ApiTap — The MCP Server That Turns Any Website Into an API

No docs, no SDK, no browser. Just data.

What It Does

ApiTap gives AI agents cheap access to web data through three layers:

1. Read — Decode any URL into structured text without a browser (side-channel APIs, og: tags, HTML extraction). 0-10K tokens vs 50-200K for browser automation.
2. Replay — Call captured API endpoints directly. 1-5K tokens per call.
3. Capture — Record API traffic from a headless browser session, generating reusable skill files.

MCP Tools (12)

Tier 0: Triage (free)

apitap_peek

Zero-cost URL triage. HTTP HEAD only — checks accessibility, bot protection, framework detection.

apitap_peek(url: string) → PeekResult

Use when: You want to know if a site is accessible before spending tokens. Check bot protection, detect frameworks.

Returns: { status, accessible, server, framework, botProtection, signals[], recommendation }

recommendation is one of: read | capture | auth_required | blocked

Example:

apitap_peek("https://www.zillow.com") → { status: 200, recommendation: "read" }
apitap_peek("https://www.doordash.com") → { status: 403, botProtection: "cloudflare", recommendation: "blocked" }

Tier 1: Read (0-10K tokens, no browser)

apitap_read

Extract content from any URL without a browser. Uses side-channel APIs for known sites and HTML extraction for everything else.

apitap_read(url: string, maxBytes?: number) → ReadResult

Use when: You need page content, article text, post data, or listing info. Always try this before capture.

Returns: { title, author, description, content (markdown), links[], images[], metadata: { source, type, publishedAt }, cost: { tokens } }

Site-specific decoders (free, structured):

Examples:

# Reddit — full subreddit listing, ~500 tokens
apitap_read("https://www.reddit.com/r/technology")

# Reddit post with comments
apitap_read("https://www.reddit.com/r/wallstreetbets/comments/abc123/some-post")

# YouTube — 36 tokens
apitap_read("https://www.youtube.com/watch?v=dQw4w9WgXcQ")

# Wikipedia — 116 tokens
apitap_read("https://en.wikipedia.org/wiki/Artificial_intelligence")

# Grokipedia — full article with citations, 6M+ articles
apitap_read("https://grokipedia.com/wiki/SpaceX")

# Grokipedia — search across 6M articles
apitap_read("https://grokipedia.com/search?q=artificial+intelligence")

# Grokipedia — site stats and recent activity
apitap_read("https://grokipedia.com/")

# Twitter/X — full tweet with engagement, articles, quotes
apitap_read("https://x.com/elonmusk/status/123456789")

# Twitter/X article (long-form post) — full text extracted
apitap_read("https://twitter.com/writer/status/987654321")

# Any article/blog/news — generic extraction
apitap_read("https://example.com/blog/some-article")

# Zillow listing (bypasses PerimeterX via og: tags)
apitap_read("https://www.zillow.com/homedetails/123-Main-St/12345_zpid/")

Tier 2: Replay (1-5K tokens, needs skill file)

apitap_search

Find available skill files by domain or keyword.

apitap_search(query: string) → { found, results[] }

Use when: Looking for captured API endpoints. Search by domain name or topic.

apitap_replay

Call a captured API endpoint directly — no browser needed.

apitap_replay(domain: string, endpointId: string, endpointParams?: object, maxBytes?: number) → ReplayResult

Use when: A skill file exists for this domain. This is the cheapest way to get structured API data.

Returns: { status, data (JSON), domain, endpointId, tier, fromCache }

Example:

# Get live stock quote (Robinhood, no auth needed)
apitap_replay("api.robinhood.com", "get-marketdata-quotes", { symbols: "TSLA,MSFT" })

# Get NBA scores (ESPN)
apitap_replay("site.api.espn.com", "get-apis-personalized-v2-scoreboard-header")

# Get crypto trending (CoinMarketCap)
apitap_replay("api.coinmarketcap.com", "get-data-api-v3-unified-trending-top-boost-listing")

apitap_replay_batch

Replay multiple endpoints in one call.

apitap_replay_batch(requests: Array<{ domain, endpointId, endpointParams? }>, maxBytes?: number)

Tier 3: Capture (15-20K tokens, uses browser)

apitap_capture

Launch a headless browser to capture API traffic from a website.

apitap_capture(url: string, duration?: number) → { sessionId }

Use when: No skill file exists and apitap_read doesn't give you the data you need. This is expensive but creates a skill file for future free replays.

apitap_capture_interact

Send browser commands during an active capture session.

apitap_capture_interact(sessionId: string, action: string, ...) → result

Actions: click, type, navigate, snapshot, scroll, wait

apitap_capture_finish

End capture session, generate skill file, verify endpoints.

apitap_capture_finish(sessionId: string) → { skillFile, endpoints[] }

Auto-Router

apitap_browse

Automatic escalation: cache → skill file → discover → read → capture_needed.

apitap_browse(url: string, query?: string, maxBytes?: number) → result

Use when: You don't know which tier to use. This tries the cheapest option first and escalates automatically.

Inspection

apitap_inspect

Get details about a skill file's endpoints.

apitap_inspect(domain: string) → { endpoints[], metadata }

apitap_stats

Usage statistics across all skill files.

apitap_stats() → { domains, endpoints, tiers }

Decision Tree

Need web data?
│
├─ Know the domain? → apitap_search → found? → apitap_replay (cheapest)
│
├─ Unknown URL → apitap_peek first (free)
│   ├─ recommendation: "blocked" → STOP, tell user
│   ├─ recommendation: "read" → apitap_read (no browser)
│   ├─ recommendation: "capture" → apitap_capture (browser)
│   └─ recommendation: "auth_required" → needs human login
│
├─ Just need article/post content → apitap_read directly
│
└─ Need structured API data → apitap_capture → creates skill file → future replays free

Key Patterns

Instagram profile data (login wall bypass)

Instagram blocks all normal scraping (Googlebot UA, oembed, noembed). But the mobile API works:

curl -s 'https://i.instagram.com/api/v1/users/web_profile_info/?params={"user_name":"TARGET_USERNAME"}' \
  -H 'User-Agent: Instagram 275.0.0.27.98 Android (33/13; 420dpi; 1080x2400; samsung; SM-G991B; o1s; exynos2100)' \
  -H 'X-IG-App-ID: 936619743392459'

Returns: Full profile JSON — bio, follower/following counts, post count, contact info (email, phone), category, highlights, recent posts with captions/engagement.

When to use: Need Instagram profile data, follower counts, contact info, or recent post summaries. Works without auth.

Limitations: Only public profiles. Rate-limited if abused. Does NOT return full post feeds — just recent edge.

Morning news scan

# Scan multiple subreddits
for sub in ["technology", "wallstreetbets", "privacy"]:
    apitap_read(f"https://www.reddit.com/r/{sub}")

Stock research

# Live quote via captured API
apitap_replay("api.robinhood.com", "get-marketdata-quotes", { symbols: "TSLA" })

# Company fundamentals
apitap_replay("api.robinhood.com", "get-fundamentals", { symbol: "TSLA" })

Research any topic (dual knowledge base)

# 1. Read Wikipedia summary (established knowledge)
apitap_read("https://en.wikipedia.org/wiki/Topic")

# 2. Read Grokipedia article (AI-curated, with citations)
apitap_read("https://grokipedia.com/wiki/Topic")

# 3. Check Reddit discussion (community sentiment)
apitap_read("https://www.reddit.com/r/relevant_sub")

# 4. Read a linked article
apitap_read("https://news-site.com/article")

Check before committing

# Peek first — is it worth reading?
result = apitap_peek("https://some-site.com")
if result.recommendation == "read":
    apitap_read("https://some-site.com")
elif result.recommendation == "blocked":
    # Don't waste tokens
    pass

Token Economics

CLI Usage

All MCP tools are also available as CLI commands:

apitap peek <url> [--json]
apitap read <url> [--json] [--max-bytes <n>]
apitap search <query> [--json]
apitap replay <domain> <endpointId> [--params '{}'] [--json]
apitap capture <url> [--duration <sec>] [--json]
apitap inspect <domain> [--json]
apitap stats [--json]

Every command supports --json for machine-readable output.

ApiTap

The CLI, MCP server, and npm library that turns any website into an API — no docs, no SDK, no browser.

ApiTap is a CLI, MCP server, and npm library that lets AI agents (and you) browse the web through APIs instead of browsers. Point it at a site: it captures the internal API from real traffic, generates a portable signed skill file, and replays requests directly with fetch(). Credentials never live in the file — they stay in encrypted storage and are injected at replay — and replays are matched against the captured route shapes, so your agent learns an endpoint drifted before it fails mid-task. No DOM, no selectors, no flaky waits. Token costs drop 20-100x compared to browser automation. Sites that publish OpenAPI specs can skip capture entirely via apitap import (APIs.guru directory built in).

The web was built for human eyes; ApiTap makes it native to machines.

# Capture a site's private API once…
apitap capture https://polymarket.com

# …then replay it forever — no browser in this path
apitap replay gamma-api.polymarket.com get-events

# Read page content without a browser
apitap read https://en.wikipedia.org/wiki/Node.js
  ✓ Wikipedia decoder: ~127 tokens (vs ~4,900 raw HTML)

# Or import published OpenAPI specs directly
apitap import --from apis-guru --search stripe
apitap replay api.stripe.com get-listcharges limit=5

No scraping. No browser. Just the API.

How It Works

ApiTap has three ways to build its API knowledge:

1. Capture (30 seconds) — Launch a browser, visit a site, browse normally. ApiTap intercepts all network traffic via CDP, filters noise, and generates a skill file. Or use apitap attach to capture from your already-running Chrome.
2. Discover (automatic) — ApiTap auto-detects frameworks (WordPress, Next.js, Shopify) and probes for OpenAPI specs at common paths. Works without a browser.
3. Import (instant) — Import OpenAPI/Swagger specs from the APIs.guru directory of 2,500+ public APIs, or from any spec URL/file. Endpoints get a confidence score based on spec quality. No browser needed.

All three paths produce the same artifact: a skill file — a portable JSON map of an API's endpoints, stored at ~/.apitap/skills/.

Import:   OpenAPI spec → Converter → Merge → skill.json (confidence 0.6-0.85)
Capture:  Browser → CDP listener → Filter → Skill Generator → skill.json (confidence 1.0)
Attach:   Running Chrome → CDP attach → Filter → skill.json (confidence 0.8-1.0)
Replay:   Agent → Replay Engine (skill.json) → fetch() → API → JSON response
                                                ↑ no browser in this path

Confidence Model

Every endpoint tracks how it was discovered:

Imported endpoints auto-upgrade to confidence 1.0 on first successful replay. The merge is additive — captured data is never overwritten by imports, imports fill gaps that capture missed.

Install

npm install -g @apitap/core

Claude Code — one command to wire it up:

claude mcp add -s user apitap -- apitap mcp

That's it. 12 MCP tools, ready to go. Requires Node.js 20+.

Note: npx @apitap/core mcp does not work due to npm scoped package bin resolution. Use npx apitap mcp or apitap-mcp instead.

Optional: To use capture and browse (which open a real browser), also run:

npx playwright install chromium

The read, peek, discover, and import tools work without it.

Quick Start

Import APIs instantly

# Import from the APIs.guru directory (2,500+ public APIs)
apitap import --from apis-guru --limit 100

# Import a specific API by name
apitap import --from apis-guru --search stripe

# Import a single OpenAPI spec from URL
apitap import https://api.apis.guru/v2/specs/stripe.com/2022-11-15/openapi.json

# Import a local spec file (JSON or YAML)
apitap import ./my-api-spec.json

# Skip auth-required APIs (open endpoints only)
apitap import --from apis-guru --limit 500 --no-auth-only

# Preview what would be imported
apitap import --from apis-guru --search twilio --dry-run

# Update previously imported APIs (skip unchanged)
apitap import --from apis-guru --update

Import produces a diff showing what changed:

Importing api.stripe.com from OpenAPI 3.0 spec...

  ✓ 12 existing captured endpoints preserved
  + 34 new endpoints added from OpenAPI spec
  ~ 8 endpoints enriched with spec metadata
  · 0 skipped (already imported)

  Skill file: ~/.apitap/skills/api.stripe.com.json (54 endpoints)

Captured endpoints are never overwritten. Import fills gaps and adds metadata (descriptions, response schemas, query param enums) from the spec.

Capture API traffic

# Capture from a single domain (default)
apitap capture https://polymarket.com

# Capture all domains (CDN, API subdomains, etc.)
apitap capture https://polymarket.com --all-domains

# Include response previews in the skill file
apitap capture https://polymarket.com --preview

# Stop after 30 seconds
apitap capture https://polymarket.com --duration 30

ApiTap opens a browser window. Browse the site normally — click around, scroll, search. Every API call is captured. Press Ctrl+C when done.

Attach to a running Chrome

# Launch Chrome with remote debugging enabled
google-chrome --remote-debugging-port=9222

# Attach to your signed-in Chrome — captures all tabs
apitap attach --port 9222

# Filter to specific domains
apitap attach --port 9222 --domain *.github.com

# Ctrl+C to stop — generates signed skill files for each captured domain

No separate browser, no re-login. Captures from your real Chrome sessions with all your cookies and auth tokens. When response bodies are evicted from Chrome's buffer (common on high-traffic pages), skeleton endpoints are written at confidence 0.8 instead of being dropped.

List and explore APIs

# List all skill files
apitap list
  ✓ api.stripe.com             446 endpoints   5m ago   [imported-signed]
  ✓ gamma-api.polymarket.com     3 endpoints   2h ago   [signed]
  ✓ api.github.com             499 endpoints   1h ago   [imported-signed]

# Show endpoints for a domain
apitap show api.stripe.com
  [ ] GET    /v1/account                    object (22 fields)
  [ ] GET    /v1/charges                    object (4 fields)
  [ ] GET    /v1/customers/:customer        object (30 fields)

# Search across all skill files
apitap search stripe

Replay an endpoint

# Replay with captured defaults
apitap replay gamma-api.polymarket.com get-events

# Override parameters
apitap replay gamma-api.polymarket.com get-events limit=5 offset=10

# Machine-readable JSON output
apitap replay gamma-api.polymarket.com get-events --json

Text-Mode Browsing

ApiTap includes a text-mode browsing pipeline — peek and read — that lets agents consume web content without launching a browser. Seven built-in decoders extract structured content from popular sites at a fraction of the token cost:

Average token savings: 74% across 83 tested domains.

# Triage first — zero-cost HEAD request
apitap peek https://reddit.com/r/programming
  ✓ accessible, recommendation: read

# Extract content — no browser needed
apitap read https://reddit.com/r/programming
  ✓ Reddit decoder: 12 posts, ~627 tokens

# Works for any URL — falls back to generic HTML extraction
apitap read https://example.com/blog/post

For MCP agents, apitap_peek and apitap_read are the fastest way to consume web content — use them before reaching for apitap_browse or apitap_capture.

Bounding response size with --max-bytes

--max-bytes (MCP: maxBytes) is a hard cap on the full serialized response envelope, not just on the data or content field. It applies uniformly across apitap replay, apitap browse, and apitap read (including every built-in decoder — Wikipedia, Hacker News, Reddit, etc.), so a bounded call returns a bounded envelope no matter which path served it.

apitap replay gamma-api.polymarket.com get-events --json --max-bytes 4000
apitap read https://en.wikipedia.org/wiki/Node.js --max-bytes 4000

How the cap is honoured:

• Read path — links are shrunk first (deduped, then halved), then content is re-sliced byte-accurately. When content is cut, the envelope carries contentTruncated: true so the truncation is never silent.
• Replay path — the data payload is trimmed to fit under the same budget, flooring at a 512-byte data minimum so a pathologically small --max-bytes still returns usable data (the only documented case where the envelope may exceed the cap).
• envelopeBytes — every capped response reports its own actual serialized siz