Release notes

This page lists what changed in each version of Cloak Proxy. To see which version you have, choose Cloak Proxy › About Cloak Proxy.

0.1.0: first public release

October 2026

The first public release of Cloak Proxy: a native macOS HTTPS debugging proxy with a built-in API client, free for life.

• Free for life. No trial, no license key, no account and no usage limits.
• Universal app. One download runs natively on Apple silicon and Intel Macs with macOS 14 Sonoma or later.
• Local only. Everything runs on your Mac, with no telemetry and no cloud.

Capture

• HTTP proxy with HTTPS interception through a root certificate created on your Mac. Plain HTTP inside CONNECT tunnels is detected and parsed.
• SSL proxying by host (with wildcards) or by app. Turning it on closes open tunnels so apps reconnect decrypted.
• Certificate install and trust, removal and regeneration, your own root CA (P-256), client certificates for mutual TLS, and TLS key logging for Wireshark.
• macOS capture with one click, optionally at launch, with your previous proxy settings restored on quit. A proxy guard restores them if the app is force-quit or crashes.
• Bypass list, an apps sidebar with icons, a domains sidebar, pinned items and a sidebar filter.
• Apps that ignore the proxy are detected and can be captured through DNS.
• Unknown hosts fail at once instead of hanging.
• HTTP/2 to servers and to apps, WebSocket, GraphQL detection, a SOCKS5 proxy, reverse proxies, and an external upstream proxy (HTTP with authentication, or SOCKS5).

Devices and runtimes

• A certificate page at http://cloak.proxy with a QR code, and an IP allow list for devices.
• Guided setup for iPhone and iPad, one-click certificates for the iOS, tvOS and watchOS Simulators, and one-click Android setup for emulators and USB devices.
• A configured Terminal for Node.js, Python, Ruby, Go, curl and git, plus guides for Java, Firefox, Docker, Flutter and Electron.

Inspect

• Request and response side by side, with sortable, customizable columns, colored methods and statuses, and a GraphQL operation badge.
• Quick filter with contains, not, prefix, suffix, equals and regex matching (⌘ F), content chips, multiple filters and saved presets.
• Highlight colors and comments on requests.
• Request tabs for headers, query, body, form, GraphQL, cookies, auth (JWT and Basic), raw, code and summary; response tabs for WebSocket messages, headers, body, Set-Cookie and raw.
• Body viewers: a fast JSON tree with search, sorting and copy, JSONPath and jq queries, Pretty, Raw and Hex views, HTML and image previews, forms, multipart, schemaless Protobuf and gRPC framing, MessagePack, and gzip, deflate and Brotli decoding.
• Quick Preview for Base64, JWT, URL-encoded text, timestamps and JSON; side-by-side request diffs; and Search Everything (⇧ ⌘ A).
• Copy as cURL, Swift, JavaScript, Python, Go, HTTPie and Markdown.

Debugging tools

• Breakpoint for requests and responses, Map Local (inline, file or directory), Map Remote, Block List, Allow List, Network Conditions, DNS Spoofing and No Caching.
• Scripting with onRequest and onResponse in JavaScript, shared state, a console, snippets and a syntax check.
• Mock Sets that record responses and replay them offline, and Alerts that notify you about errors and slow responses.
• Rules match by wildcard or regex, method and subpaths, with a live URL tester. Create any rule from a captured request, and export or import rules as JSON.
• Repeat (⌘ R), Edit and Repeat (⌥ ⌘ E) and Compose (⌥ ⌘ N), with cURL import.

Insights

• An API catalog that groups traffic into endpoint templates with error rates, p50 and p95, and exports OpenAPI.
• A secret and PII scanner with masked values, and a security grade per host for headers and cookies.
• Performance findings, schema change detection, a waterfall timeline, alert history and a Markdown report.

Sessions and sharing

• Save and open .cloaksession files; import HAR, Charles .chlsj and cURL; export HAR, CSV, Postman Collection v2.1 and OpenAPI 3.
• Redaction of tokens, cookies, passwords, API keys and card numbers on export, and Publish to Gist with redaction on by default.

API client

• Requests over HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT 3.1.1 and 5, MCP, AI, SQL (PostgreSQL, MySQL, SQLite, CSV and JSON) and raw TCP, TLS and UDP, plus HTTP over Unix sockets.
• Collections and environments with folders, docs, auth and scripts at every level, variable scopes, a Keychain vault and about 50 dynamic variables.
• Scripts and tests with pm.*, reusable requests through pm.execution.runRequest, workspace packages and npm packages.
• An MCP client for stdio, Streamable HTTP and HTTP+SSE servers, and Agent Mode (⇧ ⌘ I) with your own Anthropic, OpenAI, Gemini or OpenAI-compatible key.
• A collection runner for every protocol, with data files and datasets, and JSON, JUnit and HTML results.
• Local load testing with fixed, ramp-up, spike and peak profiles.
• Monitors with history, and Flows that can run on a schedule or when a webhook arrives.
• An OpenAPI and Swagger spec editor with lint, and collections generated from specs that stay in sync.
• API documentation as one HTML file, with custom branding.
• Mock servers that answer from a collection’s saved examples, and a webhook receiver that records, forwards and replays deliveries.
• Client SDKs in TypeScript, Python and Swift, and a ready-to-run Node.js MCP server generated from any collection.
• A workspace of small JSON files with Git built in (status, diff, discard, commit, pull, push and branches), comments, and Recently Deleted for 30 days.

Automation and AI

• cloakctl: a headless proxy and CI recorder with redaction, reports, offline mocks and --fail-on-… checks, plus status, list, show, curl, replay and export.
• Newman-style cloakctl collection run with environments, globals, data files, iterations, folders and reporters, plus mock, perf, spec and docs.
• A local, token-protected control API.
• An MCP server with 82 tools, 6 resources and 5 prompts covering the whole app.

Known limitations

• Apps that pin their certificates can’t be decrypted.
• Your own root CA must use a P-256 key.
• Protobuf bodies are decoded without a schema; .proto files can’t be imported into the inspector.
• The traffic list holds up to 50,000 requests in memory.
• macOS asks you to approve the app with Open Anyway the first time you open it.

Related

InstallDownload, install and update Cloak Proxy.

Free for lifeWhat's included, with no trial and no account.

Cloak Proxy overviewA tour of every feature area.