Reference
FAQ
Short answers about Cloak Proxy: price, requirements, privacy, HTTPS decryption, pinned apps, devices, limits, Postman collections, CI and AI.
Quick answers to the questions people ask most about Cloak Proxy. Each answer links to the page with the details.
About Cloak Proxy
Section titled “About Cloak Proxy”What is Cloak Proxy?
Section titled “What is Cloak Proxy?”A native macOS app that sits between your apps and the internet so you can see, change and replay their HTTP and HTTPS traffic, with a built-in API client for writing and testing requests. It’s made by Subcloak. See the overview.
Is it really free?
Section titled “Is it really free?”Yes. Cloak Proxy is free for life: no trial, no license key, no account and no paid tier. Every feature in these docs is included. See Free for life.
What do I need to run it?
Section titled “What do I need to run it?”A Mac with macOS 14 Sonoma or later. Cloak Proxy is a universal app, so it runs natively on Apple silicon and Intel Macs. See Install.
Why does macOS warn me the first time I open it?
Section titled “Why does macOS warn me the first time I open it?”macOS can’t verify the developer the first time. Open System Settings › Privacy & Security and click Open Anyway. You only need to do this once. See Troubleshooting.
Privacy and security
Section titled “Privacy and security”Does Cloak Proxy send my data anywhere?
Section titled “Does Cloak Proxy send my data anywhere?”No. It has no telemetry, analytics or crash reporting, and captured traffic stays on your Mac. It connects to the internet only to forward your apps’ traffic and to do things you ask for, such as sending an API request or publishing a Gist. See Security and privacy.
Is the root certificate safe to install?
Section titled “Is the root certificate safe to install?”The certificate and its private key are created on your Mac and never leave it, and Cloak Proxy decrypts only the hosts and apps you choose. Keep the private key file private, and remove the certificate from devices when you’re done. See Certificate.
Can other people on my network use my proxy?
Section titled “Can other people on my network use my proxy?”Not by default: Cloak Proxy only accepts connections from your Mac. If you turn on Allow other devices to connect, anyone on your network can; limit it with Allowed devices and turn it off when you’re done. See Other devices and access control.
Can I use it to look at other people’s traffic?
Section titled “Can I use it to look at other people’s traffic?”Only with their permission. Use Cloak Proxy on your own apps, devices and accounts, or on systems you have written permission to test.
Capturing traffic
Section titled “Capturing traffic”Why don’t I see any requests?
Section titled “Why don’t I see any requests?”Usually the macOS proxy is off, recording is paused, or a filter is hiding them. Press ⇧ ⌘ P to capture macOS traffic and check the status in the middle of the toolbar. See Troubleshooting › No traffic appears.
Why is HTTPS shown as locked tunnels?
Section titled “Why is HTTPS shown as locked tunnels?”Cloak Proxy only decrypts HTTPS for hosts and apps you turn on. Trust the certificate, then click Enable only the host or Enable all domains from the app in the inspector. See SSL proxying.
Will my internet break if Cloak Proxy crashes?
Section titled “Will my internet break if Cloak Proxy crashes?”No. Quitting restores your previous proxy settings, and a small helper, the proxy guard, restores them within seconds if the app is force-quit or crashes. See How it works.
Can it decrypt apps that use certificate pinning?
Section titled “Can it decrypt apps that use certificate pinning?”No. Pinned apps refuse any certificate but their server’s, so their connections fail while decryption is on for them. Turn SSL proxying off for those hosts and their traffic passes through encrypted again. For domains captured for apps that ignore the proxy, Cloak Proxy does this by itself. For your own app, turn off pinning in debug builds. See Troubleshooting › Apps that pin certificates.
Some apps don’t show up at all. Why?
Section titled “Some apps don’t show up at all. Why?”They ignore the macOS proxy and connect directly. Cloak Proxy lists them under Not Using the Proxy in the sidebar and can capture them by pointing their domains at itself. See Apps that ignore the proxy.
Can I capture my iPhone, Android phone or simulator?
Section titled “Can I capture my iPhone, Android phone or simulator?”Yes. Click Devices in the toolbar for step-by-step setup for iPhone and iPad, the iOS Simulator, Android emulators and USB devices, and other devices. See Devices overview.
Does it handle HTTP/2, WebSockets and GraphQL?
Section titled “Does it handle HTTP/2, WebSockets and GraphQL?”Yes. Cloak Proxy talks HTTP/2 to servers and, on decrypted connections, to apps that support it. It shows WebSocket messages and detects GraphQL operations. See WebSocket and GraphQL.
How many requests can it hold?
Section titled “How many requests can it hold?”Up to 50,000 in the traffic list. Past that, the oldest 5,000 are dropped. Bodies larger than Max captured body size (32 MB by default) are forwarded in full but only partly kept. Save a session to keep traffic. See Recording and sessions.
Can I use Cloak Proxy with another proxy, such as a corporate proxy?
Section titled “Can I use Cloak Proxy with another proxy, such as a corporate proxy?”Yes. Turn on Send outgoing traffic through another proxy in Settings › Network and enter its host and port. HTTP/HTTPS (with a username and password) and SOCKS5 are supported. See Network settings.
Does Cloak Proxy change my system settings?
Section titled “Does Cloak Proxy change my system settings?”Only with your action: it sets the macOS proxy while capturing (and restores it), adds its certificate to your keychain when you click Install & Trust…, and adds /etc/resolver files when you capture an app that ignores the proxy. Each can be undone. See Security and privacy.
Debugging and the API client
Section titled “Debugging and the API client”Can I change requests and responses?
Section titled “Can I change requests and responses?”Yes. Breakpoints pause them for editing, Map Local answers with your own response, Map Remote sends them elsewhere, and Scripting changes them with JavaScript. See Tools overview.
Can I open my Postman collections?
Section titled “Can I open my Postman collections?”Yes. The API client imports Postman collections (v2.0 and v2.1) and environments, OpenAPI 3 and Swagger 2, HAR, Insomnia exports and cURL commands, and exports Postman and OpenAPI. See Import and export.
Does the API client need an account or the cloud?
Section titled “Does the API client need an account or the cloud?”No. Your workspace is a folder of JSON files on your Mac, which you can put in Git. Secret values stay in a git-ignored folder or your keychain. See Workspace and Git.
Can I run my API tests in CI?
Section titled “Can I run my API tests in CI?”Yes, on a macOS runner with Cloak Proxy installed. cloakctl collection run runs collections with JUnit, JSON and HTML reports, and cloakctl run records and checks the API traffic of any test command. See Headless runs and CI.
Can Claude or Cursor control Cloak Proxy?
Section titled “Can Claude or Cursor control Cloak Proxy?”Yes. Cloak Proxy includes an MCP server with 82 tools for traffic, debugging tools, Insights and the API client. See MCP server.
Is there a Windows or Linux version?
Section titled “Is there a Windows or Linux version?”Not yet. Cloak Proxy runs on macOS today. See Free for life.