Startup Ideas Bank

A clever developer tool that saves time, but it sits on a legal and trust minefield.

AI roast score: 67/100 (C)

The idea

This is a neat way to turn captured app traffic into a Python client. It is also one angry platform policy away from becoming a demo people are scared to ship.

In the founder's own words

littledivy/mimic — Intercept any app, then call it from Python like a library

mimic

Intercept any app, then call it from Python like a library.

from hinge_client import Hinge

acc = Hinge () # reuses your captured session
recs = acc . get_recommendations ()
acc . like ( subject_id , comment = "hi lol" )

You don't write hinge_client.py . mimic captures your own app traffic and an AI
generates the client from it.

How it works

Most apps authenticate every request with the same bundle of values: a bearer
token, some device ids, a session id, cookies. They're stable across calls.
Capture them once from a real request you made, and you can replay them on new
requests to the same API.

capture traffic -> extract auth -> generate client
(mitmproxy) (mimic.Session) (claude reads the
captured endpoints)

The generated client is plain Python on top of mimic.App , and you edit it like
any other file. It gives you named methods, body templates, and the multi-step
call chaining mobile APIs tend to need (fetch a token in one call, spend it in
the next).

Install

sh install.sh

Installs uv if you don't have it, then mimic in an
isolated tool env. mitmproxy isn't a separate install; mimic launches it via
uvx on first record . (Manual: uv tool install mimic-client .)

mimic doctor # confirm proxy + claude are ready

Use it (iPhone)

mimic record # starts the proxy, prints the iPhone steps

record fills in your Mac's LAN IP and walks you through it:

iPhone -> Wi-Fi -> Configure Proxy -> Manual -> <your-mac-ip>:8080

Safari -> http://mitm.it -> install the Apple profile

Settings -> General -> About -> Certificate Trust Settings -> turn on full
trust for mitmproxy. This step is easy to miss and nothing works without it.

open the app, use it normally

Then:

mimic hosts # list captured hosts; pick your API host
mimic learn prod-api.hingeaws.net # see the endpoints mimic saw
mimic gen prod-api.hingeaws.net # generate hinge_client.py

Then from hinge_client import Hinge; Hinge().get_recommendations() .

The library

Three ways to build a session by hand, if you don't want codegen:

from mimic import Session

Session . from_mitm ( "prod-api.hingeaws.net" ) # pull auth from mitmweb
Session . from_curl ( open ( "copied.txt" ). read ()) # paste "Copy as cURL" from devtools
Session ( base_url = "https://x.com" , headers = {...}) # explicit

.get(path) , .post(path, json=...) , and the other common HTTP verb helpers
return parsed JSON and raise requests.HTTPError for failed responses. If your
token rotates, a 401 on an idempotent request triggers one re-pull from
mitmweb and a retry. Non-idempotent requests are not retried unless you explicitly
pass refresh=True .

Capture backends


mitmproxy for iOS apps (the default)

The roast

The core trick is real: you capture traffic, extract auth, and generate a client. That is useful for developers, and the pitch shows you understand the pain of ugly mobile APIs and multi-step auth. But useful does not mean safe, and safe does not mean sellable. You are asking developers to point a proxy at real consumer apps, trust an AI-generated client, and believe the target app will not break or ban them. Your own pitch admits the fragility. You rely on stable bearer tokens, device IDs, session IDs, and cookies, then you add a retry path when a token rotates. That is not a product moat; that is a treadmill. The moment an app changes its auth flow, adds device binding, or starts detecting proxy traffic, your magic client turns into a support ticket factory. That is the classic failure pattern for tools that sit on top of other companies' APIs: they work until the platform owner notices. The bigger problem is distribution. You say the buyers are developers, your pricing is standard, and your growth is product-led. Fine. But the pitch is aimed at a narrow slice of developers who are comfortable intercepting traffic from apps and replaying sessions. That is not a mainstream habit. So you are not just selling a tool; you are selling trust, legality, and workflow change at once. That is a lot for an idea-stage solo founder with no funding to carry.

Red flags

Verdict

If you can prove developers will pay to save hours on brittle mobile API work without getting blocked, this is a real niche tool; if not, it stays a clever demo.

Start with your own startup idea →

More ideas roasted by AI

Browse all startup ideas →