Devices and runtimes overview

Cloak Proxy captures more than the Mac it runs on. An iPhone, an Android phone, a simulator, a Docker container or a script in Terminal can all send their traffic through it, as long as two things are true: the device or program uses Cloak Proxy as its proxy, and it trusts the Cloak Proxy root certificate so HTTPS can be decrypted. The Device & Runtime Setup window walks you through both for each kind of client.

Open Device & Runtime Setup

Use any of these:

• Click Devices in the main window’s toolbar.
• Choose Proxy › Device & Runtime Setup….
• Press ⇧ ⌘ A (Tools › Search Everything…) and type the name of a page: This Mac, iPhone & iPad, iOS Simulator, Android or Terminal, Java, Firefox, Docker. Each result opens the window on that tab. See Search and command palette.
• Ask an AI assistant connected through the MCP server. Its open_in_app tool opens the window with target set to setup and page set to mac, ios, simulator, android or other.

1234

The Device & Runtime Setup window. Each tab covers one kind of client.

1. One tab per kind of client: This Mac, iPhone & iPad, iOS Simulator, Android, Other
2. Turns on the macOS proxy (shown only while it's off)
3. Opens a Terminal window already set up for Cloak Proxy
4. Copies export commands you can paste into any shell

×

The setup tabs

Tab	What it sets up	Page
This Mac	Apps and browsers on this Mac (through the macOS proxy) and command-line tools (through a configured Terminal or export commands).	macOS traffic, Terminal and runtimes
iPhone & iPad	A real iOS or iPadOS device on the same Wi-Fi network: the Wi-Fi proxy and the certificate profile.	iPhone and iPad
iOS Simulator	iOS, tvOS and watchOS Simulators: one click installs the certificate in every booted simulator.	iOS Simulator
Android	An emulator or USB-connected device through adb, plus the network security config your app needs.	Android
Other	Copyable snippets for Java, Firefox, Docker, Flutter and Electron.	Java, Firefox, Docker, Flutter and Electron

Other computers on your network, and any device the tabs don’t cover, use the certificate page at http://cloak.proxy. See Other devices and access control.

How each client reaches Cloak Proxy

Cloak Proxy listens on port 9090 by default. By default it only accepts connections from this Mac (127.0.0.1). How a client reaches it decides whether you need to let other devices connect.

Client	How its traffic reaches Cloak Proxy	Needs Allow other devices to connect
Apps and browsers on this Mac	The macOS system proxy points at 127.0.0.1:9090.	No
iOS, tvOS and watchOS Simulators	They use the Mac’s network settings, so the macOS proxy covers them.	No
Terminal programs (Node.js, Python, Ruby, Go, curl, git, Deno, AWS CLI)	http_proxy and related environment variables point at 127.0.0.1:9090.	No
Java, Electron and Flutter on this Mac	A flag or a line of code points them at 127.0.0.1:9090.	No
Android emulator or USB device	adb reverse forwards the device’s port 9090 to the Mac, and the device’s proxy is set to 127.0.0.1:9090.	No
Docker containers	HTTP_PROXY points at host.docker.internal:9090.	Yes
iPhone, iPad, Android over Wi-Fi, other computers	The device’s Wi-Fi proxy points at your Mac’s address, for example 192.168.1.20:9090.	Yes

Letting other devices connect opens the proxy to your network

While Allow other devices to connect is on, anyone on your network who knows your Mac’s address can send traffic through Cloak Proxy. Restrict it with the Allowed devices list and turn it off when you’re done. See Other devices and access control.

Trust the certificate on each client

Every client that should have its HTTPS decrypted must trust the Cloak Proxy root certificate. Cloak Proxy creates this certificate on your Mac the first time it runs, and its private key never leaves the Mac. See Certificate.

Client	How it trusts the certificate
This Mac (Safari, Chrome, most apps, Electron and Chromium apps)	Install & Trust… in Settings › Certificate adds it to the macOS keychain.
Firefox	Turn on security.enterprise_roots.enabled so Firefox reads the macOS keychain.
Terminal programs	Environment variables point each tool at the certificate or at a bundle of the macOS root certificates plus Cloak Proxy’s.
Java	Import it into the JDK’s cacerts with keytool.
iOS Simulator	Install Certificate on All Booted Simulators, once per simulator.
iPhone and iPad	Download the profile from http://cloak.proxy, install it, then turn on full trust.
Android	Push Certificate, install it as a CA certificate, and allow user certificates in your app’s network security config.
Docker containers	Mount the certificate into the container and run update-ca-certificates.

Note

Trusting the certificate lets Cloak Proxy decrypt HTTPS, but it only decrypts the hosts you’ve chosen in SSL Proxying. Other HTTPS connections pass through encrypted and show as tunnels.

Find device traffic in the traffic list

Requests from another device appear in the sidebar’s app list under the device’s IP address, for example 192.168.1.42, with a phone icon. Select it to see only that device’s traffic. See Sidebar.

The status pill in the middle of the toolbar shows Capturing when the macOS proxy is on and Listening when it’s off. In both states Cloak Proxy records any device or program that’s pointed at it. Next to the status it shows the address the proxy listens on: 127.0.0.1:9090 when only this Mac can connect, and 0.0.0.0:9090 while other devices are allowed.

Clean up when you’re done

Proxy settings and trusted certificates stay on a device until you remove them. A device whose proxy points at a Mac where Cloak Proxy isn’t running can’t reach the internet through that network.

1. Remove the proxy from each device: turn the Wi-Fi proxy Off on an iPhone or iPad, click Disconnect Proxy for Android, and close any configured Terminal window.

2. Remove the certificate from devices you no longer debug: delete the iOS profile, remove the Android user certificate, and reset or erase simulators you set up.

3. In Settings › General, turn off Allow other devices to connect (phones, other computers) and click Apply & Restart Proxy.

Each device page has a section with the exact steps to undo its setup.

Related

iPhone and iPadSet the Wi-Fi proxy and trust the certificate on a real device.

Terminal and runtimesCapture Node.js, Python, Ruby, Go, curl and git.

Other devices and access controlLet devices connect, restrict them, and get the certificate.

Debug a mobile appA complete walkthrough from setup to fixing a bug.