Install Cloak Proxy

Cloak Proxy is a single Mac app. You download a disk image, drag the app to your Applications folder, and open it. This page also covers updating to a new build and removing every file, certificate and setting the app creates.

Check the requirements

Requirement	Details
macOS	macOS 14 Sonoma or later
Processor	Apple silicon or Intel. The download is a universal app that runs natively on both.
Disk space	The disk image is about 30 MB.
Account	None. Cloak Proxy is free for life, with no license key, trial or sign-in.
Optional	Xcode, to install the certificate in the iOS Simulator with one click. Android platform tools (adb), for one-click Android setup.

Download and install

1. Go to subcloak.com/apps/cloak-proxy.

2. Enter your name and email address. The download of Cloak-Proxy.dmg starts.

3. Open Cloak-Proxy.dmg from your Downloads folder.

4. Drag Cloak Proxy onto the Applications shortcut in the disk image window.

5. Eject the disk image. You can delete the .dmg file afterwards.

Open Cloak Proxy the first time

Cloak Proxy is signed ad hoc and isn’t notarized by Apple, so Gatekeeper blocks the first launch. You allow it once in System Settings, and macOS remembers your choice for that copy of the app.

1. Open Cloak Proxy from your Applications folder.

   macOS shows a message that it can’t verify the app or that it was blocked. Click Done (or OK). Don’t move the app to the Trash.

2. Open System Settings › Privacy & Security.

3. Scroll down to the Security section. Next to the message about Cloak Proxy being blocked, click Open Anyway.

4. Confirm with Open Anyway (or Open) in the dialog, and enter your Mac password or use Touch ID when macOS asks.

   Cloak Proxy opens. From now on it opens normally.

Alternative for advanced users

Instead of Open Anyway, you can remove the quarantine attribute that macOS adds to downloaded files. Run this in Terminal after you’ve copied the app to Applications:

Terminal

xattr -dr com.apple.quarantine "/Applications/Cloak Proxy.app"

What happens on the first launch

When Cloak Proxy opens for the first time, it sets itself up on your Mac. Nothing is sent anywhere: the app has no account or activation.

1. It creates a root certificate. Cloak Proxy generates its own certificate authority (CA) and private key in ~/Library/Application Support/CloakProxy. It uses them to decrypt HTTPS for the hosts and apps you choose. See Root certificate.

2. It starts the proxy on port 9090. The proxy listens on 127.0.0.1:9090, so only this Mac can use it until you allow other devices.

3. It turns on the macOS proxy. Cloak Proxy points the Mac’s HTTP and HTTPS proxy settings at itself, so apps and browsers on this Mac send their traffic through it. Your previous proxy settings are saved and come back when you quit. If macOS requires administrator rights to change network settings, it asks for your password. See Capture macOS traffic.

4. It asks you to trust the certificate. An orange banner reads Trust the Cloak Proxy certificate to decrypt HTTPS. Click Install & Trust… and confirm with your password. Until you do, Cloak Proxy still records plain HTTP and lists HTTPS connections, but can’t show what’s inside them.

HTTPS traffic shows as locked tunnels at first. That’s expected: Cloak Proxy only decrypts the hosts and apps you turn SSL Proxying on for. The Quick start walks you through your first decrypted request.

Quitting puts your network settings back

While Cloak Proxy captures macOS traffic, every app that follows the system proxy depends on it. Quit with ⌘ Q (closing the window keeps it running) and your previous proxy settings come back. If the app crashes or you force quit it, a small guard process restores them for you. See The proxy guard.

Update to a new version

Cloak Proxy doesn’t update itself. To update, download the new build and replace the app.

1. Quit Cloak Proxy with ⌘ Q. This restores your macOS proxy settings.

2. Download the latest Cloak-Proxy.dmg from subcloak.com/apps/cloak-proxy.

3. Drag Cloak Proxy onto Applications and choose Replace when Finder asks.

4. Open the new copy. If macOS blocks it, use Open Anyway again as in Open Cloak Proxy the first time.

Your settings, rules, root certificate, saved filters and API client workspace live outside the app, so an update keeps all of them. You don’t need to trust the certificate again. If you capture apps that ignore the proxy, Cloak Proxy refreshes its background helper to point at the new copy when it opens.

Where Cloak Proxy keeps its files

• Directory~/Library/

  • DirectoryApplication Support/CloakProxy/

    • cloak-proxy-ca.pem the root certificate
    • cloak-proxy-ca-key.pem the root certificate’s private key (readable only by you)
    • api-token the token for the local control API, cloakctl and MCP
    • ca-bundle.pem macOS root certificates plus Cloak Proxy’s, created when you set up a Terminal
    • DirectoryWorkspace/ the API client workspace, unless you chose another folder

      • …
  • DirectoryLogs/CloakProxy/

    • cloak-proxy.log diagnostics: proxy changes, listener errors, certificate actions
  • DirectoryPreferences/

    • com.subcloak.cloakproxy.plist settings, debugging tool rules, filter presets, pins
  • DirectoryLaunchAgents/

    • com.subcloak.cloakproxy.dns-standby.plist only while you capture apps that ignore the proxy
• Directory/etc/resolver/

  • example.com one file per captured domain, only while you capture apps that ignore the proxy

The login keychain also holds the trusted root certificate (named Cloak Proxy CA (…)), and, if you used those features, a Cloak Proxy GitHub token item for publishing Gists and CloakProxy Vault items for the API client’s vault.

Captured traffic is never written to disk on its own. It stays in memory until you save a session.

Uninstall Cloak Proxy completely

Undo the system changes from inside the app first, while it’s still installed. Then delete the app and its files.

Back up your API client workspace first

~/Library/Application Support/CloakProxy/Workspace holds your collections, environments and specs if you kept the default workspace folder. Copy it somewhere else before you delete the folder in step 5 if you want to keep them.

1. Stop capturing apps that ignore the proxy. If the sidebar shows a Not Using the Proxy section with captured apps (a green check mark), click each one and choose Stop Capturing. This removes the files in /etc/resolver and the background helper. macOS asks for your password.

2. Remove the root certificate. Open Cloak Proxy › Settings… › Certificate and click Remove from Keychain. This removes the trust setting and deletes every Cloak Proxy CA from your login keychain.

3. Quit Cloak Proxy with ⌘ Q. Your previous macOS proxy settings come back.

4. Delete the app. Drag Cloak Proxy from Applications to the Trash.

5. Delete its files. In Terminal:

   Terminal

   rm -rf ~/Library/Application\ Support/CloakProxy
   rm -rf ~/Library/Logs/CloakProxy
   defaults delete com.subcloak.cloakproxy

6. Remove keychain items you created. Open Keychain Access, search for Cloak Proxy and CloakProxy, and delete the Cloak Proxy GitHub token and any CloakProxy Vault items. Or in Terminal:

   Terminal

   security delete-generic-password -s com.subcloak.cloakproxy.github

7. Remove the extras you set up. Only if you made them:

   You set up	Remove it
   cloakctl linked into /usr/local/bin	sudo rm /usr/local/bin/cloakctl
   Cloak Proxy as an MCP server in Claude Code	claude mcp remove cloak-proxy (or delete the cloak-proxy entry from your assistant’s MCP config)
   TLS key logging	Delete the key log file, by default ~/Desktop/cloak-proxy-sslkeys.log
   The certificate on an iPhone, iPad, simulator or Android device	Remove it on the device. See Devices.
   The proxy on an Android device	In Cloak Proxy’s Android setup, click Disconnect Proxy before you uninstall, or run adb shell settings put global http_proxy :0
   The proxy on an iPhone or iPad	Settings › Wi-Fi › ⓘ › Configure Proxy › Off

Clean up after deleting the app

If you already deleted the app without the steps above, remove what’s left by hand.

Proxy settings

If websites stop loading after Cloak Proxy is gone, the Mac’s proxy may still point at 127.0.0.1:9090. Open System Settings › Network, select your connection (for example Wi-Fi), click Details…, open Proxies, and turn off Web proxy (HTTP) and Secure web proxy (HTTPS). Or in Terminal, for each network service:

Terminal

networksetup -setwebproxystate "Wi-Fi" off
networksetup -setsecurewebproxystate "Wi-Fi" off

networksetup -listallnetworkservices lists your service names.

Root certificate

Terminal

security delete-certificate -c "Cloak Proxy CA"

Run it again until it reports that the certificate can’t be found. You can also search for Cloak Proxy CA in Keychain Access and delete it there.

Captured domains

Captured domains resolve through Cloak Proxy. Without the app and its helper they stop resolving, so remove the resolver files and the helper:

Terminal

for f in /etc/resolver/*; do
  head -1 "$f" | grep -q '^# Cloak Proxy capture' && sudo rm -f "$f"
done
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

launchctl bootout gui/$(id -u)/com.subcloak.cloakproxy.dns-standby
rm -f ~/Library/LaunchAgents/com.subcloak.cloakproxy.dns-standby.plist

The loop only deletes files whose first line is Cloak Proxy’s marker, so resolver files from other tools stay.

Related

Quick startDecrypt your first HTTPS request in five minutes.

Root certificateInstall, trust, remove and regenerate the certificate.

Capture macOS trafficHow the system proxy is turned on and restored.

Security and privacyWhat stays on your Mac and how to remove everything.