Cloak Proxy
for Mac · Free for life
A native macOS debugging proxy with an API client built in. Decrypt HTTPS, pause, mock and rewrite any request, catch the apps that skip the proxy, and let Claude drive it through MCP.
Cloak Proxy · All Traffic
CapturingGEThttps://api.example.com/v1/users/42200 · 84 ms
{
"id": 42,
"name": "Ada Park",
"plan": "pro",
"verified": true
}Everything a debugging proxy should do, and a few things none of them do
SSL Proxying
Most traffic is encrypted, so most proxies show you a wall of locked tunnels. Turn on SSL Proxying for an app or a domain and its requests open up: headers, bodies, cookies, timings.
Install & Trust
One click adds Cloak Proxy's certificate to your login keychain. macOS asks for your password.
Capture
The macOS proxy turns on by itself. Your previous proxy settings come back when you quit.
Decrypt
Pick an app in the sidebar and press Enable SSL Proxying. Only what you choose is decrypted.
auth.example.com:443
TLS 1.3 · MyApp
POST /v1/sessions HTTP/2 host: auth.example.com authorization: Bearer eyJhbGciOi… content-type: application/json { "email": "ada@example.com", "device": "iPhone 17 Pro", "remember": true }
10 debugging tools
Pause a request and edit it. Answer it from a file. Point it at staging, rewrite it with JavaScript, or slow the network to 3G. Every rule can be made from a captured request in two clicks.
Request paused
rule “Checkout”POST pay.example.com/v1/checkout
{
"plan": "free""pro",
"seats": 5,
"coupon": null
}Breakpoint
Pause matching requests or responses, edit the method, URL, headers or body, then send it on, send the original, or drop it.
GETapi.example.com/v1/usersserver
users.json200 · local
Map Local
Serve a local file, folder or inline response. The server is never contacted, so the backend doesn't have to exist yet.
GETapi.example.comstaging.example.com/v1/feed
Map Remote
Rewrite the scheme, host, port, path or query of matching requests, and keep the original Host header if you need to.
// runs before the app gets it function onResponse(ctx, url, res) { res.body.price = 0; res.headers["X-Debug"] = "1"; return res; }
Scripting
Change requests and responses in code, with a console for your logs. Handy when a rule isn't enough.
Network Conditions
3G, Edge, a very bad network, total loss or your own profile, for every request or just the ones that match.
GETapi.example.com/v1/cart200
POSTtelemetry.example.com/v2/events202403
GETcdn.example.com/app.css200
Block List
Block trackers, flaky third parties or a whole API, and see how the app copes.
Allow List
Only let chosen hosts through
DNS Spoofing
Point a host at another IP
No Caching
Strip cache headers everywhere
Mock Sets
Record a session, replay it offline
Alerts
Notify on errors, slow calls or a match
Sidebar · Not Using the Proxy
21 direct connectionsCaptured · api.payments.exampleOnly in Cloak Proxy
Some apps never ask macOS for its proxy: payment SDKs, gRPC clients, anything built on raw sockets. In other debuggers they simply never show up, and you can't tell why.
It notices. Cloak Proxy watches which apps connect to the internet directly and lists them under Not Using the Proxy.
You choose. Click one to see the domains it uses, read from its traffic and its own binary.
It captures. With your OK, lookups for those domains are answered by Cloak Proxy, so the app's requests come through it like everyone else's.
API client, built in
Right-click any captured request and it's a saved request in a collection. Then everything you'd reach for Postman for, in the same app: environments, scripts, tests, runs, mocks, load tests, specs and docs.
Run Petstore · 3 requests · 5 tests
5 passed11 protocols, one collection
Import Postman, OpenAPI, HAR or cURL. Export back to Postman.
Scripts and tests
Postman-style pm.* scripts before and after every request
Runner and datasets
Iterations, CSV or JSON data, JUnit reports
Mocks and specs
Mock servers from examples; OpenAPI lint and sync
Flows and monitors
Chain requests with logic; run them on a schedule
Model Context Protocol
Cloak Proxy is an MCP server. Claude Code, Claude Desktop, Cursor or any MCP client can read your traffic, replay requests, set up mocks and breakpoints, and run your collections. Anything you can do in the app, it can do too.
It only answers your own Mac, using a token stored on it. Assistants are told to ask before deleting anything or turning capture off.
Claude · cloak-proxy MCP
82 toolsCheckout fails in MyApp. Why?
list_requests(errors_only: true, app: "MyApp")
↳ #412 POST pay.example.com/v1/charge → 503
get_request(id: 412)
↳ 503 · upstream timed out after 30 s · Retry-After: 30
upsert_rule(tool: "mapLocal", url: "*/v1/charge", status: 200)
↳ Map Local on · rule “Charge OK”
replay_request(id: 412)
↳ 200 OK · 41 ms · served by Map Local
The payment API is timing out (503 after 30 s), so checkout never completes. I've mocked /v1/charge with a 200 so you can keep testing the flow. Switch the rule off in Tools once the API is back.
The real app
Written in Swift, with a command palette for everything (⇧⌘A) and Insights that flag leaked keys, slow endpoints and API changes on their own.
Everything inside
From the first byte on the wire to a load test in CI. Search it, or just read it.
152 features, all free
Click any feature to read its documentation, or browse docs.subcloak.com.
01 · 20 features
Cloak Proxy sits between your apps and the internet and records HTTP/1.1, HTTP/2 to apps and servers, HTTPS tunnels, WebSocket (ws and wss) and gRPC. It decrypts with SSL Proxying per app or per host, with wildcards, leaves the hosts on your bypass list alone, and catches apps that ignore the macOS proxy through per-app DNS capture. It turns the macOS proxy on at launch and restores your settings on quit, and a proxy guard puts your network back if it ever quits unexpectedly. Traffic is grouped by app, with icons and by domain, with pinned apps and domains and a sidebar filter. It also runs as a SOCKS5 proxy, a reverse proxy, or behind an upstream HTTP or SOCKS5 proxy with auth.
02 · 33 features
Every request opens with request and response side by side: headers, query, body, form fields, cookies, GraphQL query and variables, JWT and Basic auth decoding, raw and a timing summary. Bodies show as a JSON tree with search and highlight, JSONPath and jq queries, or as Pretty, Raw and Hex, with HTML and image previews. It decodes gzip, deflate and Brotli, Protobuf, MessagePack and multipart forms, and Quick Preview reads Base64, JWTs, URL encoding and timestamps. The list has sortable, customizable columns, colored methods and status codes, filters with regex, content-type chips, saved filter presets, highlight colors and comments. Diff any two requests, and find anything with the command palette and global search.
03 · 19 features
Breakpoints pause requests and responses so you can edit them. Map Local answers from a file, folder or inline response, Map Remote points requests somewhere else, Block List and Allow List decide what gets through, Network Conditions simulates 3G, Edge or packet loss, DNS Spoofing sends a host to another IP, No Caching strips cache headers, and JavaScript scripting rewrites anything, with a script console and shared state. Rules use wildcard or regex matching with a live URL tester, can be made from any request, and exported or imported as JSON. Mock Sets record a session and replay it offline. Send things again with Repeat, Edit & Repeat and Compose.
04 · 9 features
Insights reads your traffic for you: an API catalog with p50 and p95 timings, a secret and PII scanner, security header and cookie grades, a waterfall timeline, performance hot spots, schema change detection and alerts for errors, slow calls or matching responses. Share it as a Markdown report.
05 · 11 features
Debug more than your Mac: iPhone and iPad, the iOS, tvOS and watchOS Simulator with a one-click certificate, Android emulators and USB devices in one click, and a Terminal set up for Node, Python, Ruby, Go, curl and git. There are guides for Java, Firefox, Docker, Flutter and Electron, a certificate page with a QR code, and an IP allow list for other devices.
06 · 4 features
Bring your own root CA, use client certificates for mutual TLS, regenerate or remove the certificate any time, and write TLS keys for Wireshark.
07 · 9 features
Save sessions, import and export HAR, open Charles sessions, and export to CSV, a Postman collection or OpenAPI 3 with inferred schemas. Redact secrets on export, publish to a GitHub Gist, or copy any request as cURL and 19 other languages.
08 · 39 features
Any captured request becomes a saved request. Organize collections and folders, environments, globals and a vault for secrets, and write pre-request and test scripts with the pm.* API and shared script packages. Send HTTP, GraphQL with a schema explorer, gRPC with reflection, WebSocket, Socket.IO, MQTT 3.1.1 and 5, MCP, AI model requests, SQL for PostgreSQL, MySQL and SQLite and TCP, TLS and UDP, with 10 auth types including OAuth 2.0 and AWS Signature. Run collections in the collection runner with iterations and datasets, load test them with fixed, ramp, spike and peak profiles, serve them as mock servers, chain them into flows, watch them with monitors and webhooks. Keep OpenAPI specs with linting and sync, generate API docs, SDKs in TypeScript, Python and Swift and an MCP server from any collection, leave comments, browse history, recover from Recently Deleted, get help from Agent Mode, and version everything with Git.
09 · 8 features
From the terminal, cloakctl lists, shows and replays traffic, runs collections like Newman with JUnit reports, starts mocks and load tests, and runs as a headless CI recorder. A token-protected local API and an MCP server with 82 tools let scripts and AI assistants like Claude drive the whole app.
No trial. No tiers. No account.
Every feature on this page, free forever. We build Cloak Proxy for our own testing work and want it in every developer's hands. It's on the Mac today, and coming to every platform you debug on.
No account and no cloud. Traffic, collections and secrets stay on your machine.
The API client's workspace is a folder of small JSON files, one per request, so it can live in Git next to your code.
cloakctl replays, exports and runs collections from the terminal, and records traffic headless in CI.
Yes, for life. There's no trial, no paid tier and no account, and every feature on this page is included. We ask for your name and email when you download so we can tell you about new releases.
Any Mac with macOS 14 Sonoma or later, Apple silicon or Intel.
Yes, all four are on the way. Leave your email when you download and we'll tell you when your platform is ready.
Cloak Proxy isn't notarized by Apple yet, so the first time you open it macOS asks you to confirm. Open System Settings › Privacy & Security, scroll down and click Open Anyway. You only do this once.
No. Cloak Proxy runs entirely on your Mac and has no account or cloud sync. Captured requests stay on your Mac unless you export them, publish one as a Gist, or send them to an AI model you've set up yourself.
Cloak Proxy creates its own root certificate on your Mac, unique to your install, and adds it to your login keychain only when you click Install & Trust (macOS asks for your password). You can remove it from the Keychain or regenerate it from Settings at any time, or use your own CA.
Yes. The Devices button walks you through iPhone, iOS Simulator, Android, Firefox, Java, Docker and Terminal setup, with the steps for trusting the certificate on each.
Apps that pin their certificates refuse any certificate but their own, so no proxy can decrypt them without changing the app. Leave SSL Proxying off for those hosts and their traffic passes through as normal tunnels, so the app keeps working and you still see which hosts it talks to.
Yes. cloakctl lists and replays captured requests, runs collections like Newman (with JUnit output), starts mock servers and load tests, and can run as a headless proxy that records traffic in CI.
Download Cloak Proxy free. One disk image, Apple silicon and Intel, macOS 14 Sonoma or later.
Download for Mac
Tell us who you are and it's yours, free for life.