Controlled local endpoint mapping

Use a native endpoint setting first. This fallback is for a workstation and application you are authorized to administer, where the client cannot change an otherwise compatible HTTPS API origin. It requires a local intercepting proxy and explicit trust in that proxy's own CA. Applications with certificate pinning or separate trust stores may not work.

The example maps https://api.deepseek.com/ to https://api.b2b-llm.com/. It intentionally retains the method, path, query and JSON fields. The destination, TLS connection and Host/HTTP2 authority change; this is not a byte-preserving relay or a converter between API protocols.

Response streaming helper

Create b2b-response-stream.py beside the commands below:

from mitmproxy import ctx, exceptions

def configure(updated):
    if ctx.options.stream_large_bodies is not None:
        raise exceptions.OptionsError('Keep request buffering enabled for URL mapping.')

def requestheaders(flow):
    flow.request.stream = False

def responseheaders(flow):
    if flow.response is not None:
        flow.response.stream = True

Requests must remain buffered until map_remote has applied its rewrite. The helper enables streaming for responses only. Do not set a global stream_large_bodies=1 threshold with this recipe.

Windows preparation

Install the official native Windows build from mitmproxy. Start and stop it once under the same account that will run capture:

mitmweb --listen-host 127.0.0.1 --web-host 127.0.0.1

After Ctrl+C, import only your installation's public CA into Current User trust:

$ca = Join-Path $env:USERPROFILE '.mitmproxy\mitmproxy-ca-cert.cer'
if (-not (Test-Path -LiteralPath $ca)) { throw 'Initialize the proxy under this account first.' }
certutil -user -addstore Root "$ca"
if ($LASTEXITCODE -ne 0) { throw 'Certificate import failed.' }

Machine-wide trust needs administrator approval and a matching machine-store removal later. Do not distribute the private mitmproxy-ca.pem file. Restart the application after importing trust.

For the Visual Studio process, use an elevated PowerShell when capture permissions require it, preserving the same account/CA profile:

mitmweb --mode local:devenv `
  --listen-host 127.0.0.1 --web-host 127.0.0.1 `
  --allow-hosts '^api\.deepseek\.com(:443)?$' `
  --set connection_strategy=lazy --set upstream_cert=false `
  --set stream_large_bodies --set store_streamed_bodies=false `
  -s .\b2b-response-stream.py `
  --set 'map_remote=|^https://api\.deepseek\.com(?::443)?/|https://api.b2b-llm.com/'

devenv is Visual Studio, not VS Code. An extension may use a helper process; identify it with Get-Process and use its actual PID as local:12345 when necessary. Do not expand capture to the entire machine simply because the first process name did not produce traffic.

Linux preparation

Local Capture requires a supported kernel; the documented floor for this recipe is Linux 6.8. Start mitmweb as the ordinary user so its privileged helper can request sudo when needed. WSL is not a supported substitute for native process capture. Remote development processes must be configured where they actually run.

After initializing the CA, prefer the application's documented custom-CA mechanism. For Debian/Ubuntu system-store applications, an approved system-wide import is:

sudo install -m 0644 "$HOME/.mitmproxy/mitmproxy-ca-cert.pem" \
  /usr/local/share/ca-certificates/b2b-local-proxy.crt
sudo update-ca-certificates

Run a scoped mapping for the actual request-producing process:

mitmweb --mode local:code \
  --listen-host 127.0.0.1 --web-host 127.0.0.1 \
  --allow-hosts '^api\.deepseek\.com(:443)?$' \
  --set connection_strategy=lazy --set upstream_cert=false \
  --set stream_large_bodies --set store_streamed_bodies=false \
  -s ./b2b-response-stream.py \
  --set 'map_remote=|^https://api\.deepseek\.com(?::443)?/|https://api.b2b-llm.com/'

Test without leaking a credential

Start with a dummy token and nonsensitive prompt. Confirm that the rewritten destination is the intended company API, then configure a dedicated limited B2B LLM key in the client. A DeepSeek credential is not exchanged for a company key by the mapping. Original paths remain unchanged, so a missing /v1 prefix still needs a deliberate client-specific path rule. Keep source-host matching exact and anchored.

CA trust allows HTTPS decryption within the capture scope. Keep the proxy interfaces loopback-only, avoid flow exports and do not disable upstream TLS verification. Certificate pinning, signed requests and incompatible API bodies remain compatibility limits.

Undo in the safe order

Close the client or remove the company key from its original-provider field before stopping capture. Otherwise its next direct request may expose that key to the original provider. Stop mitmweb and restore the normal endpoint configuration.

For the Windows Current User import, identify and delete only that CA:

$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($ca)
certutil -user -delstore Root $cert.Thumbprint

For the Debian/Ubuntu system import:

sudo rm /usr/local/share/ca-certificates/b2b-local-proxy.crt
sudo update-ca-certificates

A failed cleanup command requires inspecting the corresponding trust store. Do not delete unrelated roots by a broad name match.