Debug with Claude

Cloak Proxy is a Model Context Protocol (MCP) server, so an AI assistant like Claude Code can do anything you can in the app: read and replay traffic, turn capture on, set up Map Local and breakpoints, read Insights, and use the whole API client. This guide connects Claude Code, shows prompts that map to real tools, and covers reviewing what the assistant does and keeping it safe.

What you need

Cloak Proxy installed, with the certificate trusted	The assistant drives the running app over a local API
An MCP client: Claude Code, Claude Desktop, Cursor or VS Code	Each connects over stdio by running cloakctl mcp

Caution

The MCP server exposes everything the app can do on your Mac, including turning macOS capture on, publishing Gists and running requests. Only connect an assistant you trust, and review its tool calls.

Connect the assistant

The connection command is on the Advanced settings page and in the API client’s MCP hub (copy buttons fill in the real cloakctl path).

Claude Code

Terminal

claude mcp add cloak-proxy -- "/Applications/Cloak Proxy.app/Contents/Resources/cloakctl" mcp

Cursor / VS Code / Claude Desktop

Add this to the client’s MCP config:

{"mcpServers":{"cloak-proxy":{"command":"/Applications/Cloak Proxy.app/Contents/Resources/cloakctl","args":["mcp"]}}}

123

Advanced settings: copy the MCP command for your client.

1. The cloakctl path on this Mac
2. AI assistants (MCP)
3. Copy the Claude Code command

×

The API client’s MCP hub shows the same commands alongside the full tool list.

123

The MCP hub lists the connection commands and every tool by group.

1. MCP section
2. Use Cloak Proxy from AI assistants
3. The 82 tools, grouped

×

Ask it to investigate

Once connected, describe the problem in plain language. The assistant chooses the tools. A few examples and the tools they call:

Ask	Tools it uses
“What’s failing in my traffic right now?”	list_requests (errors only), get_request, compare_requests
“Why did request 42 fail? Try a fix.”	get_request, list_requests, edit_and_replay
“Mock GET /v1/users to return an empty list.”	rule_from_request (Map Local), upsert_rule, replay_request
“Any leaked secrets or weak headers?”	insights with section secrets and security
“What is the MyApp app doing on the network?”	list_requests filtered by app, bypassing_apps
“Turn on capture and decrypt api.example.com.”	set_macos_proxy, ssl_proxying
“Run the Petstore collection and report failures.”	run_collection

Tip

The server also ships ready-made prompts your client can pick: Debug a failing request, Mock an endpoint, Write tests for a saved request, Security review of captured traffic, and What is this app doing?. They expand into the right tool sequence for you.

What the assistant can reach

The 82 tools are grouped: captured traffic (list_requests, get_request, replay_request, edit_and_replay, compare_requests, export_session…), capture control (set_recording, set_macos_proxy, ssl_proxying), debugging tools (list_rules, upsert_rule, rule_from_request, set_tool_enabled), breakpoints (list_paused, resolve_paused), insights, settings, bypassing apps, and the whole API client (collections, environments, runner, mocks, load tests, flows, specs, Git). There are also 6 read-only resources and 5 prompts.

It can also open things in the app for you (open_in_app) — a request, the Tools window, Insights, a Settings page — so you can see what it found.

Review and stay safe

1. Watch the tool calls. Your MCP client shows each call and its arguments before (or as) it runs; read them like you’d read a command before pressing Enter.

2. Approve destructive actions deliberately. The server marks tools that delete or overwrite (clear_session, delete_rule, delete_request, delete_collection, delete_variable) as destructive, and the server’s own instructions tell the assistant to ask before deleting things or turning macOS capture off.

3. Some actions still need you. Capturing an app that ignores the proxy needs your Mac password, so open_capture just opens the sheet for you to confirm — the assistant can’t enter the password.

4. Breakpoints wait for a human. If a rule pauses a request, the assistant can read it with list_paused and continue or edit it with resolve_paused, but a paused request holds the app until someone acts.

Danger

The local API answers only this Mac, and only requests that carry the token in ~/Library/Application Support/CloakProxy/api-token. Don’t share that token or expose the API to other machines. Treat an assistant with MCP access as having the same reach as you do in the app.

Clean up

1. Remove the MCP server from your client when you no longer need it (for Claude Code, claude mcp remove cloak-proxy).

2. Turn off any tools the assistant left on (Map Local, Breakpoint…) in the Tools window, and turn off macOS capture if it was enabled for the session.

Related

MCP serverConnect Claude Code, Claude Desktop, Cursor and VS Code; what it can do; security.

MCP tools referenceAll 82 tools grouped, with arguments, resources and prompts.

Control APIThe local REST API and its token.

MCP clientUse the API client to test other MCP servers.