Repository guide · getting started · v2
mitmproxy / mitmproxy · Getting started
mitmproxy is an open-source Python project under the MIT license described by its authors as an intercepting HTTP proxy. The repository spans 1,292 analyzed files, with 44 JavaScript dependencies recorded in web/package.json. Runtime flows, installation commands, and Python dependencies remain unverified in this static analysis.
- Original repository
- mitmproxy/mitmproxy
- License
- MIT · open-source license
- Analyzed revision · last verified
- b506c68108e287104045333ade476d92c39c275e ·
Newer revision observed; the code this guide cites is unchanged. The default branch moved to 5253dcbd1d8f, checked 2026-10-11. A revision diff of 24 changed files found no change in the code regions this guide cites. The guide still describes revision b506c68108e2; repository-wide counts (files, calls and so on) refer to that revision.
mitmproxy/mitmproxy: Getting Started Guide
Terms used on this page
- Entrypoint record
- A file the analyzer marks as a place where execution can start. When it carries a __main__ guard excerpt, the file contains an if __name__ == "__main__": block and the excerpt shows what that block calls; without an excerpt, the file was flagged by its name only.
- Bounded static execution path
- A call chain reconstructed from the source code without running it, stopped after a fixed number of steps. It shows how far the code can be followed on paper, not what happens at run time.
- Unresolved boundary
- Where a static path stops because the next call goes into an external library or cannot be resolved without running the code. It marks the edge of this analysis, not a defect in the repository.
- Static relations
- Calls and imports found in the source. "External or unresolved" relations point outside the analyzed files.
- Module role
- The analyzer's label for a file, inferred from how many calls go in and out (for example core, entry/orchestration, leaf). It describes a position in the call graph, not the authors' design.
- Test-like files
- Files whose names or locations look like tests. This analysis counts them; it does not run them.
- Observed · inferred · author-claimed · unresolved
- How each statement is supported: read directly from the analyzed files; derived by the analyzer from them; stated by the repository's authors (metadata, README); or not established by this analysis.
- Verified
- Two uses on these pages. In an analyzer record ("verified provenance", "a verified entrypoint") it means the record was read directly from the analyzed files, which these guides call observed; for an entrypoint, the __main__ guard text is present. Since the analyzer fix of 2026-10-04, a file that only has an entrypoint-like name such as cli.py or main.py is recorded as inferred; guides analyzed before that still call such a file verified, and it is still only a guess about how the file is used. It does not mean the code was run or tested. "Last verified" is the date the guide last passed the lab's checks against the analysis record of the stated revision; it is not a review of the repository itself.
What You Are Looking At
Repository metadata describes the project as an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. The codebase is primarily written in Python and is licensed under the MIT license. GitHub platform records show release v12.2.3 published on 2026-05-12T13:02:17Z, with 45,046 stargazers recorded. In total, the analyzer inventoried 1,292 files.
What It Needs
Dependencies were parsed exclusively from web/package.json. This manifest records 18 runtime dependencies, including react, codemirror, and @reduxjs/toolkit, alongside 26 development dependencies such as jest, vite, eslint, and typescript.
However, Python dependency specifications in pyproject.toml were not parsed during analysis. Furthermore, installation and build procedures are not verified by the analyzer.
How It Starts
The analyzer identified 28 total entrypoint records, of which 20 are listed with Python execution guards. Listed files include mitmproxy/version.py which prints its version string, release/build.py which triggers cli(), and test/filename_matching.py which executes main().
For docs/scripts/clirecording/record.py, five bounded static execution paths are documented, but each terminates at an unresolved boundary. Runtime behavior beyond these static records is not established.
Where to Look First
Newcomers should examine top-level files highlighted by the analyzer: README.md, pyproject.toml, and LICENSE. The analyzer's teaching claims suggest starting with these files and inspecting entrypoint mitmproxy/tools/main.py.
The repository structure centers on test (427 files), web (286 files), mitmproxy (285 files), docs (166 files), examples (73 files), and release (33 files). A suite of 194 test-like files is present across the codebase.
What This Analysis Cannot Tell You
This assessment is strictly static: dynamic imports, reflection, monkey-patching, and framework wiring remain unresolved. Manifest extraction is incomplete because pyproject.toml dependency tables were not parsed, and installation commands are not verified.
README extraction is line-based and may capture raw code. Additionally, four files over 400 kB or identified as minified bundles were skipped. Finally, the analyzer's heuristic categorization of the project as a web or Node.js application contradicts the primary Python language metadata.
What this analysis could not establish
The writing model's own notes on the analysis record. Identifiers such as lim_3, exec_* or claim_… name records of that analysis; the claims table cites the same records.
- Python dependencies in pyproject.toml were not parsed, leaving runtime Python requirements ungrounded.
- Analyzer classified the repository as a web or Node.js application despite primary Python language metadata.
- Runtime behavior beyond bounded static entrypoint steps remains unverified.
Claims and evidence — 22 claims, 22 supported by an independent verifier
Every substantive statement above is a claim bound to grounding IDs of the analyzed revision. Global grounding IDs are namespaced by the analysis run.
| Claim | Epistemic status | Verifier | Grounding (global IDs) |
|---|---|---|---|
| c1 Author metadata describes the project as an interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers. | author_claimed | supported | analysis_047cd186cb2a335b:meta_description |
| c2 The repository's primary language is Python, with MIT licensing detected across the project. | observed | supported | analysis_047cd186cb2a335b:meta_primary_language, analysis_047cd186cb2a335b:meta_license |
| c3 Platform records note latest release v12.2.3 published on 2026-05-12T13:02:17Z, with 45,046 stargazers recorded. | observed | supported | analysis_047cd186cb2a335b:meta_latest_release, analysis_047cd186cb2a335b:meta_stars |
| c4 The analyzer recorded 1,292 analyzed files across the repository. | inferred | supported | analysis_047cd186cb2a335b:summary_repository |
| c5 Only web/package.json was parsed for dependencies, recording 18 runtime dependencies including react, codemirror, and @reduxjs/toolkit. | observed | supported | analysis_047cd186cb2a335b:dep_1, analysis_047cd186cb2a335b:dep_2, analysis_047cd186cb2a335b:dep_3, analysis_047cd186cb2a335b:dep_4, analysis_047cd186cb2a335b:dep_5, analysis_047cd186cb2a335b:dep_6, analysis_047cd186cb2a335b:dep_7, analysis_047cd186cb2a335b:dep_8, analysis_047cd186cb2a335b:dep_9, analysis_047cd186cb2a335b:dep_10, analysis_047cd186cb2a335b:dep_11, analysis_047cd186cb2a335b:dep_12, analysis_047cd186cb2a335b:dep_13, analysis_047cd186cb2a335b:dep_14, analysis_047cd186cb2a335b:dep_15, analysis_047cd186cb2a335b:dep_16, analysis_047cd186cb2a335b:dep_17, analysis_047cd186cb2a335b:dep_18 |
| c6 The web/package.json manifest records 26 development dependencies including jest, vite, eslint, and typescript. | observed | supported | analysis_047cd186cb2a335b:dep_19, analysis_047cd186cb2a335b:dep_20, analysis_047cd186cb2a335b:dep_21, analysis_047cd186cb2a335b:dep_22, analysis_047cd186cb2a335b:dep_23, analysis_047cd186cb2a335b:dep_24, analysis_047cd186cb2a335b:dep_25, analysis_047cd186cb2a335b:dep_26, analysis_047cd186cb2a335b:dep_27, analysis_047cd186cb2a335b:dep_28, analysis_047cd186cb2a335b:dep_29, analysis_047cd186cb2a335b:dep_30, analysis_047cd186cb2a335b:dep_31, analysis_047cd186cb2a335b:dep_32, analysis_047cd186cb2a335b:dep_33, analysis_047cd186cb2a335b:dep_34, analysis_047cd186cb2a335b:dep_35, analysis_047cd186cb2a335b:dep_36, analysis_047cd186cb2a335b:dep_37, analysis_047cd186cb2a335b:dep_38, analysis_047cd186cb2a335b:dep_39, analysis_047cd186cb2a335b:dep_40, analysis_047cd186cb2a335b:dep_41, analysis_047cd186cb2a335b:dep_42, analysis_047cd186cb2a335b:dep_43, analysis_047cd186cb2a335b:dep_44 |
| c7 Dependency tables in pyproject.toml were not parsed by the analyzer. | observed | supported | analysis_047cd186cb2a335b:lim_3 |
| c8 Installation and build commands are not verified by this analysis. | observed | supported | analysis_047cd186cb2a335b:lim_2 |
| c9 The repository contains 28 entrypoint records, with 20 listed in the packet containing Python execution guards. | inferred | supported | analysis_047cd186cb2a335b:summary_repository, analysis_047cd186cb2a335b:py_entry_23aa0a6611cd, analysis_047cd186cb2a335b:py_entry_9bc2d0951bbb, analysis_047cd186cb2a335b:py_entry_b8ec913ab5ec, analysis_047cd186cb2a335b:py_entry_de4dff7bdb74, analysis_047cd186cb2a335b:py_entry_76b9f498ea20, analysis_047cd186cb2a335b:py_entry_e99c950b04c3, analysis_047cd186cb2a335b:py_entry_ebf4a3c298f4, analysis_047cd186cb2a335b:py_entry_b367f5ba5480, analysis_047cd186cb2a335b:py_entry_b7f1061677a8, analysis_047cd186cb2a335b:py_entry_58c06815c9c5, analysis_047cd186cb2a335b:py_entry_f00ac7b841ad, analysis_047cd186cb2a335b:py_entry_5b3a718325db, analysis_047cd186cb2a335b:py_entry_4f750bb8c01d, analysis_047cd186cb2a335b:py_entry_b21d33d3ba0d, analysis_047cd186cb2a335b:py_entry_1999ea8fac39, analysis_047cd186cb2a335b:py_entry_978eda704ebb, analysis_047cd186cb2a335b:py_entry_b55340337abc, analysis_047cd186cb2a335b:py_entry_9990e520bd8e, analysis_047cd186cb2a335b:py_entry_7814fefb28de, analysis_047cd186cb2a335b:py_entry_3df95b0e4335 |
| c10 Entrypoints include mitmproxy/version.py which prints VERSION, release/build.py which invokes cli(), and test/filename_matching.py which invokes main(). | observed | supported | analysis_047cd186cb2a335b:py_entry_9bc2d0951bbb, analysis_047cd186cb2a335b:py_entry_b8ec913ab5ec, analysis_047cd186cb2a335b:py_entry_e99c950b04c3 |
| c11 The analyzer lists five bounded static execution paths for docs/scripts/clirecording/record.py, all terminating at unresolved boundaries. | inferred | supported | analysis_047cd186cb2a335b:exec_12b531f3877d, analysis_047cd186cb2a335b:exec_f8ca272a0f5a, analysis_047cd186cb2a335b:exec_6537d444029e, analysis_047cd186cb2a335b:exec_166eee7e2659, analysis_047cd186cb2a335b:exec_941682fedfc0 |
| c12 Runtime behavior beyond these static records is not established by the analyzer. | unresolved | supported | analysis_047cd186cb2a335b:claim_4d30ade3e21e |
| c13 Project-level files classified as important include README.md, pyproject.toml, and LICENSE. | observed | supported | analysis_047cd186cb2a335b:important_1, analysis_047cd186cb2a335b:important_3, analysis_047cd186cb2a335b:important_4 |
| c14 Analyzer teaching claims suggest reading README.md, pyproject.toml, and LICENSE early, then inspecting entrypoint mitmproxy/tools/main.py. | inferred | supported | analysis_047cd186cb2a335b:claim_5e040738cac5, analysis_047cd186cb2a335b:claim_0419236c594f, analysis_047cd186cb2a335b:claim_d445d928f2f7, analysis_047cd186cb2a335b:claim_3b3bfa82ac65 |
| c15 The repository structure centers on top-level directories including test, web, mitmproxy, docs, examples, and release. | inferred | supported | analysis_047cd186cb2a335b:summary_repository |
| c16 The repository contains 194 test-like files across the codebase. | inferred | supported | analysis_047cd186cb2a335b:summary_repository |
| c17 The analysis is strictly static, so dynamic imports, reflection, dynamic dispatch, and framework wiring are not resolved. | observed | supported | analysis_047cd186cb2a335b:lim_1 |
| c18 Manifest parsing was partial because pyproject.toml dependency tables were not parsed, leaving Python dependencies unlisted. | observed | supported | analysis_047cd186cb2a335b:lim_3 |
| c19 Commands for installation, execution, and building are not verified. | observed | supported | analysis_047cd186cb2a335b:lim_2 |
| c20 README extraction is line-based and may capture code lines rather than prose claims. | observed | supported | analysis_047cd186cb2a335b:lim_4 |
| c21 Files exceeding 400 kB or detected as minified bundles were inventoried but skipped during deep parsing. | observed | supported | analysis_047cd186cb2a335b:lim_6 |
| c22 An internal contradiction exists where the analyzer infers a web or Node.js application despite metadata recording Python as primary. | inferred | supported | analysis_047cd186cb2a335b:summary_repository, analysis_047cd186cb2a335b:meta_primary_language |
Sources, rights and disclosure · attribution-license-templates/v0.1
Rights notice. Original repository hosted on GitHub. Repository source code, documentation, names, media, and related project materials remain subject to the rights of their respective authors, contributors, and other rights holders and to applicable repository license terms.
Platform notice. GitHub is the source hosting platform for the linked repository. GitHub and related marks are trademarks of GitHub, Inc. EVEMISS Technology is not affiliated with or endorsed by GitHub unless explicitly stated otherwise.
How this page is produced. This page was produced using revision-aware repository analysis and AI-assisted editorial tooling. Technical claims are tied to the analyzed repository revision and may be revalidated when the source repository changes.
AI-assisted analysis. Reviewed by EVEMISS Technology through human–AI collaborative review. · Report a rights concern · Back to the overview