Show HN: API Parrot – Automatically Reverse Engineer HTTP APIs

Original Article ↗ Hacker News Discussion ↗

API Parrot, a new tool for reverse-engineering website HTTP APIs by capturing and correlating browser traffic, is drawing strong interest from developers who want to understand undocumented or legacy integrations more quickly. Commenters praise its UI and data-relationship detection, but raise concerns over its closed-source model, early-stage bugs, Chrome-only assumptions on Linux, and the initial lack of a polished macOS build (now available but unsigned). The conversation also branches into comparisons with tools like mitmproxy2swagger and Integru, plus a broader debate over the dominance of macOS in backend development versus working directly on Linux.

Product concept and capabilities

  • Tool captures HTTP traffic from a browser, infers API structure, and visualizes request/response flows.
  • Main value: automatic correlation of data across requests by decomposing JSON and other structures into trees and matching repeated values.
  • Users report it’s intuitive and helpful for understanding complex/legacy vendor APIs and spotting architecture/performance issues.

Platform availability and installation

  • Early comments requested a macOS version; one is later announced, but it’s not code-signed and requires a quarantine workaround.
  • Linux users report issues launching Chrome (wrong command, Windows-specific assumptions). Workarounds involve manually starting Chrome with proxy and certificate arguments; a configurable launch command is planned.
  • AppImage install path and permissions confuse some Linux users; docs were updated after feedback.

Data modeling and technical details

  • Data correlation works by recursively breaking down structures (e.g., arrays, objects), then matching identical values across requests.
  • Currently supports HTTP only; WebSocket support is acknowledged as harder due to binary formats and is not implemented.
  • Non-JSON formats are partially supported; multipart form data is not yet.

Missing features and roadmap requests

  • Frequent requests: macOS build (now provided), OpenAPI/Swagger export, SDK generation, better browser choice (not only Chrome), and explicit ToS/license info.
  • Users ask about support for URL path variables, query parameters, and noise filtering; those are said to be supported.
  • Feature suggestions include UI refinements, adjustable layout, better defaults for naming and resizing, and optional newsletter for releases.

Stability, bugs, and UX

  • Reports of crashes on large GraphQL responses and missed captures when certain requests occur on initial page load.
  • Some find the website’s animated “snake” distracting.
  • Overall UI and docs receive praise, with minor usability nitpicks.

Comparisons and ecosystem

  • Compared to Postman’s capture features, mitmproxy2swagger, and Integuru/Integru; differentiation is seen in correlation/visualization, but details remain somewhat unclear.
  • Naming of both this tool and competitors is discussed as affecting memorability.

Broader OS debate

  • A substantial subthread debates macOS dominance in dev tooling, cross-platform issues, ARM vs x86, Docker abstraction, and the practicality vs “harm” of developing on macOS while deploying to Linux.