzer/certs/ on macOS, and first-time installation needs administrator rights. The root CA is valid for 10 years and leaf certificates for 825 days, which the README says is to satisfy Apple's requirements.

For a terminal command, the documented form is:

curl -x http://127.0.0.1:8888 https://api.example.com/data

The request should appear in the active session tagged as proxy traffic. The README gives the equivalent configuration for a Python script and for Node.js:

proxies = {"http": "http://127.0.0.1:8888", "https": "http://127.0.0.1:8888"}
requests.get("https://api.example.com/data", proxies=proxies)

HTTP_PROXY=http://127.0.0.1:8888 HTTPS_PROXY=http://127.0.0.1:8888 node app.js

For desktop applications, Settings has a one-click option to set the system proxy. For a phone or tablet, the README says to set Wi-Fi HTTP proxy to manual with the computer's IP and port 8888, then open the proxy address in the phone browser to download and install the CA certificate. A session created with an empty URL still receives that external traffic.

Where the MITM Design Stops

The README is unusually candid in its CA certificate section, and the limits it names are the ones to take seriously. The MITM proxy is read-only capture: it does not modify request or response content. WebSocket traffic is tunnelled, not decrypted. Individual bodies are capped at 1MB, and binary content is skipped automatically.

That combination rules out a set of jobs. If your target protocol runs over WebSocket, the app will show you the upgrade request and then nothing useful about the frames. If you are analysing a binary protocol, a protobuf-heavy service, or anything transferring files larger than 1MB, the body will not be there. And because modification is off the table, you cannot use it to replay a tampered request or test how a server reacts to an altered signature.

The certificate handling is the other boundary. Installing a root CA on a device is a real change to that device's trust store, and on iOS and recent Android versions it can require more than a settings toggle. Anything Analyzer gives you install, uninstall, regenerate and export actions, but the README notes the first install needs admin rights (Windows UAC or macOS password). On a machine you do not control, that alone can be a blocker.

There is also a packaging caveat that has nothing to do with capture: the README warns that macOS auto-update depends on signed and notarised builds, and that GitHub Actions needs CSC_LINK, CSC_KEY_PASSWORD, APPLE_ID, APPLE_APP_SPECIFIC_PASSWORD and APPLE_TEAM_ID configured in repository Secrets or ShipIt cannot install updates. That is a maintainer concern, but it tells you the macOS update path is more fragile than the Windows one.

Anything Analyzer vs Charles and mitmproxy

The honest comparison is with mitmproxy, because that is the tool most people reach for when they need a scriptable HTTPS proxy.

mitmproxy is a Python program with a console UI, a web UI and a scripting API. You write addons in Python, run them headless, and put the whole thing in CI. Its strength is that interception logic is code you own and version. Its weakness for this use case is that it does not analyse anything for you: you still read the flows.

Anything Analyzer inverts both properties. The proxy is a component inside a GUI, not a standalone process you script, and the value comes from the AI layer summarising what was captured. You get a two-phase pipeline, five analysis modes and follow-up questions out of the box, plus MCP so Claude Desktop or Cursor can call the capture tools directly. You give up headless operation and the ability to write your own interception logic.

Charles sits between the two: a mature commercial GUI proxy with strong mapping and rewriting features. Anything Analyzer's proxy is explicitly read-only, so if rewriting responses is part of your workflow, Charles or mitmproxy is the right tool and Anything Analyzer is not.

The MCP angle is the genuinely different piece. The README describes both directions: an MCP client that connects to external MCP servers over stdio and StreamableHTTP to extend analysis, and a built-in MCP server that exposes capture and analysis as tools for other agents. If your workflow already lives in an agent IDE, that is the reason to pick this over a plain proxy.

Licence, Maintenance and Upgrade Cost

The README carries an MIT badge linking to a LICENSE file, but the top-level repository listing does not include a LICENSE file. Treat the licence as unverified until that file exists, and read it before you ship anything derived from the source. Nothing here is legal advice; if the distinction matters to your organisation, ask someone qualified.

The last push was on 2026-09-09, and the most recent release listed is v3.6.61 from 2026-08-26. The version in package.json is 3.6.62. Releases have been frequent, with three listed between early August and late August 2026, and the version numbering suggests small increments rather than long cycles.

Upgrade cost is mostly operational rather than code-level, since this is an installed desktop app. Auto-update is built in via electron-updater. The friction is on macOS, where the README ties updates to signed and notarised packages. Building from source needs Node.js 18 or newer, pnpm (package.json pins [email protected]), and Visual Studio Build Tools on Windows, which better-sqlite3 makes necessary. The stack is Electron 35, React 19, Ant Design 5, TypeScript 5 and better-sqlite3, so anyone forking it inherits a full Electron toolchain rather than a small script.

Editorial conclusion

Adopt Anything Analyzer if you reverse-engineer HTTP and HTTPS APIs across browsers, CLI tools and mobile apps and want the captured traffic summarised by an LLM rather than read by hand. Do not adopt it for WebSocket payload inspection, for binary or large-body protocols, or for anything where you cannot install a root CA on the target device. Before committing, verify three things: that the repository has no LICENSE file even though the README badge says MIT, that your chosen LLM endpoint works with the Chat Completions or Responses API the app routes to, and that the MITM proxy's read-only, non-decrypting WebSocket behaviour matches what you actually need to inspect.

Frequently asked questions

Official sources

1. Issues
2. Mouseww/anything-analyzer on GitHub
3. README
4. Releases