Traffic list

The traffic list is the table in the top half of the main window. Every request Cloak Proxy captures becomes one row, in the order it arrived, and the row updates in place as the response comes in. Select a row to open it in the inspector below.

12345

The traffic list above the inspector. The status bar at the bottom counts the requests.

1. Status icon: decrypted, encrypted, plain HTTP, pending or failed
2. Click a column header to sort. Right-click it to show or hide columns.
3. Methods and status codes are colored by kind
4. Duration turns orange after 1 second and red after 3
5. Request count, or “N of M requests” while a filter is on

×

Columns

The list has thirteen columns. Eleven are visible by default; URL and Req Size start hidden.

Column	Shows	Notes
#	The request’s number in this session	Numbers only go up. A colored dot before the number is the row’s highlight, and a speech bubble after it means the row has a comment. Always visible.
Status icon	Whether the request was decrypted, encrypted, plain HTTP, still waiting or failed	The column has no title. See Status icons. Not sortable.
App	The app that sent the request, with its icon	Command-line tools show a Terminal icon and the executable’s name. Devices on your network show an iPhone icon and their IP address. Unknown when the app couldn’t be identified.
Method	GET, POST, CONNECT and so on	Colored by method. See Colors.
Code	The response status code	Colored by class. ERR in red when the request failed without a response. Empty while waiting and for tunnels.
Host	The host name from the request	Long hosts are shortened in the middle.
Path	Path and query string	Starts with a pink GraphQL badge (for example query GetUser) and a tool badge (for example Map Local) when they apply. Tunnels show Encrypted tunnel, or Connecting… while the connection opens. Hover for the full URL.
URL	The full URL	Hidden by default.
Type	The short response content type, such as json, html or png	Taken from the response’s Content-Type, with any x- prefix removed.
Req Size	The size of the request body	Hidden by default. Empty when there’s no body.
Size	The size of the response body	Empty until a response arrives.
Duration	Time from the start of the request to the end of the response	Shown in ms under a second, then in seconds. Not shown for tunnels.
Time	When the request started	Your Mac’s time format.

Tool badges in the Path column

When a debugging tool touched a request, its name appears as a badge at the start of the Path cell. Several tools are joined with a dot, for example Script · Breakpoint.

Badge	Added when
Block List	A Block List rule matched
Network Conditions	A Network Conditions rule throttled the request
Script	A script ran on the request or the response
Breakpoint	The request or response paused at a breakpoint
Map Local	Map Local answered the request
Mock	A Mock Set answered the request
Map Remote	Map Remote sent it somewhere else
No Caching	No Caching removed cache headers
DNS Spoofing	DNS Spoofing resolved the host to another address
Insecure TLS	The host is in the insecureUpstreamHosts setting, so Cloak Proxy didn’t check the server’s certificate. That setting is changed with update_settings through the control API.
Client Certificate	Cloak Proxy presented a client certificate (mutual TLS)

Status icons

The narrow column after # tells you at a glance what Cloak Proxy could see. Hover a failed row’s icon to read the error.

Icon	Meaning
Green open lock	HTTPS that Cloak Proxy decrypted. You can read everything.
Gray lock	HTTPS that passed through encrypted. Turn on SSL Proxying to read it.
Blue dot	Plain HTTP. Nothing to decrypt.
Dotted circle	Still waiting for the response.
Orange triangle	Failed. See Failed requests and tunnels.

Colors

Methods, status codes and durations are colored so problems stand out.

What	Color
GET	Blue
POST	Green
PUT	Orange
PATCH	Purple
DELETE	Red
OPTIONS, HEAD	Teal
CONNECT	Gray
Status 2xx	Green
Status 3xx	Purple
Status 4xx	Orange
Status 5xx and ERR	Red
Duration over 1 second	Orange
Duration over 3 seconds	Red

Sort the list

Click a column header to sort by it. Click the same header again to reverse the order. Every column except the status icon can be sorted.

The default order is #, oldest first. In that order, when you’re scrolled to the bottom, the list follows new requests as they arrive. Scroll up and it stays where you left it.

Show, hide and arrange columns

1. Right-click any column header.

   A menu lists every column except #. Checked columns are visible. The status icon column is listed as Status Icon.

2. Choose a column to show or hide it.

3. Drag a header sideways to move its column, or drag the edge between two headers to resize it.

Cloak Proxy remembers column widths, order and visibility between launches.

Long names

Every row is one line. Long hosts, paths and URLs are shortened in the middle so you still see both ends; app names and methods are shortened at the end. Hover a Path cell to see the full URL, or widen the column.

1234

Long app names, hosts and paths stay on one line and are shortened.

1. App names are shortened at the end
2. Hosts and paths are shortened in the middle
3. A tunnel that wasn't decrypted
4. Two advanced filter conditions are on

×

Select requests

Click a row to select it. The inspector shows the selected request.

• ↑ and ↓ move between requests.
• ⌘-click adds or removes a row, and ⇧-click selects a range.
• With several rows selected, the inspector shows the newest of them (the highest #), and the status bar shows N selected.

Highlight requests by color

Highlights help you find requests again in a long session.

1. Select one or more requests.

2. Right-click and choose Highlight.

3. Choose Red, Orange, Yellow, Green, Blue, Purple or Gray.

   A dot in that color appears before the request number. To remove it, choose Highlight › No Highlight.

Comment on a request

1. Right-click a request and choose Add Comment… (or Edit Comment… when it already has one).

2. Type your note and click Save.

   A speech bubble appears after the request number. Hover the number to read the comment.

3. To remove it, open the comment again and click Delete Comment, or save it empty.

12

Comments are short notes on a single request.

1. Your note
2. Remove the comment

×

Highlights and comments stay in this session

Highlights and comments live in memory. Clear Session removes them, and they aren’t written to .cloaksession files or exports. AI assistants connected through the MCP server can set them too (the annotate_request tool).

Right-click a request

The menu acts on all selected rows when you right-click one of them. Right-click a row outside the selection and it acts on that row only. Items that need a single request (such as Edit and Repeat… and Tools) use the last of the selected rows.

Item	What it does
Copy URL	Copies the URL. Several requests give one URL per line.
Copy as cURL	Copies a curl command. See Copy as code.
Copy as ›	Copies the request as code in any of the 20 formats.
Copy Response Body	Copies the decompressed response body as text. Only when there’s a response body.
Copy Request Body	Copies the decompressed request body as text. Only when there’s a request body.
Compare	Opens the two requests side by side. Only when exactly two are selected. See Compare requests.
Repeat / Repeat N Requests	Sends the requests again. See Repeat and Compose.
Edit and Repeat…	Opens the request in Compose so you can change it first.
Save to API Client / Save N Requests to API Client	Adds the requests to a Captured Requests collection and opens the API client.
Tools ›	Creates a rule from the request: Breakpoint…, Map Local…, Map Remote…, Scripting…, Block List…, Allow List…, Network Conditions…, DNS Spoofing…, Mock This Response (or Mock N Responses) and Alerts…. See Rules and matching.
Highlight ›	Colors the rows, or No Highlight to clear.
Add Comment… / Edit Comment…	Opens the comment sheet.
Enable SSL Proxying for host / Disable SSL Proxying for host	Turns decryption on or off for this host.
Enable SSL Proxying for All Domains from app / Disable SSL Proxying for app	Turns decryption on or off for everything the app sends. Only when the app is known.
Export Request › / Export N Requests ›	Saves the requests as Cloak Proxy Session…, HAR…, CSV…, Postman Collection… or OpenAPI (YAML)…. See Export.
Publish to GitHub Gist…	Shares the requests as a Gist. See Publish to Gist.
Remove / Remove N Requests	Deletes the rows from the session.

Repeat, Edit and Repeat…, Save to API Client and Tools are unavailable for encrypted tunnels, because there’s no request to work with.

Keyboard shortcuts

Shortcut	Action
↑ ↓	Move between requests
⌘ C	Copy the selected requests’ URLs, one per line
Delete	Remove the selected requests
⌘ R	Repeat the selected requests (Proxy › Repeat Selected Request)
⌥ ⌘ E	Edit and repeat the inspected request (Proxy › Edit and Repeat…)
⌥ ⌘ D	Compare the two selected requests (Tools › Compare Selected Requests)
⌘ F	Focus the filter
⌘ K	Clear the session (File › Clear Session)
⇧ ⌘ A	Search everything

The full list is in Keyboard shortcuts.

Empty list

When nothing has been captured yet, the list shows Waiting for traffic. If macOS capture is off, it offers a Capture macOS Traffic button and reminds you that apps and devices can point at 127.0.0.1:9090 directly. See Capture macOS traffic.

When there is traffic but your filters hide all of it, the list shows No matching requests with a Reset Filters button.

How much the list holds

Cloak Proxy keeps up to 50,000 requests in memory. When a session goes past that, the oldest 5,000 are dropped to make room. New traffic is added in batches, at most ten times a second, so heavy browsing doesn’t slow the app down. To start fresh, use Clear in the toolbar or ⌘ K; to keep a session, save it first.

Tip

Bodies larger than the Max captured body size setting in Settings › General (32 MB by default) are cut for inspection but still forwarded in full. See Network settings.

Related

FilteringNarrow the list by text, content type and saved presets.

InspectorEvery request and response tab.

SidebarShow one app or domain at a time.

Recording and sessionsPause recording, clear, and how sessions live in memory.