Mouseww/anything-analyzer

Anything Analyzer – AI‑powered universal traffic capture & reverse‑engineering tool

What it is – A desktop application (Electron + React) that can intercept HTTP/HTTPS traffic from any source (web browsers, desktop apps, CLI tools, scripts, mobile devices, IoT) and then hand the captured requests to a large‑language model (OpenAI, Anthropic, or any compatible API) to automatically generate reverse‑engineering, security‑audit, performance‑ or encryption‑analysis reports.

---

Core capabilities

Feature	How it works	What you get
All‑scenario capture	• Embedded Chromium browser (CDP) for web pages • Built‑in MITM HTTPS proxy on port 8888 (system‑proxy, manual, or Wi‑Fi proxy) – works with Postman, Electron apps, curl/wget/httpie, Python requests, Node fetch, Go http, iOS/Android apps, IoT devices. • Requests from every source are merged into a single Session database.	One unified view of every request/response, regardless of origin.
AI‑driven analysis	Two‑phase pipeline: Phase 1 filters noise, Phase 2 runs deep analysis using LLM prompts. Five built‑in analysis modes (auto‑identify, API reverse‑engineer, security audit, performance profile, JS‑encryption reverse).	One‑click generation of protocol docs, auth flow diagrams, encryption‑algorithm extraction, vulnerability findings, and runnable code snippets (Python/JS).
JS Hook injection	When using the embedded browser, the tool injects hooks into fetch, XMLHttpRequest, crypto.subtle, CryptoJS, SM2/3/4, etc., to capture encrypted payloads and the exact crypto calls.	Automatic extraction of client‑side encryption logic and ready‑to‑run Python implementations.
MCP ecosystem integration	• MCP client can connect to external MCP servers (stdio or Streamable‑HTTP) to extend analysis capabilities. • Built‑in MCP server exposes capture + analysis as an MCP tool, allowing Claude Desktop, Cursor, or other AI agents to invoke it programmatically.	The analyzer can be used as a plug‑in for larger AI‑agent workflows.
Session management & export	SQLite‑backed storage, per‑session tagging, domain‑based filtering, JSON export of raw requests.	Easy hand‑off of data to other tools or archival.
Cross‑platform UI	Electron 35 + Vite, React 19, Ant Design 5, dark‑mode support, multi‑tab browsing, one‑click system‑proxy toggle.	Consistent experience on Windows, macOS (Intel & Apple Silicon) and Linux (AppImage).

---

Typical use‑cases

Scenario	Traffic source	AI output
Reverse‑engineer a web API	Embedded browser	Endpoint list, auth flow, Python request code
Discover hidden mobile‑app APIs	Phone Wi‑Fi proxy	API URLs, request signatures, de‑obfuscated crypto steps
Decode JavaScript encryption	Browser + JS hook	Identified algorithm, step‑by‑step description, Python implementation
Security audit of a SaaS client	Mixed browser + proxy	Token leakage, CSRF/XSS risks, sensitive data exposure report
Debug a CLI tool that talks to a REST service	curl/httpie via proxy	Full request/response log with AI‑generated explanation of each step
Trace micro‑service calls from a script	Python/Node script using proxy env vars	Call chain diagram, auth token propagation analysis

---

Tech stack (as described in the repo)

• Runtime: Electron 35 (main process) + Vite
• Frontend: React 19, Ant Design 5, TypeScript 5
• Database: better-sqlite3 (local SQLite file)
• Capture engine: Chrome DevTools Protocol (CDP) for in‑browser traffic, custom MITM HTTPS proxy built with node‑forge TLS library
• AI integration: Calls to OpenAI, Anthropic, or any compatible Chat Completion API; prompt templates are configurable
• Extensibility: MCP client/server (stdio & StreamableHTTP) for AI‑agent integration
• Build tools: pnpm, electron‑builder for installers, GitHub Actions for CI/CD

---

Getting started (summary from README)

1. Download the installer for your OS from the Releases page.
2. Configure an LLM in Settings → LLM (enter your OpenAI/Anthropic API key).
3. Create a Session – give it a name, optionally a start URL.
4. Capture –
   • For web: use the built‑in browser, click Start Capture.
   • For other apps/devices: enable the MITM proxy (port 8888), install the generated CA certificate (stored under the app data folder), then point the target application or device to the proxy.
5. Analyze – stop capture, press Analyze, pick a mode, and watch the streaming LLM report. You can ask follow‑up questions directly in the UI.

---

Maturity & community

• Release model – Pre‑built installers for Windows, macOS (Intel & Apple Silicon) and Linux (AppImage). Auto‑update via electron-updater.
• Open‑source – MIT license, source code available; build instructions provided.
• Tests – pnpm test script exists, indicating unit/integration tests.
• Activity – Star‑history chart shows ongoing interest; the repo includes CI for building signed macOS packages.
• Support – QQ group (ID 1091466461) and a “Thanks to LinuxDo” acknowledgement; sponsorship links are listed but not required for core functionality.

---

License

MIT – free for personal, academic, or commercial use, provided you comply with the disclaimer that the tool does not contain any built‑in AI model and must be used in accordance with local regulations.

---

Bottom line

Anything Analyzer is a genuine, full‑stack tool that bridges network traffic capture with generative‑AI analysis. It lets developers, security researchers, and reverse‑engineers collect HTTP(S) traffic from virtually any environment and obtain automatically generated, LLM‑driven documentation or security insights—all from a single desktop UI.