Automation and AI

MCP server for AI assistants

Connect Claude Code, Claude Desktop, Cursor or VS Code to Cloak Proxy over MCP to read traffic, set up mocks and breakpoints, and run API tests.

Cloak Proxy is a Model Context Protocol (MCP) server. Connect it to an AI assistant such as Claude Code, Claude Desktop, Cursor or VS Code, and the assistant can do what you do in the app: read and replay captured requests, turn on capture and SSL proxying, create Map Local mocks and breakpoints, answer paused requests, read Insights, and use the whole API client. It offers 82 tools, 6 resources and 5 prompts, and runs entirely on your Mac.

How it works

The server is cloakctl mcp. Your assistant starts it as a local process and talks to it over standard input and output. It does nothing until the assistant calls a tool.

Kind of tool	Where it runs	Needs the app open
Captured traffic: `list_requests`, `get_request`, `get_request_curl`, `replay_request`	The proxy’s control API	The app, or `cloakctl run`
Everything else in the proxy: capture, SSL proxying, settings, debugging tools, breakpoints, Insights, windows	The running app, through `POST /api/rpc`	Yes
API client: collections, requests, environments, runs, mocks, specs, flows, Git and more	The workspace folder, read and written directly	No

Changes an assistant makes show up in the app’s windows right away, and changes to the workspace are picked up by the app if it’s open.

Connect your assistant

You need Cloak Proxy installed in /Applications. Copy the commands from the app so the path is right for your Mac: open Settings › Advanced and look under AI assistants (MCP), or open the API client with ⇧ ⌘ M (File › MCP…) and use the Use Cloak Proxy from AI assistants card.

The MCP page of the API client: a Connect to an MCP server card, and a Use Cloak Proxy from AI assistants card with Copy buttons for Claude Code and for Claude Desktop, Cursor and VS Code JSON, followed by the tool list grouped by area — The MCP page in the API client has copyable setup for each assistant and lists every tool.
Use Cloak Proxy from AI assistants
Copies the Claude Code command
Copies the JSON for Claude Desktop, Cursor and VS Code
Every tool, grouped by area

Run this in Terminal:

claude mcp add cloak-proxy -- "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl" mcp

Then start claude and ask about your traffic. Run claude mcp list to check that cloak-proxy is connected.

Add the server to ~/Library/Application Support/Claude/claude_desktop_config.json, then quit and reopen Claude Desktop:

{
  "mcpServers": {
    "cloak-proxy": {
      "command": "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl",
      "args": ["mcp"]
    }
  }
}

If the file already has an mcpServers object, add the cloak-proxy entry inside it.

Add the server to .cursor/mcp.json in your project, or to ~/.cursor/mcp.json for every project:

{
  "mcpServers": {
    "cloak-proxy": {
      "command": "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl",
      "args": ["mcp"]
    }
  }
}

Add the server to .vscode/mcp.json in your project. VS Code uses a servers key and a type:

{
  "servers": {
    "cloak-proxy": {
      "type": "stdio",
      "command": "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl",
      "args": ["mcp"]
    }
  }
}

Any MCP client that can launch a local stdio server works. Give it:

Setting	Value
Command	`/Applications/Cloak Proxy.app/Contents/Resources/cloakctl`
Arguments	`mcp`
Transport	stdio

Options

Add these after mcp in the command or args:

Option	Use it when
`--port N`	The proxy listens on a port other than the one in the app’s settings, for example a `cloakctl run --port 9091`.
`--workspace DIR`	The assistant should use a different API-client workspace folder than the app’s, for example the one in your project’s repository.

claude mcp add cloak-proxy -- "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl" mcp --workspace ~/code/shop-api/api-workspace

Find the setup from anywhere

Press ⇧ ⌘ A and type mcp. MCP opens the API client’s MCP page, and AI Assistants (MCP) opens Settings › Advanced.

Search Everything with the query mcp: MCP in the API Client as the top hit, AI Assistants (MCP) under Settings › Advanced, and New MCP Request entries — Search Everything finds both places to set up the MCP server.
Opens the MCP page in the API client
Opens Settings › Advanced

What your assistant can do

The tools cover the whole app. Every one is listed with its arguments in the MCP tools reference.

Area	Examples of what you can ask
Captured traffic	“Why did the last checkout request fail?” “Compare request 41 with 52.” “Replay request 12 with a different `Authorization` header.”
Capture control	“Start capturing macOS traffic and decrypt `*.example.com`.” “Pause recording.”
Debugging tools	“Mock `GET /v1/users` to return an empty list.” “Add a 2-second delay to `api.example.com`.” “Block analytics hosts.”
Breakpoints	“Pause the next login request and change the password field.”
Insights	“Are any secrets leaking in this traffic?” “Which endpoints are slowest?”
Apps that ignore the proxy	“Why isn’t my app’s traffic showing up?” The assistant can suggest domains to capture and open the capture sheet for you to confirm.
API client	“Write tests for the Login request and run them.” “Run the Shop API collection against Staging.” “Create an OpenAPI spec from this collection.” “Commit the workspace.”

Resources

Resources are read-only context an assistant can attach to a conversation.

URI	What it contains
`cloak://status`	Port, recording, macOS capture and active tools.
`cloak://requests/recent`	The last 100 captured requests.
`cloak://requests/{id}`	Headers and bodies of one request (a template: replace `{id}`).
`cloak://insights/report`	The Insights Markdown report.
`cloak://rules`	Every debugging tool and its rules.
`cloak://collections`	API client collections, requests and environments.

Prompts

Prompts are ready-made tasks. In clients that support them, they appear as slash commands or in a prompt menu.

Prompt	Arguments	What it asks the assistant to do
`debug_request`	`id` (required)	Find out why a captured request failed, compare it with a successful one, and suggest or try a fix.
`mock_endpoint`	`id` (required), `change`	Make a Map Local rule from a request, change the response as described, and confirm by replaying.
`write_tests`	`collection`, `request` (both required)	Add `pm.test` assertions to a saved request, run it, and report.
`security_review`	None	Review leaked secrets, weak headers and risky cookies, with fixes.
`app_traffic_summary`	`app` (required)	Summarize one app’s API calls, and check whether it bypasses the proxy.

Security

The MCP server gives an assistant the same power over Cloak Proxy that you have. Set it up knowing what that means.

It stays on your Mac. The server is a local process. It talks to the app only on 127.0.0.1, and the app’s API refuses other machines.
It uses the API token. The server reads the token from ~/Library/Application Support/CloakProxy/api-token. Any program you let run cloakctl mcp can read your captured traffic. See Control API.
Captured data goes to your assistant’s model. When a tool returns a request, its headers and body become part of the conversation, which your assistant sends to its model provider. That can include cookies, tokens and personal data. Use redaction and the masked secrets view where you can, and don’t point an assistant at traffic you aren’t allowed to share.
Assistants are told to ask first. The server’s instructions tell the assistant to ask before deleting things or turning macOS capture off. Each tool is also marked read-only or destructive, so clients that support those hints can ask for confirmation. The destructive tools are clear_session, delete_rule, delete_request, delete_collection and delete_variable.
Some actions always need you. Trusting or removing the certificate and capturing an app that ignores the proxy need your Mac password, so the assistant can only open the right screen for you to confirm.
Review tool calls. Keep your client’s approval prompts on for tools that change things, such as update_settings, set_macos_proxy, upsert_rule and git_commit.

Troubleshooting

Problem	What to do
Traffic tools say “Couldn’t reach Cloak Proxy on port 9090”	Open Cloak Proxy, or start `cloakctl run`. If the proxy uses another port, add `--port N` to the server command.
A tool says it “needs the Cloak Proxy app”	The proxy is `cloakctl run`, which only serves traffic tools. Open the app for the rest.
Collection tools don’t see your collections	The server uses the app’s workspace folder. If yours is elsewhere, add `--workspace DIR`.
The client doesn’t list the server	Check the path to `cloakctl` (it contains a space, so it must be quoted in shell commands), then restart the client.

MCP tools referenceAll 82 tools with arguments, plus resources and prompts.

Debug with ClaudeA walkthrough of debugging an app with an AI assistant.

MCP clientTest other MCP servers from the API client.

Security and privacyWhat stays on your Mac and who can reach it.