Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

zatanna.ai

Post reply on HN
Print view View original

21–30 of 97 posts

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#21

Post by dataviz1000 »

alexblackwell_ wrote: post #19
dataviz1000 wrote: post #8

I built the same thing as this just for websites. [0] I'm more interested in using Claude recursion to tune itself -- the agent writes itself, the agent -- than hacking websites. It is a good demonstration that 47 iterations of a recursive Claude agent writing itself to decompose any transport. I've tested it against YouTube, Twitch, Ticketmaster, and Yahoo Finance. It will detect any transport like JSON, WebSocket,…

We’ve essentially been using that “recursion” to tune our agent. Having the agent build itself is not something I would have ever thought of though. Curious if you find it genuinely creates specific enough tools for it to be worth the setup time? I have a claude skill that takes in a chat and then offers tools/fixes to system prompt. Have found that + the anthropic harness engineering blogs to be super useful in maki…

Have a look at https://github.com/adam-s/agent-tuning. Now, I'm working on developing the evaluation, the part that quantifies the performance of the agent. I'm having a hard time explaining it. You should be able to point Opus 4.7 to the repository and it will know how to set it up in your project.

You are welcome to send me an email at [my_username]@gmail.com if you want to talk about some of these things that I'm working on that are in your space.

`intercept` is just a proof-of-concept and at this point, if it added any value to what you are working on, that would be the best. Overall, people are pounding every website and your product will save billions in compute from AI inference to servers grinding and grinding getting pounded by these bots.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#22

Post by alexblackwell_ »

lyime wrote: post #15

How is this different/better than charles proxy/proxyman or similar apps?

I’ve probably spent on the order of months of my life in proxyman/charles/burp/powhttp. All are great, but I’ve never been completely satisfied with the UX/features for building automations. As far as differences; we don’t modify TLS/HTTP2 connections, have a fully featured MCP (each UI action is an api action by definition), and have built more robust automation tooling in the app itself. The goal is to be an AI-native burp suite/powhttp with Proxyman-like UI.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#23

Post by alexblackwell_ »

IMTDb wrote: post #20

Congratulations. How do you handle SSL pinning ? Most of the apps I interact with have some sort of SSL pinning, which is the hard part to circumvent. I tried Kampala but got stuck at the usual place; as soon as I enable it, chatGPT stops working. Most of my iPhone apps stop responding etc. I would love to try using this tool to build an agent that can simply subscribe me to my gym lessons instead of me having to go…

Unfortunately we can’t do much around SSL pinning yet. Not sure how deep you want to go, but there are several Frida scripts that patch common pinning implementations.

I also think mitmproxy (open source) has an option to spin up a virtual Android device that can bypass pinning via AVD. I have not tested how reliable it is though.

FWIW, it could also be a cert trust issue. I would try a quick Safari search to confirm the cert is fully trusted. ChatGPT is pinned, but the gym app makes me think it might be a trust or config issue on your device.

Happy to take a look as well. Email me at alex at zatanna dot ai.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#24

Post by alexblackwell_ »

benagents wrote: post #13

Great job Alex! Think this is really interesting especially for creating datasets. Proxyman was always hard to use for me, so connecting it to a MCP was something I have been waiting for. Quick question: How do you handle session re-auth mid-script? Congrats on the launch.. I need that conference script!

Thanks Ben! For session re-auth we attempt to agentically find the session refresh/login endpoints and make those part of the flow as an auth provider. This can be a bit sketchy though and is the main bottleneck right now. Currently working on some cool workarounds for this that allow us to piggy back on browser that should land by next week :)

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#25

Post by alexblackwell_ »

telecuda wrote: post #18

Congrats. You may want to consider dropping the "reverse engineer" language though, since most every application's ToS is clear on that being prohibited. Perhaps just "replay any application" or similar.

Yeah agreed this messaging is a bit confusing. Our focus is on helping people build automations, not do any mass-scale scraping.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#26

Post by benagents »

alexblackwell_ wrote: post #24
benagents wrote: post #13

Great job Alex! Think this is really interesting especially for creating datasets. Proxyman was always hard to use for me, so connecting it to a MCP was something I have been waiting for. Quick question: How do you handle session re-auth mid-script? Congrats on the launch.. I need that conference script!

Thanks Ben! For session re-auth we attempt to agentically find the session refresh/login endpoints and make those part of the flow as an auth provider. This can be a bit sketchy though and is the main bottleneck right now. Currently working on some cool workarounds for this that allow us to piggy back on browser that should land by next week :)

Thank you! Looking forward to it.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#27

Post by peterabbitcook »

It seems like it’s quite HTTP-centric (like most of the web…). I didn’t see anything on the page about this - can it also intercept / “reverse engineer” service calls that go over gRPC or WebSocket? I’m guessing at least a partial “yes” if the gRPC traffic uses grpc-web/Envoy?

Seems like a great product, potentially quite powerful for automated testing of SPAs.

Re: Launch HN: Kampala (YC W26) – Reverse-Engineer Apps into APIs

#29

Post by alexblackwell_ »

peterabbitcook wrote: post #27

It seems like it’s quite HTTP-centric (like most of the web…). I didn’t see anything on the page about this - can it also intercept / “reverse engineer” service calls that go over gRPC or WebSocket? I’m guessing at least a partial “yes” if the gRPC traffic uses grpc-web/Envoy? Seems like a great product, potentially quite powerful for automated testing of SPAs.

Yep we handle gRPC and websocket. gRPC is a bit sketch/hard to do because of the way the protocol is designed. FWIW not many sites implement gRPC (some google sites and spotify being the only two I can think of), and if they do they usually have decent APIs. Feel free to try and lmk if you have any issues!
Post reply on HN