Cloak Proxy
Cloak Proxy is a free, native macOS HTTPS debugging proxy with a built-in API client. Capture, decrypt, change and test traffic from your Mac, phones and code.
Cloak Proxy is an HTTPS debugging proxy for the Mac, with a full API client built in. It sits between your apps and the internet, shows you every request and response, and lets you change them on the way. It’s a native Mac app by Subcloak, it runs entirely on your Mac, and it’s free for life.
Every request and response, decrypted, in one window.
What you can do with it
Section titled “What you can do with it”- See what your apps send. Capture traffic from Mac apps and browsers, iPhones and iPads, simulators, Android devices, and command-line tools, and decrypt HTTPS for the apps and hosts you choose.
- Change traffic without changing code. Pause and edit requests, answer them with local files, redirect them to staging, script them in JavaScript, slow them down or block them.
- Work offline. Record real responses and replay them later without the network.
- Understand an API. Turn captured traffic into an endpoint catalog, security grades, a list of leaked secrets, performance problems and schema changes.
- Build and test APIs. Use the built-in API client for collections, environments, tests, a runner, load tests, mock servers and ten protocols.
- Automate it. Drive everything from the
cloakctlcommand line, CI pipelines and AI assistants over MCP.
Get started
Section titled “Get started”Cloak Proxy is free for life: no trial, no license key, no account.
Tour of Cloak Proxy
Section titled “Tour of Cloak Proxy”Capture traffic
Section titled “Capture traffic”Point your Mac’s proxy settings at Cloak Proxy with one click, and decrypt HTTPS for an app or a set of hosts. Your previous settings come back when you quit, even after a crash.
- Capture macOS traffic: turn capture on or off, auto-on at launch, the proxy guard and the bypass list.
- SSL Proxying: decrypt by app, by host or with wildcards; locked tunnels and pinned apps.
- Root certificate: trust, remove, regenerate, use your own CA, client certificates and TLS key logs.
- Apps that ignore the proxy: find them and capture them through DNS.
- Network settings: port, other devices, HTTP/2, external proxy, SOCKS5 and reverse proxies.
- Recording and sessions: pause, clear, and how sessions are kept.
Devices and runtimes
Section titled “Devices and runtimes”Capture phones, simulators, other computers and code running in a terminal or a container.
- Devices overview
- iPhone and iPad
- iOS Simulator
- Android
- Terminal and runtimes: Node.js, Python, Ruby, Go, curl, git, Deno and the AWS CLI.
- Java, Firefox, Docker, Flutter and Electron
- Other devices and access control: let devices connect, limit which may, and the certificate page.
Inspect traffic
Section titled “Inspect traffic”Find the request you need and read every part of it.
- Traffic list: columns, sorting, colors, highlights and comments.
- Sidebar: apps, domains, pinned items and apps that skip the proxy.
- Filtering: quick filters, content chips, multiple filters and presets.
- Inspector: every request and response tab.
- Body viewers: JSON tree, JSONPath, jq, HTML and image previews, Protobuf and MessagePack.
- WebSocket and GraphQL
- Quick Preview: decode Base64, JWTs, URL encoding and timestamps.
- Compare requests
- Search and command palette
- Copy as code: cURL and other languages.
- Failed requests and tunnels
Debugging tools
Section titled “Debugging tools”Change requests and responses as they pass through, with rules that match by URL and method.
Eleven debugging tools, each with its own rules.
- Tools overview and Rules and matching
- Breakpoint: pause and edit requests and responses.
- Map Local: answer requests with local files or inline responses.
- Map Remote: send requests to another server.
- Scripting: change traffic with JavaScript.
- Block List and Allow List
- Network Conditions: latency, bandwidth and packet loss.
- DNS Spoofing
- No Caching
- Mock Sets: record and replay offline.
- Alerts: notifications for failures, slow responses and more.
- Repeat and Compose
Insights
Section titled “Insights”Analysis of everything you captured, computed on your Mac.
Insights flags leaked secrets, slow endpoints, errors and schema changes.
- Insights overview
- Endpoints: an API catalog with timings and error rates.
- Security: grades for headers and cookies.
- Secrets: leaked keys, tokens and personal data.
- Performance
- Schema changes
- Timeline
- Alerts history
- Report: a Markdown summary.
Sessions and sharing
Section titled “Sessions and sharing”Keep, move and share captured traffic.
- Save and open
.cloaksessionfiles. - Import HAR, Charles and cURL.
- Export HAR, CSV, Postman, OpenAPI and sessions.
- Redaction: strip secrets before you share.
- Publish to Gist
API client
Section titled “API client”A full API client in its own window (⇧ ⌘ O), stored as a folder of JSON files you can keep in Git.
Collections can mix every protocol.
- API client overview
- Workspace and Git
- Collections and requests
- Authorization
- Variables and environments
- Scripts and tests
- Examples and docs
- Capture to client: save captured requests.
- History and recently deleted
- Comments
- Import and export
- Code snippets
- Agent Mode
Protocols: HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT, MCP, AI, SQL and data, and TCP and UDP.
Run, test and mock: the collection runner, datasets and data files, load testing, mock servers, monitors and webhooks, flows, specs, and generating docs, SDKs and MCP servers.
Automation and AI
Section titled “Automation and AI”- cloakctl: the command-line tool.
- Headless and CI: record and test in pipelines.
- Control API: the local REST API.
- MCP server: connect Claude Code, Claude Desktop, Cursor or VS Code.
- MCP tools reference
Guides
Section titled “Guides”Step-by-step walkthroughs for common jobs:
- Debug a mobile app
- Mock a backend
- Test on a slow network
- Find leaked secrets
- Demo offline with Mock Sets
- Capture an app that ignores the proxy
- Run API tests in CI
- Debug with Claude
- Pentest your own app
- Debug webhooks and callbacks
- Turn traffic into API docs
Reference
Section titled “Reference”Requirements
Section titled “Requirements”| macOS | 14 Sonoma or later |
| Mac | Apple silicon or Intel (one universal app) |
| Download | About 30 MB, from subcloak.com/apps/cloak-proxy |
| Optional | Xcode for one-click iOS Simulator setup; Android platform tools (adb) for one-click Android setup |
Free for life
Section titled “Free for life”Cloak Proxy costs nothing, now or later. There’s no trial, no license key and no account, and every feature is included. Your traffic, rules and certificate stay on your Mac. See Free for life.