Limit what AI assistants can see

When an AI assistant is connected to Cloak Proxy’s MCP server, it can read everything you’ve captured. That’s a lot more than the app you’re working on: your browser, chat apps, and anything else going through the proxy. The assistant scope keeps the assistant to the traffic you choose, such as one app, a few hosts, a filtered view or the requests you highlight. You can also decide whether it gets bodies at all.

Cloak Proxy applies the scope itself, to every tool, resource and prompt the MCP server offers. The assistant can see what the scope is, but it can’t change it.

1234

Settings › AI Assistants with the scope limited to ShopApp's API hosts, metadata only.

1. Turns the scope on
2. Apps and hosts the assistant may see
3. Bodies, or metadata only
4. What happens to everything else

×

Set the scope

1. Open Settings › AI Assistants (or press ⇧ ⌘ A and type assistant).
2. Turn on Limit what AI assistants can see.
3. Add what the assistant may see. Each kind you fill in narrows the scope further, and within a kind any entry counts:
   • Apps: app names or bundle IDs, as the traffic list shows them. Pick from Seen Apps or type one.
   • Hosts: an exact host such as api.example.com, or *.example.com for its subdomains (not example.com itself; add both if you need both).
   • Query: a typed query, such as status:5xx -path:/health. Use Current View turns the front tab’s sidebar selection and filters into one.
   • Only requests I highlight: right-click requests in the traffic list and choose Highlight to share just those.
4. Choose what the assistant gets of Requests in the scope: Full requests and responses, or Metadata only.
5. Choose what happens to Everything else: Hidden (the default) or Metadata only.

The page shows how many requests the assistant sees right now. The scope applies at once, to assistants that are already connected too.

Faster ways in

From	Choose	The scope becomes
An app in the sidebar, or a request in the list	Limit AI Assistants to ShopApp	That app
A host in the sidebar	Limit AI Assistants to api.example.com	That host
A tab’s menu, or the query bar’s menu	Limit AI Assistants to This View	The tab’s sidebar selection and filters, as a query

Choose the same item again (Stop Limiting AI Assistants to ShopApp) to turn the scope off. Its settings are kept for next time.

While a scope is on, a capsule in the status bar says so, for example Assistants: ShopApp. Click it to open the settings.

1

The status bar shows when assistants are limited.

1. The assistant scope is on

×

Metadata only

With Metadata only, the assistant gets each request’s method, URL, status, timing, sizes and headers, and nothing it would need a body for:

• Request and response bodies, WebSocket messages and stream events are left out. get_request says a body was withheld and gives its size.
• Credentials in the URL and headers are replaced with REDACTED, even if Redact sensitive data before sending to AI is off.
• Tools that work on bodies, such as generate_types, get_protobuf, get_stream_events, build_replay_flow and Map Local from rule_from_request, say the bodies aren’t shared.
• Searches, trace_value and typed queries only look at what the assistant can see, so they can’t be used to find out what a body contains.

Use it when the assistant needs to know which calls an app makes and how they went, but not what’s in them.

What the assistant sees

	In the scope	Outside it, Hidden	Outside it, Metadata only
list_requests, cloak://requests/recent	Listed	Left out, with a count: (12 requests hidden by the assistant scope)	Listed without bodies
get_request, get_request_curl, cloak://requests/{id}	Full, or metadata only	Refused	Without bodies
Tools that take a request id (replay_request, edit_and_replay, compare_requests, annotate_request, rule_from_request and others)	Work	Refused: Request #12 is outside the assistant scope the user set in Cloak Proxy	Work, except those that need bodies
Searches and reports (search_requests, trace_value, insights, llm_calls, privacy_map, get_trace, check_contract, export_session)	Included	Left out	Included without bodies
Counts (proxy_status, list_apps, list_domains)	Counted	Not counted; proxy_status says how many are hidden	Counted

A few things work on all your traffic and can’t be limited, so they’re off while a scope is on: clear_session, start_live_share (and share links in list_live_shares), contract_report (use check_contract), mirror_report (use compare_environments) and script logs. The Doctor (diagnose_capture) leaves out findings about apps and hosts outside the scope, and browser console messages are shown only when the scope is limited by host alone.

The security tools keep to it too. The AI security tools (prompt_injection, mcp_manifests, review_mcp_manifest, ai_guard_log) leave out findings and guard entries for requests outside it, and MCP servers seen only there, and refuse ids outside it. list_findings and export_findings_report withhold evidence from requests outside it (and its bodies, where the scope shares metadata only), and add_finding only takes requests the assistant may read in full. See Findings and reports.

Requests an assistant sends through Cloak Proxy count as the request they copy: a replay of a ShopApp request is in a ShopApp scope. A new request it makes up with edit_and_replay can only go to a host in the scope.

The scope covers captured traffic. Your API client collections, environments and history aren’t captured traffic, and assistants can use them as before. Cloak Proxy’s own tools and rules (Map Local, breakpoints, scripts) still work on all traffic.

Tell the assistant

The MCP server’s instructions say what the scope is when an assistant connects, so it doesn’t keep asking for requests it can’t have. The read-only tool assistant_scope_status (and the cloak://assistant-scope resource) gives the details: each scope, who set it, and how many requests are visible, metadata only and hidden.

assistant_scope_status

{
  "active" : true,
  "summary" : "Assistants see ShopApp · api.example.com, *.shopapp.example as metadata only; everything else is hidden.",
  "requests" : { "visible" : 41, "fullBodies" : 0, "metadataOnly" : 41, "hidden" : 1286 },
  "scopes" : [ { "apps" : [ "ShopApp" ], "hosts" : [ "api.example.com", "*.shopapp.example" ], "inScope" : "metadata", "outsideScope" : "hidden", "setBy" : "the user, in Cloak Proxy" } ]
}

No tool can change the scope, and update_settings refuses to.

Limit one connection with flags

cloakctl mcp takes flags that narrow the scope for that connection only. Use them in a project’s MCP config so that project’s assistant keeps to its own app, whatever you set in the app for others:

Flag	Narrows it to
--app NAME	That app (repeat it, or separate names with commas, for several).
--host HOST	That host, or *.example.com.
--scope QUERY	Requests matching the typed query, such as 'app:ShopApp status:5xx'.
--metadata-only	Metadata only, for everything it can see.

Claude Code

Terminal

claude mcp add cloak-proxy -- "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl" mcp --app ShopApp --metadata-only

JSON

.cursor/mcp.json

{
  "mcpServers": {
    "cloak-proxy": {
      "command": "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl",
      "args": ["mcp", "--app", "ShopApp", "--metadata-only"]
    }
  }
}

Flags only narrow. A request has to pass both the scope in Settings and the connection’s flags, so --app OtherApp with the setting limited to ShopApp shows nothing, and --host can’t bring back what the setting hides. Settings › AI Assistants has copyable commands with your current scope already written as flags.

A query that depends on things an assistant could change, such as highlight and extract rules (col:, rule:, tag:, is:highlighted) or contract results, can’t be a scope: use Only requests I highlight instead.

On Linux

The scope works the same in the Linux app. Set it on the MCP and AI Assistants page, under Assistant scope, and use the same cloakctl mcp flags.

What the scope is, and isn't

The scope decides what Cloak Proxy’s MCP server hands to an assistant. It isn’t a sandbox: an assistant that can run commands on your Mac can read whatever you can, including running cloakctl show itself. For agents with a shell, keep your client’s approval prompts on for commands, or run them where they can’t reach your account.

Related

MCP server for AI assistantsConnect Claude Code, Cursor and others, and what they can do.

MCP tools referenceEvery tool, with assistant_scope_status.

Agent skills and setup toolsRedact sensitive data before sending to AI.

Query languageThe typed queries a scope can use.