Apitap
CLI, MCP server, and npm library that turns any website into an API — no docs, no SDK, no browser.
Last verified:
What is Apitap?
ApiTap is a Rust-based CLI tool and MCP server that turns any website into a structured API for AI agents. It finds and captures a website's internal API endpoints, then lets AI agents call them directly without using a browser, scraping HTML, or parsing the DOM. The result is clean structured JSON at a fraction of the token cost compared to browser automation.
The tool works in three simple steps: Capture (point ApiTap at any site, it opens a browser temporarily via Playwright to watch network traffic and identify real API endpoints while filtering out analytics and tracking noise), Skill File (generates a portable JSON map of the site's API with parameterized URLs, encrypted auth tokens, and HMAC signing), and Replay (your agent reads the skill file and calls the API directly with fetch(), no Chrome or DOM needed). This architecture delivers 90-97% token reduction compared to browser-based approaches.
ApiTap is designed for AI developers, agentes using Claude Code/Cursor/Windsurf, and anyone building AI agents that need to interact with web data. It includes an optional Chrome extension that silently builds an index of APIs as you browse (excluding banking/login/payment pages for privacy), supports 12 MCP tools with 925 passing tests, and is production-ready under an MIT license. Real-world tests show TechCrunch dropping from ~8,000 tokens to ~200 tokens (97% reduction) and Reddit from 125,805 tokens to 641 tokens.
Key features include built-in SQL transformations for API-to-PostgreSQL ETL pipelines, human login support for authenticated sites to capture session tokens, passive API discovery through the Chrome extension index, agent discovery via apitap_discover MCP tool, on-demand skill file promotion, and defense-in-depth security hardening. The tool is installed via npm install -g @apitap/core and integrates with claude mcp add -s user apitap -- apitap-mcp.
Apitap pricing
Pricing model: Freemium
ApiTap is free and open-source under the MIT license. It is installed via npm install -g @apitap/core with no paid tiers or subscription plans. The tool is production-ready with 925 passing tests and actively maintained. GitHub repository is publicly available. The Chrome extension is free when released. Self-hosting is available since it runs locally on your machine.
Apitap pros
- 90-97% token cost reduction versus browser automation
- No browser needed after initial capture step
- Returns structured JSON instead of fragile HTML parsing
- Works with Claude Code, Cursor, and Windsurf
- 12 MCP tools available with 925 passing tests
- Built-in SQL transformations for PostgreSQL ETL
- Portable skill files can be shared, versioned, committed
- Auth tokens encrypted at rest with HMAC signing
- Optional Chrome extension for passive API discovery
- Filters out analytics, tracking pixels, framework noise
- Human login support captures session tokens for authenticated sites
- Production-ready with MIT license, actively maintained
- 90%+ token reduction on real sites like TechCrunch and Reddit
- Agent discovery tool answers what endpoints exist instantly
- Privacy by design blocks banking/login/payment flows automatically
Apitap cons
- Requires initial browser capture step for each new site
- Chrome extension still in development, not on Chrome Web Store yet
- Only supports PostgreSQL for ETL pipelines
- Rust-based tool may have steeper learning curve than Python alternatives
- Skill file generation requires manual approval for on-demand promotion
- Does not support sites with heavily obfuscated or dynamic API endpoints
- Limited documentation available publicly
- No official GUI, CLI-only interface
Frequently asked questions about Apitap
What is ApiTap and what does it do?
ApiTap is a CLI tool and MCP server that turns any website into an API for AI agents. It finds a website's internal API endpoints, captures them in a skill file, and lets your agent call them directly with fetch() - no browser, no scraping, no DOM parsing. You get structured JSON at 90-97% less token cost than browser automation.
How does ApiTap reduce token costs?
Browser automation loads and parses entire HTML pages (often 68,000+ tokens), then converts to markdown lossily. ApiTap skips the browser after capture and calls the underlying API directly, returning only the structured JSON data needed. TechCrunch drops from ~8,000 tokens to ~200 (97% reduction), Reddit from 125,805 tokens to 641 tokens.
What are the three steps to use ApiTap?
Step 1 Capture: Run 'apitap capture https://site.com' - it opens a browser via Playwright, watches network traffic, identifies real API endpoints. Step 2 Skill File: A portable JSON map is generated with parameterized URLs, encrypted auth tokens, HMAC-signed. Step 3 Replay: Your agent calls 'apitap replay domain endpoint' and gets structured JSON directly via fetch() with no browser.
What AI assistants work with ApiTap?
ApiTap works with Claude Code, Cursor, and Windsurf. You install it via 'npm install -g @apitap/core' then add it with 'claude mcp add -s user apitap -- apitap-mcp'. It provides 12 MCP tools for AI agent integration.
Does ApiTap require a browser forever?
No. The browser is only used during the initial Capture step to watch network traffic and identify API endpoints. After the skill file is generated, the Replay step calls the API directly with fetch() - no Chrome, no DOM, no browser at all. The architecture explicitly states 'no browser after step one'.
What is the Chrome extension for?
The optional Chrome extension silently builds an index of API endpoints as you browse sites like Discord, Spotify, Notion - no infobar, no performance hit. It records endpoint shapes, auth types, and pagination patterns. Banking, login pages, and payment flows are automatically excluded. The extension enables passive API discovery and on-demand skill file promotion.
How does ApiTap handle authenticated sites?
For sites requiring login, ApiTap facilitates human login to capture session tokens, then returns control to the agent. Auth tokens are encrypted at rest in the skill file and HMAC-signed to prevent tampering. The agent can then use the captured session to call authenticated endpoints directly.
Is ApiTap open source?
Yes, ApiTap is open-source under the MIT license. The GitHub repository is at github.com/apitap/apitap. It has 925 passing tests, is production-ready, and actively maintained.
What is the skill file?
The skill file is a portable JSON map of a site's API generated during capture. It contains the domain, endpoints with IDs/methods/paths/tiers, parameterized URLs, encrypted auth tokens, and is HMAC-signed to prevent tampering. You can share it, version it, and commit it to version control. The agent reads it to call APIs directly.
Does ApiTap work with ETL pipelines?
Yes, ApiTap is a Rust-based ETL tool that streams APIs to PostgreSQL with SQL transformations. You can write SQL to transform API data and load it into PostgreSQL without Python scripts. This makes API-to-database pipelines simple with built-in scheduler support.