What is ferret?

Ferret is a tool for security testers who need to intercept and study HTTP traffic while they look for vulnerabilities in web applications. It works like a proxy that sits between your browser or testing tool and the target website, capturing every request and response so you can inspect, replay, or modify them, and it adds an AI assistant on top to help analyze what it sees. The project runs as a set of Docker containers: a proxy and API service built on FastAPI and mitmproxy that captures traffic and stores it in SQLite, a Next.js web interface for browsing that traffic, and a separate lab container that holds security testing tools like pytest, ffuf, and sqlmap. Getting started requires Docker, Docker Compose, and a command runner called just, after which one command builds and starts everything. Once running, a setup wizard walks new users through connecting an AI provider such as OpenRouter, OpenAI, Anthropic, Gemini, DeepSeek, Mistral, Ollama, or LM Studio, and no manual configuration file is required to begin. The tool itself listens as a proxy that any browser or testing tool can be pointed at, with an option to install a certificate so it can also inspect encrypted HTTPS traffic. Key features include a request history log with AI generated notes on each entry, a findings tracker for logging vulnerabilities by severity and host, a feature called Snare that lets you pause and edit requests before they reach the server, a persistent request editor called Gnaw for repeatedly resending modified requests, and Workspaces, which give each testing project its own folder of scripts, notes, and automated tests that run inside the lab container. Multiple projects can be kept separate, each with its own history, findings, and API keys. The project is written in TypeScript, released under the MIT license, and is aimed specifically at people doing authorized security assessments rather than casual browsing.