# Zatanna's Kampala tool intercepts app traffic to replay it as automation The macOS-only utility captures HTTP/S requests from apps and browsers, maps tokens and sessions, and exports replayable flows while preserving HTTP and TLS fingerprints; Windows support is still a waitlist. Canonical URL: https://freelancenews.online/news/zatanna-launches-kampala-a-mitm-proxy-that-converts-apps-into-apis Published: 2026-09-20T20:35:08.132Z Updated: 2026-09-25T14:26:38.711Z Source published: 2026-04-16T15:19:54.000Z Event date: Not established Review status: source-reviewed Review method: Automated comparison against retrieved source text; not independent fact-checking. Editorial note: Updated after automated comparison with the full extracted source text. Attribution, wording and practical context were re-evaluated; this is not an independent fact check. ## Report Zatanna has published a product page for Kampala, a tool it describes as able to "reverse engineer websites, mobile apps, and desktop software instantly" and then turn the observed request flow into repeatable automation. The page is the only supplied source, and it is vendor material rather than independent reporting, so every capability below is the publisher's own description rather than a verified test result. Traffic interception is the mechanism that gets stated. In the page's account, a user is allowed by Kampala to observe, in real time, each HTTP/S request originating from any browser or app, and the tool performs "full traffic interception." The page does not explain how the interception is implemented, what configuration it requires, or whether it operates as a system proxy, a browser extension or something else. Beyond simply viewing requests, the page says Kampala maps "tokens, cookies, sessions, and multi-step sequences automatically." This matters for automation work because multi-step flows — a login, a token refresh, a paginated fetch — are usually the part that is hardest to reproduce reliably by hand. The vendor claims this mapping happens without manual reconstruction, though no method, accuracy figure or sample is given. A second claimed capability is flow replay and export: the page states that users can "capture sequences and replay them as stable automations." The word "stable" is the vendor's characterization; the supplied evidence contains no benchmark, failure rate or longevity data for exported flows, so how stable they remain over time is unknown. Documented as the third feature is fingerprint preservation. According to the page, the ability to keep the connection's low-level HTTP and TLS traits unchanged, so that replayed traffic resembles the software it came from, belongs to Kampala. The page presents this as the purpose of the feature — maintaining the fingerprint so intercepted traffic behaves like the original — but it does not say which servers, protocols or client libraries were used to validate that behavior. Which capabilities are available and which are not is stated plainly on the page. For those on macOS, the instruction reads: "download Kampala and begin inspecting software traffic on macOS today." A waitlist applies to Windows instead, with this message displayed to visitors: "join the waitlist" and a promise that word will come once Windows support is ready. Accordingly, the tool appeared at that time to run on macOS only; rather than a shipped feature, Windows was presented as something anticipated later. The supplied evidence does not include a release date, version number, price, license terms or company background. The page's own framing is promotional — "Everything you need to reverse engineer any software flow" — and no independent review, changelog or documentation is provided to corroborate the feature list. The candidate's suggested framing that Kampala "converts apps into APIs" is not language the page itself uses; the page talks about reverse engineering software and turning request flows into repeatable automation, which is a narrower and differently worded claim. For freelancers and developers who build integrations, the practical appeal is the gap between observing a flow and automating it. Manually tracing a multi-step sequence, extracting the relevant tokens and cookies, and then reproducing the connection characteristics is slow, brittle work; a tool that claims to do the mapping and replay in one place targets exactly that bottleneck. That is the vendor's positioning, not a measured time saving. The practical implication for this audience is conditional rather than settled. If the described interception, mapping and replay work as stated, Kampala could shorten the reconnaissance phase of building an automation against a service that has no public API. That is editorial interpretation of the vendor's claims, not a tested outcome, and it assumes the user has a legitimate basis for automating the traffic in question. There are real tradeoffs to weigh. Intercepting HTTP/S traffic and replaying it with preserved fingerprints is a technique that sits close to the line between interoperability work and circumvention, and the page says nothing about terms-of-service considerations, consent, or how the tool handles credentials it captures. Nothing in the evidence addresses those questions either way, so readers should not assume the vendor has resolved them. The limitations are substantial. The evidence is a single vendor page with no pricing, no release date, no version, no platform support beyond macOS, and no third-party verification. Claims such as automatic mapping of sessions and "stable" replay are assertions, not demonstrated results, and the Windows build is explicitly not available yet. A reader evaluating Kampala should therefore treat the feature list as a statement of intent from the publisher. The concrete, checkable facts are narrow: the tool is described as intercepting HTTP/S traffic, mapping tokens and sessions, replaying captured sequences, preserving HTTP and TLS fingerprints, and shipping for macOS with Windows on a waitlist. What remains unknown is how any of this performs in practice — on which apps, against which anti-automation measures, and with what maintenance burden as the target software changes. The page offers no answers, and no independent source in the evidence fills the gap. The useful conclusion is to file Kampala as a macOS-only intercepting proxy with an automation-oriented export path, described by its maker, and to verify the replay and fingerprint claims against a real target before relying on them. Until Windows ships and independent accounts appear, the vendor page is the whole of the available record. ## Key points - Zatanna's page describes Kampala as intercepting HTTP/S traffic from apps and browsers in real time. - The vendor says it automatically maps tokens, cookies, sessions and multi-step sequences, and can replay captured flows as automations. - The page claims HTTP and TLS fingerprint preservation so replayed traffic behaves like the original. - macOS is available now; Windows is a waitlist, and the evidence includes no price, version or release date. ## Practical implications — editorial interpretation If the described interception, session mapping and replay work as claimed, Kampala could cut the manual reconnaissance time freelancers and developers spend when automating a service that has no public API. This is editorial interpretation of vendor claims, not a tested result, and it presumes a legitimate basis for automating the traffic. ## Limitations and unknowns Single vendor page, no independent verification, no pricing, version or release date. Windows is waitlisted, not shipped. Claims of automatic session mapping and "stable" replay are assertions without benchmarks. The evidence does not address terms-of-service, consent or credential handling. ## Sources - [1] zatanna.ai: See every request. Automate any workflow. https://www.zatanna.ai/kampala Retrieved: 2026-09-25T14:26:27.971Z ## Claim references - Kampala is described as intercepting HTTP/S traffic from any app or browser in real time. [source 1] - The vendor says it automatically maps tokens, cookies, sessions and multi-step sequences. [source 1] - Captured sequences can be replayed and exported as automations, per the page. [source 1] - The tool is said to preserve HTTP and TLS fingerprints so intercepted traffic behaves like the original. [source 1] - macOS download is available now while Windows support is a waitlist. [source 1]