Insights
Insights overview
Analyze captured traffic in Cloak Proxy's Insights window for API endpoints, security grades, leaked secrets, performance problems and schema changes.
Insights reads the traffic you’ve captured and tells you what’s in it: which API endpoints your app calls, how each host scores on security headers and cookies, whether keys or tokens are leaking, what’s slow or wasteful, and when a backend changed the shape of its JSON. Use it after a test session, before a release, or whenever you want a second look at an app’s network behaviour without reading every request by hand.
Everything runs on your Mac. Nothing is uploaded to analyze it.
Open the Insights window
Section titled “Open the Insights window”Open Insights in any of these ways:
| Where | How |
|---|---|
| Menu bar | Tools › Insights… |
| Keyboard | ⌥ ⌘ I |
| Main window toolbar | Click Insights |
| Search Everything | Press ⇧ ⌘ A and type a tab name, such as Secrets or Timeline. Each tab is listed under Windows with the subtitle Insights and opens the window on that tab. See Search and command palette. |
The window remembers the last tab you used and the scope you picked.
The Overview tab: summary cards across the top and the high-severity problems below.
- Tabs for each analysis
- Analyze all traffic or only the main window's current filter
- Export Report saves a Markdown summary
- Summary cards: click one to open its tab
- Details opens the tab the problem came from
- Show Request selects the request in the main window
Choose what to analyze
Section titled “Choose what to analyze”The menu at the top right sets the scope:
| Option | What Insights analyzes |
|---|---|
| All traffic (default) | Every captured request in the session, whatever the main window shows. |
| Current filter | Only the requests the main window’s sidebar selection and filters currently show. Use it to focus on one app or one domain. See Filtering. |
Insights updates as new traffic arrives. It re-analyzes at most once a second, in the background, so heavy traffic doesn’t slow the app down. A small spinner appears next to the scope menu while an analysis runs. Until the first analysis finishes, the window shows Analyzing traffic….
The tabs
Section titled “The tabs”| Tab | What it shows | Page |
|---|---|---|
| Overview | Summary cards and the high-severity problems from every other tab. | This page |
| Endpoints | An API catalog: requests grouped into endpoint templates such as /users/{id}, with calls, errors, p50 and p95 latency, size, query parameters and callers. |
Endpoints |
| Security | An A to F grade per host for security headers, cookie flags, CORS and version disclosure. | Security |
| Secrets | API keys, tokens, private keys, card numbers and credentials found in requests and responses, with values masked. | Secrets |
| Performance | Slow and large responses, missing compression, duplicate requests, N+1 bursts, uncacheable static files and errors. | Performance |
| Schema | Fields added, removed or changed in type between successive JSON responses from the same endpoint. | Schema changes |
| Timeline | Every request on one time axis, like a browser’s network waterfall but across all apps. | Timeline |
| Alerts | A history of the alerts your Alert rules fired. | Alerts history |
Read the Overview tab
Section titled “Read the Overview tab”Summary cards
Section titled “Summary cards”Six cards sum up the analysis. Click a card to open the tab behind it.
| Card | Value | Color | Opens |
|---|---|---|---|
| Requests | Number of requests analyzed. | Accent color | Timeline |
| Endpoints | Number of endpoint templates in the API catalog. | Blue | Endpoints |
| Errors | Requests to API endpoints that returned 4xx or 5xx, or failed with no response. | Red when above zero, green at zero | Performance |
| Possible secrets | Number of secret findings. | Red if any is High, orange if all are lower, green at zero | Secrets |
| Worst security grade | The lowest grade of any host, or – when no responses were audited. |
Green for A, mint for B, yellow for C, orange for D, red for F | Security |
| Schema changes | Number of JSON shape changes. | Orange when above zero, green at zero | Schema |
Needs attention
Section titled “Needs attention”Below the cards, Needs attention lists the High-severity problems so you can deal with the worst first. It takes up to five High items from each of these, in this order:
- Secrets, titled with the kind and where it was found, such as “Stripe secret key in URL”, with the host and masked value underneath.
- Security issues, with the host underneath.
- Performance problems, such as “Slow: GET api.example.com/v1/search”, with the detail underneath.
- Schema changes, such as “Removed price”, with the endpoint underneath.
Each row has two buttons:
- Details switches to the tab the problem came from.
- Show Request (or Show N Requests) selects the requests in the main window and brings it to the front.
When nothing is High, the list says No high-severity problems found. With no traffic at all, it says Capture some traffic to see insights.
Jump from a finding to the request
Section titled “Jump from a finding to the request”Every tab has Show Request buttons. They select the matching requests in the main window’s traffic list and bring the window forward. If the main window’s sidebar selection or filters would hide those requests, Cloak Proxy switches the sidebar to all traffic and clears the filters first, so the selection is always visible.
If you’ve cleared the session since the analysis, the button does nothing for requests that no longer exist.
Severity levels
Section titled “Severity levels”Findings on the Security, Secrets, Performance and Schema tabs carry one of three severities, shown as a colored badge:
| Badge | Meaning |
|---|---|
| High | Likely to cause a breach, an outage or a broken app. Fix these first. |
| Medium | A real weakness or waste that’s worth fixing. |
| Low | Hygiene and best practice. |
Each tab’s page lists exactly which findings get which severity.
Use Insights outside the window
Section titled “Use Insights outside the window”The same analysis is available without opening the window:
- Markdown report: click Export Report to save a summary for a pull request, ticket or CI log. See Insights report.
- Command line:
cloakctl run --report report.mdwrites the same report after a headless run, and--fail-on-secretsor--fail-on-schema-changeturn findings into a failing exit code. See Headless and CI. - AI assistants: the MCP server’s
insightstool returns a summary, the endpoint catalog, security grades, secrets, performance findings, schema changes or the Markdown report. See MCP server.