MCP tools reference

This is the complete list of what an AI assistant can do through Cloak Proxy’s MCP server: 82 tools in nine groups, 6 resources and 5 prompts. Use it to know what to ask for, to decide which tools to auto-approve in your assistant, and to call the tools from your own MCP client.

12

The API client's MCP page lists every tool by area. This reference adds each tool's arguments.

1. The resources and prompts the server offers
2. Tools grouped by area

×

How to read this page

Each tool lists its arguments with their JSON type and whether they’re required. Your assistant fills them in from what you ask; you rarely type them yourself.

Kind	Meaning
Read-only	Only reads. Safe to auto-approve.
Makes changes	Changes the app, a setting, a rule, a file or the workspace, or sends a request.
Destructive	Deletes something. The server marks these so clients can ask you to confirm.

Every tool is marked as not reaching the open internet on its own (openWorldHint: false). Tools that send requests, such as replay_request, run_saved_request and send_http_request, still contact the servers those requests go to.

Where a tool takes a request id, use the number from the traffic list’s # column or from list_requests. Where it takes a collection or request, use its name or id; requests can also be given as a Folder / Name path.

Note

Errors come back as a text message with isError: true, for example upsert_rule needs "rule" or No captured request #12, so the assistant can correct itself.

Captured traffic

Read, replay, compare, annotate, export and import captured requests. list_requests, get_request, get_request_curl and replay_request read the proxy directly, so they also work with cloakctl run; proxy_status falls back to the basic status there. The rest need the app.

Tool	Kind
proxy_status	Read-only
list_requests	Read-only
get_request	Read-only
get_request_curl	Read-only
replay_request	Makes changes
edit_and_replay	Makes changes
compare_requests	Read-only
annotate_request	Makes changes
list_apps	Read-only
list_domains	Read-only
export_session	Makes changes
import_session	Makes changes

proxy_status

Cloak Proxy’s state: port, recording, whether macOS traffic is captured, request count, active debugging tools, SSL proxying hosts/apps, paused breakpoints, captured domains and apps bypassing the proxy.

Read-only. Does not change anything.

No arguments.

list_requests

Captured HTTP/HTTPS requests (newest last): id, method, URL, status, app, timing. Filter by text, host, app, method, status, errors, or only requests newer than an id.

Read-only. Does not change anything.

Argument	Type	Required	Description
search	string	No	URL or app name contains this
host	string	No	Host contains this
app	string	No	App name contains this
method	string	No	HTTP method
status	integer	No	Exact status code
errors_only	boolean	No	Only failures and 4xx/5xx
since_id	integer	No	Only requests with a larger id (new since then)
limit	integer	No	Maximum results (default 50)

get_request

One captured request in full: request and response headers and bodies, timing, app, WebSocket messages.

Read-only. Does not change anything.

Argument	Type	Required	Description
id	integer	Yes	Request id from list_requests

get_request_curl

A captured request as a cURL command.

Read-only. Does not change anything.

Argument	Type	Required	Description
id	integer	Yes	Request id

replay_request

Send a captured request again, unchanged, through Cloak Proxy; returns the new request and response.

Makes changes.

Argument	Type	Required	Description
id	integer	Yes	Request id

edit_and_replay

Send a modified copy of a captured request (or a new request) through Cloak Proxy and return the result. Headers given as an object are merged over the original (null removes one).

Makes changes.

Argument	Type	Required	Description
id	integer	No	Captured request to start from (optional)
method	string	No	HTTP method
url	string	No	URL
headers	object	No	{"Name": "value"} is merged in (null removes a header), or [{name, value}] replaces them all
body	string	No	Body text

compare_requests

Line diff of two captured requests and their responses (headers and bodies).

Read-only. Does not change anything.

Argument	Type	Required	Description
a	integer	Yes	First request id
b	integer	Yes	Second request id

annotate_request

Highlight a captured request with a color and/or set its comment (shown in the traffic list).

Makes changes.

Argument	Type	Required	Description
id	integer	Yes	Request id
color	string	No	Highlight color. One of: none, red, orange, yellow, green, blue, purple, gray
comment	string	No	Comment text (empty clears it)

list_apps

Apps seen in the captured traffic with request counts and whether SSL proxying is on for them.

Read-only. Does not change anything.

No arguments.

list_domains

Hosts seen in the captured traffic with request counts and whether they’re decrypted.

Read-only. Does not change anything.

No arguments.

export_session

Write captured requests to a file: session (Cloak), HAR, CSV, Postman collection or OpenAPI. Optionally only some ids, and redacted (tokens, cookies, secrets removed).

Makes changes.

Argument	Type	Required	Description
format	string	Yes	File format. One of: session, har, csv, postman, openAPI
path	string	Yes	File path to write
ids	array of integers	No	Only these request ids
redact	boolean	No	Remove credentials and secrets

import_session

Open a HAR, Charles (.chlsj) or Cloak session file into the traffic list.

Makes changes.

Argument	Type	Required	Description
path	string	Yes	File path

Capture control

Recording, the traffic list, macOS capture and SSL proxying. These need the app.

Tool	Kind
set_recording	Makes changes
clear_session	Destructive
set_macos_proxy	Makes changes
ssl_proxying	Makes changes

set_recording

Pause or resume recording traffic (the proxy keeps forwarding either way).

Makes changes.

Argument	Type	Required	Description
on	boolean	Yes	true to record

clear_session

Remove every captured request from the traffic list.

Destructive. Deletes something; clients that support it ask you to confirm.

No arguments.

set_macos_proxy

Turn capturing of all macOS traffic on or off (points the system HTTP/HTTPS proxy at Cloak Proxy; previous settings come back when off).

Makes changes.

Argument	Type	Required	Description
on	boolean	Yes	true to capture macOS traffic

ssl_proxying

List, add or remove hosts and apps whose HTTPS traffic is decrypted. Hosts accept wildcards (*.example.com).

Makes changes.

Argument	Type	Required	Description
action	string	No	What to do. One of: list, add_host, remove_host, add_app, remove_app
value	string	No	Host pattern or app name

Debugging tools

Breakpoint, Map Local, Map Remote, Scripting, Block List, Allow List, Network Conditions, DNS Spoofing, No Caching, Mock Sets and Alerts. These need the app. The tool argument takes breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets or alerts.

Tool	Kind
list_rules	Read-only
upsert_rule	Makes changes
delete_rule	Destructive
set_tool_enabled	Makes changes
rule_from_request	Makes changes
script_logs	Read-only

list_rules

Debugging tools (Breakpoint, Map Local, Map Remote, Scripting, Block/Allow List, Network Conditions, DNS Spoofing, No Caching, Mock Sets, Alerts): whether each is on, its rules, and an example rule showing every field.

Read-only. Does not change anything.

Argument	Type	Required	Description
tool	string	No	Only this tool. One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets, alerts

upsert_rule

Create a rule (no id) or change one (with its id; only the given fields change). Fields follow exampleRule from list_rules, for example Map Local: {name, matcher: {url, method}, statusCode, headers, body}. Turns the tool on.

Makes changes.

Argument	Type	Required	Description
tool	string	Yes	Which tool. One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, mockSets, alerts
rule	object	Yes	Rule fields; include id to update an existing rule

delete_rule

Delete a debugging-tool rule.

Destructive. Deletes something; clients that support it ask you to confirm.

Argument	Type	Required	Description
tool	string	Yes	Which tool. One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets, alerts
id	string	Yes	Rule id

set_tool_enabled

Turn a debugging tool on or off (its rules are kept).

Makes changes.

Argument	Type	Required	Description
tool	string	Yes	Which tool. One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets, alerts
enabled	boolean	Yes	On or off

rule_from_request

Make a rule matching a captured request, like the app’s right-click menu: Map Local copies its response so you can edit it, Breakpoint pauses it, Mock Sets records it, Alerts watch it, etc.

Makes changes.

Argument	Type	Required	Description
tool	string	Yes	Which tool. One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets, alerts
id	integer	Yes	Captured request id
open	boolean	No	Also show it in the Tools window

script_logs

Recent console output (console.log, warnings, errors) from Scripting rules.

Read-only. Does not change anything.

Argument	Type	Required	Description
limit	integer	No	How many (default 100)

Breakpoints

Requests and responses paused by Breakpoint rules. These need the app.

Tool	Kind
list_paused	Read-only
resolve_paused	Makes changes

list_paused

Requests and responses currently held by Breakpoint rules, waiting for a decision.

Read-only. Does not change anything.

No arguments.

resolve_paused

Let a paused request/response continue (optionally edited), continue it unedited, or abort it.

Makes changes.

Argument	Type	Required	Description
id	string	Yes	Paused message id from list_paused
action	string	No	Decision. One of: send, send_original, abort
request	object	No	Edits for a paused request: {method, url, headers, body}
response	object	No	Edits for a paused response: {status, headers, body}

Insights analysis

Analysis of the captured traffic. Needs the app.

Tool	Kind
insights	Read-only

insights

Analysis of the captured traffic: summary, endpoints (API catalog with p50/p95 and errors), security (per-host grades and issues), secrets (leaked keys and tokens, masked), performance (slow, large, duplicate and N+1 requests), schema (JSON shape changes), or a Markdown report.

Read-only. Does not change anything.

Argument	Type	Required	Description
section	string	No	What to return. One of: summary, endpoints, security, secrets, performance, schema, markdown
limit	integer	No	Maximum items (default 50)

Settings

Proxy settings and the root certificate. These need the app.

Tool	Kind
get_settings	Read-only
update_settings	Makes changes
certificate_info	Read-only

get_settings

Proxy settings: port, other devices, HTTP/2, body size limit, SSL proxying and bypass lists, allowed devices, external proxy, SOCKS, reverse proxies, insecure upstream hosts, TLS key log.

Read-only. Does not change anything.

No arguments.

update_settings

Change proxy settings. Keys as in get_settings (objects like externalProxy merge). Port, other-devices, SOCKS and reverse-proxy changes restart the proxy.

Makes changes.

Argument	Type	Required	Description
changes	object	Yes	{setting: value}, for example {"port": 9091} or {"externalProxy": {"isEnabled": true, "host": "proxy.example.com", "port": 8080}}

certificate_info

The Cloak Proxy root certificate: file, whether macOS trusts it, and its PEM (for installing on devices). Trusting it needs the user’s password in the app.

Read-only. Does not change anything.

No arguments.

Apps that ignore the proxy

Find apps whose traffic is missing and start capturing them. These need the app.

Tool	Kind
bypassing_apps	Read-only
suggest_capture_domains	Read-only
open_capture	Makes changes

bypassing_apps

Apps connecting straight to the internet instead of through Cloak Proxy (so their requests don’t show up), and apps already captured through DNS.

Read-only. Does not change anything.

No arguments.

suggest_capture_domains

The domains to capture for an app that ignores the proxy (from its binary and traffic seen).

Read-only. Does not change anything.

Argument	Type	Required	Description
app	string	Yes	App name

open_capture

Open the capture sheet for an app in Cloak Proxy so the user can confirm capturing it (needs their Mac password).

Makes changes.

Argument	Type	Required	Description
app	string	Yes	App name

Windows

Show something in the app. Needs the app.

Tool	Kind
open_in_app	Makes changes

open_in_app

Show something in Cloak Proxy: a captured request, the Tools window (optionally a tool), Insights, the API Client, MCP, the Breakpoint window, Device Setup (mac, ios, simulator, android, other) or a Settings page (general, ssl, bypass, certificate, network, advanced).

Makes changes.

Argument	Type	Required	Description
target	string	Yes	What to show. One of: request, tools, insights, api_client, mcp, breakpoints, setup, settings
id	integer	No	Request id (target request)
tool	string	No	Tool (target tools). One of: breakpoint, mapLocal, mapRemote, scripting, blockList, allowList, networkConditions, dnsSpoofing, noCaching, mockSets, alerts
page	string	No	Setup or Settings page

API client

The API client’s workspace: collections, requests, environments, runs, mocks, specs, flows, monitors, datasets, comments, generators, packages, history, Recently Deleted and Git. These read and write the workspace folder directly and work without the app, except save_captured_request, which reads the request from the proxy.

Tool	Area	Kind
list_collections	Collections and requests	Read-only
get_saved_request	Collections and requests	Read-only
run_saved_request	Collections and requests	Makes changes
run_collection	Collections and requests	Makes changes
create_request	Collections and requests	Makes changes
update_request	Collections and requests	Makes changes
delete_request	Collections and requests	Destructive
send_http_request	Collections and requests	Makes changes
get_code_snippet	Collections and requests	Read-only
save_captured_request	Collections and requests	Makes changes
create_collection	Collections and requests	Makes changes
delete_collection	Collections and requests	Destructive
create_folder	Collections and requests	Makes changes
import_into_client	Collections and requests	Makes changes
list_environments	Environments and variables	Read-only
create_environment	Environments and variables	Makes changes
set_variable	Environments and variables	Makes changes
delete_variable	Environments and variables	Destructive
set_active_environment	Environments and variables	Makes changes
run_load_test	Load tests and mock servers	Makes changes
start_mock_server	Load tests and mock servers	Makes changes
stop_mock_server	Load tests and mock servers	Makes changes
list_mock_servers	Load tests and mock servers	Read-only
list_specs	Specs	Read-only
get_spec	Specs	Read-only
save_spec	Specs	Makes changes
lint_spec	Specs	Read-only
sync_spec	Specs	Makes changes
generate_openapi	Specs	Read-only
list_flows	Flows	Read-only
run_flow	Flows	Makes changes
list_monitors	Monitors	Read-only
run_monitor	Monitors	Makes changes
list_datasets	Datasets	Read-only
get_dataset	Datasets	Read-only
save_dataset	Datasets	Makes changes
list_comments	Comments	Read-only
add_comment	Comments	Makes changes
resolve_comment	Comments	Makes changes
generate_docs	Docs, SDKs and MCP servers	Makes changes
generate_sdk	Docs, SDKs and MCP servers	Makes changes
generate_mcp_server	Docs, SDKs and MCP servers	Makes changes
list_packages	Packages	Read-only
save_package	Packages	Makes changes
client_history	History and Recently Deleted	Read-only
list_recently_deleted	History and Recently Deleted	Read-only
restore_deleted	History and Recently Deleted	Makes changes
git_status	Git	Read-only
git_diff	Git	Read-only
git_commit	Git	Makes changes

list_collections

The API client’s collections with every request (ids, methods, URLs) and the environments.

Read-only. Does not change anything.

No arguments.

get_saved_request

A saved request: method, URL, params, headers, body, auth, scripts and docs.

Read-only. Does not change anything.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	Yes	Request name, Folder / Name path, or id

run_saved_request

Send a saved request (any protocol: HTTP, GraphQL, gRPC, WebSocket, MQTT, MCP, AI, SQL, TCP) with its scripts, auth and environment; returns the response and test results.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	Yes	Request name, Folder / Name path, or id
environment	string	No	Environment name (default: active)

run_collection

Run a collection (or one folder) with its tests, like Newman: iterations, a dataset or data file, environment. Returns a pass/fail report.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
environment	string	No	Environment name
iterations	integer	No	Times to run (default 1)
folder	string	No	Only this folder
dataset	string	No	Dataset name or CSV/JSON file path: one iteration per row

create_request

Save a new HTTP request in a collection (created if missing).

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name
name	string	Yes	Request name
method	string	No	HTTP method
url	string	Yes	URL; may use {{variables}}
headers	object	No	{"Name": "value"}
body	string	No	Raw body
tests	string	No	Post-response script with pm.test(…)
folder	string	No	Folder name (optional)

update_request

Change a saved request; only the given fields change. Headers and params given as objects merge (null removes one). Auth: {type: bearer | basic | apiKey | …, …params}.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	Yes	Request name, Folder / Name path, or id
name	string	No	New name
method	string	No	HTTP method
url	string	No	URL
headers	object	No	{"Name": "value"}, or null as the value to remove one
params	object	No	Query params {"name": "value"}, or null as the value to remove one
body	string	No	Raw body
pre_request_script	string	No	Pre-request script
tests	string	No	Post-response script
docs	string	No	Markdown docs
auth	object	No	{type, …params}

delete_request

Delete a saved request (kept in Recently Deleted for 30 days).

Destructive. Deletes something; clients that support it ask you to confirm.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	Yes	Request name, Folder / Name path, or id

send_http_request

Send an ad-hoc HTTP request (not saved, not through the proxy) and return the response.

Makes changes.

Argument	Type	Required	Description
method	string	No	HTTP method (default GET)
url	string	Yes	Absolute URL
headers	object	No	{"Name": "value"}
body	string	No	Raw body

get_code_snippet

A saved request as code: cURL, JavaScript fetch, Python requests, Go, Swift, Node axios, Java, C#, PHP, Ruby, Rust, Kotlin, Dart, PowerShell, HTTPie, wget, raw HTTP…

Read-only. Does not change anything.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	Yes	Request name, Folder / Name path, or id
language	string	No	Language name, e.g. cURL, Python, Go (default cURL)

save_captured_request

Save a captured request (with its response as an example) into an API-client collection.

Makes changes.

Argument	Type	Required	Description
id	integer	Yes	Captured request id
collection	string	No	Collection name (default: Captured Requests)

create_collection

A new, empty collection.

Makes changes.

Argument	Type	Required	Description
name	string	Yes	Name
docs	string	No	Markdown description

delete_collection

Delete a collection (kept in Recently Deleted for 30 days).

Destructive. Deletes something; clients that support it ask you to confirm.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id

create_folder

A folder in a collection (optionally inside another folder).

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
name	string	Yes	Folder name
parent	string	No	Parent folder name

import_into_client

Import into the API client from a file or text: OpenAPI/Swagger, Postman collection or environment, HAR, or a cURL command.

Makes changes.

Argument	Type	Required	Description
path	string	No	File path
text	string	No	Or the content itself (e.g. a curl command)
name	string	No	Collection name to use

list_environments

Environments and globals with their variables (secret values hidden), and which is active.

Read-only. Does not change anything.

No arguments.

create_environment

A new environment with variables.

Makes changes.

Argument	Type	Required	Description
name	string	Yes	Name
variables	object	No	{"key": "value"}
activate	boolean	No	Make it the active environment

set_variable

Set a variable in an environment, a collection or globals.

Makes changes.

Argument	Type	Required	Description
scope	string	Yes	Where. One of: environment, collection, globals
environment	string	No	Environment name (default: active)
collection	string	No	Collection (scope collection)
key	string	Yes	Name
value	string	Yes	Value
secret	boolean	No	Store as a secret (kept out of Git)

delete_variable

Remove a variable from an environment, a collection or globals.

Destructive. Deletes something; clients that support it ask you to confirm.

Argument	Type	Required	Description
scope	string	Yes	Where. One of: environment, collection, globals
environment	string	No	Environment name
collection	string	No	Collection
key	string	Yes	Name

set_active_environment

Choose the active environment (or none).

Makes changes.

Argument	Type	Required	Description
environment	string	Yes	Environment name, or none

run_load_test

Local performance test of a collection: virtual users, duration and load shape. Returns throughput, latency percentiles and errors per request.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
virtual_users	integer	No	Concurrent users (default 10)
duration_seconds	integer	No	Seconds (default 30)
profile	string	No	Load shape. One of: fixed, rampUp, spike, peak
environment	string	No	Environment name

start_mock_server

Serve a collection’s saved examples on localhost (match by method and path; x-mock-response-name/-code headers pick examples). Runs while this MCP session lasts.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
port	integer	No	Port (default: any free port)

stop_mock_server

Stop a mock server started in this session.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id

list_mock_servers

Mock servers running in this session, with their URLs and recent calls.

Read-only. Does not change anything.

No arguments.

list_specs

OpenAPI specs in the workspace and the collections they’re linked to.

Read-only. Does not change anything.

No arguments.

get_spec

A spec’s YAML/JSON text.

Read-only. Does not change anything.

Argument	Type	Required	Description
spec	string	Yes	Spec name or id

save_spec

Create or replace a spec’s text.

Makes changes.

Argument	Type	Required	Description
name	string	Yes	Spec name
text	string	Yes	OpenAPI YAML or JSON

lint_spec

Check an OpenAPI spec (from the workspace, or text) for problems.

Read-only. Does not change anything.

Argument	Type	Required	Description
spec	string	No	Spec name
text	string	No	Or the spec text

sync_spec

Generate the spec’s collection, or update its linked collection from the spec (tests, scripts and examples are kept; removed operations move aside).

Makes changes.

Argument	Type	Required	Description
spec	string	Yes	Spec name
collection	string	No	Existing collection to link and update (default: the linked one, or a new one)

generate_openapi

An OpenAPI 3 YAML document generated from a collection.

Read-only. Does not change anything.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id

list_flows

Flows (chained requests with logic) in the workspace.

Read-only. Does not change anything.

No arguments.

run_flow

Run a flow and return each step’s result and its outputs.

Makes changes.

Argument	Type	Required	Description
flow	string	Yes	Flow name or id
inputs	object	No	Input variables {"name": value}

list_monitors

Scheduled collection monitors with their last results.

Read-only. Does not change anything.

No arguments.

run_monitor

Run a monitor now and record the result in its history.

Makes changes.

Argument	Type	Required	Description
monitor	string	Yes	Monitor name or id

list_datasets

Datasets (test data tables for the runner).

Read-only. Does not change anything.

No arguments.

get_dataset

A dataset’s columns and rows.

Read-only. Does not change anything.

Argument	Type	Required	Description
dataset	string	Yes	Dataset name

save_dataset

Create or replace a dataset.

Makes changes.

Argument	Type	Required	Description
name	string	Yes	Dataset name
columns	array of strings	Yes	Column names
rows	array of arrays of strings	Yes	Rows: arrays of cell strings

list_comments

Comment threads on a collection or a request.

Read-only. Does not change anything.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	No	Request (omit for the collection’s comments)

add_comment

Comment on a collection or request (optionally on one part, or as a reply).

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
request	string	No	Request (omit for the collection)
text	string	Yes	Comment
anchor	string	No	Part it’s about: URL, Params, Headers, Body, Scripts…
reply_to	string	No	Comment id to reply to

resolve_comment

Mark a comment thread resolved (or reopen it).

Makes changes.

Argument	Type	Required	Description
id	string	Yes	Comment id
resolved	boolean	No	true to resolve

generate_docs

API documentation for a collection as one HTML file (with code samples and the collection’s branding).

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
path	string	Yes	Where to write the .html

generate_sdk

A client SDK for a collection’s API.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
language	string	Yes	Language. One of: TypeScript, Python, Swift
path	string	Yes	Folder to write

generate_mcp_server

A Node.js MCP server with one tool per request in a collection, so AI assistants can call that API.

Makes changes.

Argument	Type	Required	Description
collection	string	Yes	Collection name or id
path	string	Yes	Folder, or a .zip path

list_packages

Script packages (pm.require modules) in the workspace.

Read-only. Does not change anything.

No arguments.

save_package

Create or replace a script package (CommonJS: module.exports = …).

Makes changes.

Argument	Type	Required	Description
name	string	Yes	Package name
code	string	Yes	JavaScript

client_history

Requests recently sent from the API client.

Read-only. Does not change anything.

Argument	Type	Required	Description
limit	integer	No	How many (default 30)

list_recently_deleted

Deleted collections, folders, requests, environments and datasets that can still be restored.

Read-only. Does not change anything.

No arguments.

restore_deleted

Restore something from Recently Deleted.

Makes changes.

Argument	Type	Required	Description
id	string	Yes	Id from list_recently_deleted

git_status

The workspace’s Git branch, changed files and recent commits.

Read-only. Does not change anything.

No arguments.

git_diff

The uncommitted diff of the workspace (or one file).

Read-only. Does not change anything.

Argument	Type	Required	Description
path	string	No	File path inside the workspace

git_commit

Commit every change in the workspace.

Makes changes.

Argument	Type	Required	Description
message	string	Yes	Commit message

Resources

Resources are read-only context an assistant can attach. Clients list them with resources/list and resources/templates/list.

URI	Name	Type	Contents
cloak://status	status	application/json	Port, recording, macOS capture and active tools (the same as proxy_status).
cloak://requests/recent	recent-requests	application/json	The last 100 captured requests.
cloak://insights/report	insights	text/markdown	The Insights report: endpoints, errors, security, secrets and schema changes.
cloak://rules	rules	application/json	Every debugging tool and its rules (the same as list_rules).
cloak://collections	collections	text/plain	API client collections, requests and environments (the same as list_collections).
cloak://requests/{id}	request	application/json	A template: headers and bodies of one captured request (the same as get_request).

Prompts

Prompts are ready-made tasks. Clients list them with prompts/list; many show them as slash commands.

Prompt	Title	Arguments	What it asks the assistant to do
debug_request	Debug a failing request	id (required): captured request id	Call get_request, look at the status, headers and body, compare with a similar successful request (list_requests, compare_requests), explain the cause and the fix, and try the fix with edit_and_replay if useful.
mock_endpoint	Mock an endpoint	id (required): captured request id; change (optional): how the mocked response should differ	Call rule_from_request with tool mapLocal, change the response with upsert_rule, and confirm by replaying the request.
write_tests	Write tests for a saved request	collection (required), request (required)	Read the request with get_saved_request, run it with run_saved_request, write pm.test assertions for status, timing and important body fields, save them with update_request, run again and report.
security_review	Security review of captured traffic	None	Call insights for secrets and security, then explain each finding (masked values only), how serious it is, and how to fix it.
app_traffic_summary	What is this app doing?	app (required): app name	List the app’s requests, group them by host and endpoint, note errors, slow calls and anything sensitive, and check bypassing_apps if traffic seems missing.

Related

MCP serverConnect Claude Code, Claude Desktop, Cursor or VS Code.

Control APIThe local API behind the proxy tools, with every RPC method.

Debug with ClaudePut the tools to work on a real bug.

Rules and matchingWhat the fields of a debugging-tool rule mean.