Cloak Proxy at a glance

Cloak Proxy is a free, native macOS app (with a Linux beta) that captures, decrypts, changes and replays the HTTP and HTTPS traffic of your Mac, phones, simulators and code, with a full API client built in. This page lists the key facts in one place, with links to the details.

Who makes it and what it costs

• Maker: Subcloak, a small, founder-led security practice based in India.
• Issues and releases: github.com/subcloak/cloak-proxy.
• Price: free for life. There’s no trial, no license key, no account and no paid tier. See Free for life.

Requirements and download

macOS	macOS 14 Sonoma or later
Mac	Apple silicon or Intel (one universal app)
Linux (beta)	Ubuntu 24.04+, Debian 13+, Fedora 43+ and other desktops with GTK 4 and WebKitGTK 6.0, as a .deb, an RPM, an AppImage or a portable folder; x86_64 and ARM64. See Install on Linux.
Current version	0.5.0 (20 October 2026) on the Mac; the Linux beta is at 0.4.2 (19 October 2026)
Signing	Signed with a Developer ID and notarized by Apple, so it opens like any other app
Download	subcloak.com/apps/cloak-proxy

See Install Cloak Proxy for setup and Release notes for what changed in each version.

What it does

• HTTPS decryption. Decrypt HTTPS per app or per host with a local root certificate. See SSL Proxying.
• 12 debugging tools. Breakpoint, Map Local, Map Remote, Rewrite, Scripting, Block List, Allow List, Network Conditions, DNS Spoofing, No Caching, Mock Sets and Alerts. See Debugging tools.
• Rule conditions and folders. Narrow any rule by a header, a query parameter, a JSON body value (JSONPath), body text or a GraphQL operation name or type; group rules in folders that turn on and off together, and switch scenarios with rule sets from the app, MCP and cloakctl rules. GraphQL errors in 200 responses are flagged as failures. See Conditions and GraphQL operations and Rule folders and sets.
• Failure scenarios. Fail the first N requests, a percentage or only the Nth, return a status, time out, reset the connection, drop or truncate a body, trickle it slowly or serve stale data, for just the requests you choose, with a log of what happened. See Failure scenarios.
• Apps that skip the proxy. App Capture (Mac, since 0.5.0) is a network extension that sends every TCP connection of the apps you pick (Go and Rust tools, command-line tools, Electron apps) through Cloak Proxy, app by app and off by default. See Capture apps that ignore the proxy. Cloak Proxy can also capture an app’s domains by answering their DNS lookups. See Apps that ignore the proxy.
• Devices. Capture iPhone, iPad, iOS Simulator, Android, Terminal tools and other runtimes. See Devices and runtimes.
• One-click capture targets. A capturing browser (Chrome, Chromium, Edge, Brave or Firefox) with its own proxied profile; Electron apps launched with capture; a Docker Compose override with requests labelled by service; a debug-only Flutter proxy file; a debug-only Android network security config. See Capturing browser and Electron apps, Docker and Flutter.
• API client. Collections, environments, tests, a collection runner, load tests and mock servers, with 11 protocols: HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT, MCP, AI models, SQL databases, TCP and UDP. Imports and exports .http files from VS Code’s REST Client and JetBrains’ HTTP Client. See API client overview.
• Insights. An API endpoint catalog, security grades, a secret and PII scanner, performance findings and schema changes from captured traffic. See Insights overview.
• Query language. Filter with one typed line, such as status:5xx app:ShopApp dur:>500ms -host:cdn.*, with autocomplete and saved queries; highlight and extract rules color requests and pull JSONPath or regex values into their own columns. See Query language.
• Trace Value. Follow an ID, token or email from the response it came from to every request that sent it. See Trace Value.
• Streaming responses. Server-Sent Events, JSON lines and GraphQL subscriptions pass through as they arrive and show event by event, live, with arrival times. See Streaming responses.
• Protobuf and gRPC editing. gRPC, gRPC-Web, Connect and Protobuf bodies decoded and edited as JSON in breakpoints, Compose, Map Local and scripts, with each call’s gRPC status. See Edit Protobuf and gRPC.
• LLM Inspector. Every model call to OpenAI, Anthropic, Gemini, Ollama or a compatible API, with tokens, estimated cost from an editable price list, time to first token, tool calls, where the context window went and where the prompt cache stopped matching. See LLM Inspector.
• Distributed tracing. Trace and span IDs from W3C, B3, Jaeger, Datadog, X-Ray, Cloud Trace and Sentry headers, links to Jaeger, Honeycomb, Datadog and Grafana Tempo, broken-propagation checks and traceparent injection. See Distributed tracing.
• Privacy Map. See which outside companies receive an app’s users’ data, and what each one gets. See Privacy Map.
• Authorization matrix. Replay every captured request as another user, an admin, or no credentials, and find where one user gets another’s data back (a broken access control, an IDOR). See Authorization matrix.
• API contract checking. Bind an OpenAPI or Swagger spec to your API’s host and every captured request and response is checked against it as the app runs: undocumented endpoints and status codes, missing parameters, and bodies that drift from their schemas, with coverage and a JUnit report for CI. See Contract checking.
• Release diff. Compare two recordings of the same journey — two builds, or yesterday and today: endpoints added and no longer called, fields added, removed or retyped, status changes, slower and extra calls, and new third parties receiving user data, with a CI exit code. See Release diff.
• Make tests from traffic. Turn captured requests into an API-client test suite, with IDs and tokens chained between requests and tests inferred from the capture: status, content type, JSON schema, values that never changed and response time budgets. Runs in the collection runner and in CI. See Make tests from traffic.
• Live sharing. Show a colleague on your network a live, read-only view of the requests you choose, in their browser, with secrets hidden. See Live sharing.
• Browser extension. For Safari, Chrome, Edge, Brave and Firefox: see which tab, page and script made each request, record one tab without a proxy (not in Safari), and add console errors to bug reports. The Safari extension comes inside the app. See Browser extension.
• Report Bug. One bundle with a summary of the failing requests, cURL repros, a redacted HAR, a replayable flow and a Simulator or Android screen recording, saved or filed in GitHub, Jira or Linear. See Report Bug.
• Compare environments. Send captured requests to staging and production (or compare captured responses with staging) and see which answers differ in status, fields, types or values; or mirror live traffic to a second host with Map Remote. See Compare environments.
• MCP server. 133 tools that let AI assistants such as Claude Code, Claude Desktop, Cursor and VS Code read traffic and drive the app, with credentials redacted before they reach the model, plus agent skills for Claude Code and Codex. See MCP server, the MCP tools reference and Agent skills and setup tools.
• Large sessions. Up to 500,000 requests in the traffic list, with large bodies kept on disk, and the session kept when you quit. See Recording and sessions.
• Team deployment. A signed, notarized installer package (Cloak-Proxy.pkg) for device management services, with a sample configuration profile that pre-approves the network extension and locks update checks. See Deploy to a team’s Macs.
• cloakctl. A command-line tool for headless capture, replay, rule management and API-client runs in Terminal and CI, plus a Toxiproxy-compatible API for test suites. See cloakctl.

What it doesn’t do

• No Windows version yet, and Linux is a beta. Cloak Proxy runs on macOS, and on Linux as a beta. It can capture traffic from other devices that point their proxy at your computer. See Install on Linux.
• The source code isn’t public. The GitHub repository has the releases and the issue tracker.
• No decryption of pinned apps. Apps that pin their server’s certificate refuse Cloak Proxy’s certificate, so their HTTPS can’t be decrypted. See Troubleshooting.

Privacy

Cloak Proxy runs entirely on your Mac. It has no telemetry, analytics or crash reporting, and captured traffic, rules and the root certificate stay on your Mac. The only thing that contacts Subcloak is the optional update check, from the app menu or once a day if you turn it on, which asks download.subcloak.com for the latest version number. The daily check is off by default on the Mac, and on Linux from 0.4.2 (Linux 0.4.1 and earlier check daily unless you turn it off). From 0.4.2, anonymous install counts, off by default, add the app version and platform to the check, and Agent Mode and AI requests ask before they first send anything to an AI provider; they always use your own key. See Security and privacy.

When people pick it

• You want a free alternative to Charles or Proxyman on the Mac, with breakpoints, Map Local, Rewrite, scripting and HAR export included at no cost. Your Charles sessions and settings come with you. See Import Charles settings.
• Your app’s traffic doesn’t show up in a proxy because it ignores the system proxy, as Flutter apps do. See Apps that ignore the proxy.
• You want an AI assistant such as Claude to read and change live traffic. See Debug with Claude.
• You want a proxy and a Postman-style API client in one app, with collections you can keep in Git and run in CI.

How it compares

For a side-by-side comparison with other debugging proxies, see Cloak Proxy alternatives.

Related

Quick startYour first decrypted request in five minutes.

FAQShort answers to common questions.

Security and privacyWhat stays on your Mac and how to remove everything.