frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Show HN: Plaidify – Give AI agents access to any login-protected website

https://github.com/meetpandya27/plaidify
2•meetpandya99•1h ago
Every AI agent hits the same wall: the world's most valuable data is locked behind login forms. Bank balances, utility bills, insurance policies, academic transcripts — none of them have APIs. Plaid covers banks for $500+/mo. Everything else? You write fragile Selenium scripts.

Plaidify is open-source infrastructure that turns any login-protected website into a REST API. You drop a JSON "blueprint" into the connectors folder — CSS selectors for username, password, submit, and what to extract — and you get a structured JSON endpoint. No scraper code to write.

It's designed specifically for the AI agent era. The repo includes ready-to-copy integration code for LangChain, CrewAI, OpenAI function calling, and a planned MCP server so Claude/GPT can use it as a native tool.

What's built today: FastAPI with 19 endpoints, JWT auth, Fernet credential encryption at rest, Alembic migrations, 53 tests at 80% coverage, Docker support, CI pipeline. What's NOT built yet: the Playwright browser engine (it returns simulated responses today). We're building in public.

The hardest and most impactful open contribution is the Playwright engine — replacing the stub with real browser automation. Blueprint contributions (write a JSON file for a public test site) are easy first issues.

MIT licensed. Python 3.9+. Self-hosted — credentials never leave your infrastructure.

Comments

gnabgib•1h ago
You'd be violating almost every site's Terms-Of-Service (TOS) using this. If you use it for banking, you'll never get any money back you lost.

> Credential encryption handled for you

Ugg. Especially with a README (and post) that's clearly LLM generated.

> Encryption at rest (AES-128-CBC)

AES-128 is entirely discouraged by OWASP (ideally AES-256), while CBC (and CTR) modes are likewise discouraged in favour of GCM/CCM.. for something that's holding credentials to payment systems or banks - you should be exceeding acceptable (AES128 was approved in 2001 - try ChaCha20, ThreeFish)