goodnight000/api-anything

Teach your agent a website once. After that, it calls the site like an API instead of driving a browser.

API Anything watches a site's own page make a request and learns which parts of it are your inputs. It saves the result as an operation. Your agent calls that operation with new inputs over MCP, the CLI or TypeScript, and gets JSON back over plain HTTP.

_{Same agent (Claude Opus 5.5), same prompt, started together. Left: it drives headless Chrome through Playwright MCP. Right: it calls API Anything's Google Flights operation. Shown at 3× speed with no cuts; the timers show real elapsed time. Recorded 2026-09-28. MP4 · how it was recorded}

Across 5 runs of each task, the agent using API Anything answered 1.5 to 2× sooner, read about half as many tokens, and cost the same or less. All 20 answers were correct. Method, raw numbers and limits.

Paste this into Claude Code, Codex or another coding agent:

Set up API Anything for me: https://github.com/goodnight000/api-anything/blob/main/INSTALL.md

The agent checks Node 22.13+, builds and installs the api-anything command, confirms that a call works, then connects the MCP server and the skill to itself. Restart the agent, then ask it something like "What does Goodreads rate Piranesi?"

git clone https://github.com/goodnight000/api-anything.git && cd api-anything
npm ci && npm install -g "$(npm pack --silent)"
api-anything call hacker-news search query=sqlite

{"ok":true,"class":"ok","tier":1,"data":[{"title":"Hosting SQLite databases on GitHub Pages or any static file hoster","url":"https://phiresky.github.io/blog/2021/hosting-sqlite-databases-on-github-pages/", ...}, ...],"ms":111}

{ "mcpServers": { "api-anything": { "command": "api-anything", "args": ["mcp"] } } }

Over MCP an agent calls operations, using four tools: list_sites, list_operations, call_operation and login. To create operations, an agent needs a shell and the skill. A Chromium browser is needed only for creating operations and for the browser tier — Google Chrome by default, or Brave, Edge, Chromium, Vivaldi, Arc; any Chromium executable works via API_ANYTHING_BROWSER. Setup details.

Give it the page URL with a placeholder, and two example inputs:

api-anything add hn-demo links \
  --trigger 'https://news.ycombinator.com/from?site={domain}' \
  --example domain=github.com --example2 domain=github.io --match path=/from \
  --html '{"items":"tr.athing","fields":{"title":".titleline > a","url":".titleline > a@href"}}'

api-anything call hn-demo links domain=arxiv.org      # 30 arxiv.org stories, tier 1

The headless browser loads the page once for each example. The part of the request that changed with the input becomes a parameter, and the rest is stored as a template. The agent (or you) picks the request and the fields. API Anything builds the template without an LLM. Recorded demos.

Tell an agent what you need from a site. The skill makes it do this, in order:

1. Ask about whatever the request leaves unclear.
2. Propose operations and wait for your approval.
3. Scout each page with capture --outline. This is a summary of what each request returns, so the agent doesn't have to read full responses.
4. Build each operation and check it with an input that wasn't an example.

Goodreads has had no public API since 2020. One run took 6.3 minutes and $1.19. It produced search, book details, an author's books and reviews:

api-anything call goodreads searchBooks q=piranesi
api-anything call goodreads getBook bookId=50202953

• Tested on unseen books. The test used 30 books that nobody used while building the operations. For the 29 books the search found, every checked field matched the page Chrome rendered: title, rating, ratings count and pages. All 146 calls went over plain HTTP.
• Agent comparison. An agent using the operations answered 5 books in 30.5 s; the browser agent took 182.5 s. For one book, it cost a third as much.
• No agent needed. A plain script (examples/reading-list.mjs) builds the same five-book table in 16 s with no model.

How it was explored, tested and compared.

22 read operations across 9 sites:

• google-flights: search, top flights, price calendar
• hacker-news
• x and instagram profiles
• search on youtube, airbnb and amazon
• linkedin: profiles, companies and search, with your own login
• goodreads: search, books, author lists and reviews, built by the explorer above

They cover selected features, not whole sites. api-anything ops <site> lists parameters and caveats.

• Learn. The headless browser records the page's requests for two example inputs. The request that followed the inputs becomes a template with slots, and cookies and tokens become references to a local store.
• Call. Fill the slots and send the request with Node's fetch. If the site blocks that, fetch from inside a browser page. As a last resort for reads, run the page itself and read its own response.
• Repair. If the request stops working (a rotated id, a moved field), re-learn it and save the new version only after a replay succeeds. Otherwise the call returns an error, not someone else's data.

Details · design

For a site that needs an account, api-anything login <site> first tries to import that site's cookies from a browser profile you are already signed in to, so there is usually no password to type. If several profiles are signed in it asks which one, and if none can be imported it opens a browser window to sign in by hand. A saved operation holds references to cookies and tokens, never their values, so a refreshed session works without re-learning anything.

A session is kept current where that is possible. Cookies a site sets on a plain-HTTP response, or while API Anything runs the site's page in the browser, are saved. When a plain-HTTP call comes back unauthorized, API Anything tries these in order, each at most once, retrying the call after each one that changes something:

1. re-import from the browser profile you chose at login;
2. take the cookies from its own browser profile, if they differ from the saved ones;
3. for an operation that uses session tokens (a bearer, a CSRF token the page issues), reload the page so the site issues fresh ones. For a write, the page's own request is stopped, so it is sent only by the retry.

A read whose only credential is a key the site gives every visitor (X's web-app bearer) is re-learned from the page when the site rotates it. If the call is still unauthorized, it returns class: "auth" with the login command to run.

Import reads Chrome, Arc, Brave, Edge, Chromium and Firefox profiles on macOS and Linux (on Linux, not cookies encrypted with the desktop keyring). On Windows, login opens the browser window. Details

• It is a local tool, not a hosted API. It uses your machine, your network and your sessions.
• It knows only the operations it was taught. It doesn't support every feature of every site.
• Repair can fail. There is no CAPTCHA solving, and if a site challenges real Chrome, you have to clear the challenge by hand.
• No write operations are bundled. LinkedIn messaging isn't bundled and hasn't been tested against LinkedIn. Writes are tested only against a local fixture, and they need --allow-writes. An HTTP 2xx doesn't prove a message was delivered.
• Credentials stay in ~/.api-anything, and specs hold references, never values. Read each site's terms: you are responsible for how you use it.

All limits

Benchmark · Demos · Setup for agents · Reference · Design · Release checks · Contributing

MIT licensed.