PandoraBox

A programmable MITM proxy — intercept, inspect, replay, and script HTTP/HTTPS traffic — with a compact CLI so an AI agent can drive it without burning context.

Download · Quick start · Agent CLI · Docs

_{History & inspector · Replay editor · Collaborator (out-of-band)}

---

Download

The easy way — grab a pre-built app from the Releases page. No build step.

OS	File	Notes
macOS · Apple Silicon	PandoraBox-…-arm64.dmg
macOS · Intel	PandoraBox-….dmg
Windows	PandoraBox-…-win.zip	Portable — unzip and run PandoraBox.exe
Linux	PandoraBox-….AppImage · .deb

Builds are unsigned. macOS: right-click the app → Open (or xattr -dr com.apple.quarantine PandoraBox.app). Windows: More info → Run anyway.

Prefer the terminal? Any release also runs headless:

./pandorabox serve      # web UI at http://localhost:7777

---

Quick start

1. Run it — open the app (or pandorabox serve). The UI is at http://localhost:7777.
2. Trust the CA — Settings → Certificate installs the root CA with per-platform steps, so HTTPS decrypts cleanly.
3. Point your browser at the proxy: 127.0.0.1:8080.

Traffic now streams into History in real time.

---

What it does

• History & Inspector — live capture with Pretty / Raw / Hex views, decoded bodies, and full-text + regex search.
• Intercept — hold, edit, forward, or drop requests in real time.
• Replay — edit the full raw packet and resend; back/forward through every sent packet and its response.
• Scope · Match & Replace · SiteMap — include/exclude rules, on-the-fly rewrites, and a host/path tree with HAR export.
• Intruder — fuzz a request across payload sets.
• Collaborator — an interactsh-backed host that catches blind DNS/HTTP/SMTP callbacks (SSRF, XXE, RCE).
• Flows · Python middleware — chain requests and script traffic programmatically.
• Projects — per-project SQLite storage and configuration.

Full walkthrough → wiki/features.md

---

Agent CLI — let an AI drive the proxy

PandoraBox exposes compact CLI commands backed by the local REST API. The defaults print short summaries; use --json only when an agent needs structured output.

pandorabox status
pandorabox traffic list -n 20 --host api.example.com
pandorabox traffic get 47 --headers
pandorabox traffic get 47 --body response --max-bytes 4000
pandorabox replay send 47
pandorabox intercept queue

For Codex-style agents, use the repository skill at skills/pandorabox-cli/SKILL.md.

The legacy MCP server is still available for compatibility, but it is opt-in: start with pandorabox serve --enable-mcp and then configure the endpoint shown in Settings → Agent CLI.

---

Build from source

Requires Go 1.23+ and Node 18+.

git clone https://github.com/hamedsj/PandoraBox.git
cd PandoraBox
make build          # npm build → embed UI → go build
./bin/pandorabox serve

Desktop app: make dev-electron to run · make electron-mac / electron-win / electron-linux to package.

Always use make build, never npm run build alone — the Go binary embeds the React bundle that the Makefile copies into place.

---

Docs

Features	Every page and option
Agent CLI	Compact commands for LLM agents
MCP	Legacy MCP compatibility
API	REST + WebSocket
Architecture	Packages and data flow
Development	Workflow and build pipeline
Database	SQLite schema

---

_{Apache-2.0 · For authorized security testing, CTFs, and research only.}