Cloak Proxy
Free native HTTPS debugging proxy, API client and MCP server for Mac (Linux beta). Pause, edit and mock any request, inspect LLM calls, find IDOR bugs. Notarized, no account.
Free native HTTPS debugging proxy, API client and MCP server for Mac (Linux beta). Pause, edit and mock any request, inspect LLM calls, find IDOR bugs. Notarized, no account.
This page is designed to help you find out whether Cloak Proxy is good and if it is the right choice for you.
Cloak Proxy is a free, native macOS HTTPS debugging proxy by Subcloak, a security testing company. See every HTTP and HTTPS request your Mac, iPhone, Android devices, simulators and code make, then pause, edit, mock or fail any of them. No account, no paid tier, no telemetry: traffic stays on your machine.
Capture - Decrypt HTTPS only for the apps or hosts you choose - App Capture: a network extension that captures apps that ignore the macOS proxy (Go and Rust tools, curl, many Electron apps) - iPhone, iPad, Android, iOS Simulator, Docker, Electron, Flutter and terminals, each with a guided setup, plus a Doctor that explains missing traffic
Debug - Breakpoint, Map Local, Map Remote, Rewrite, JavaScript scripting, Network Conditions, block and allow lists, DNS spoofing and Mock Sets - WebSocket, gRPC, GraphQL and streaming (SSE) views
API client - Collections, environments, tests, a runner, mock servers and flows over HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT and more; imports Postman, Insomnia, OpenAPI, HAR and .http files
Beyond inspection - LLM Inspector: tokens, cost, time to first token and prompt-cache misses for OpenAI, Anthropic, Gemini and Ollama - Authorization Matrix: replay traffic as another user to find IDOR bugs - MCP server with 133 tools for Claude Code, Cursor and Codex, with secrets redacted
Signed and notarized by Apple; also via Homebrew (brew install --cask subcloak/tap/cloak-proxy), a signed .pkg for teams, and a Linux beta (.deb, RPM, AppImage).
Listed in
Cloak Proxy puts three tools in one free, native Mac app: a debugging proxy, a full API client and an MCP server for AI coding agents. Because they share one place, it can do things none of them can alone: replay captured traffic as another user to find IDOR bugs (the Authorization Matrix), show the tokens, cost and prompt-cache misses of every LLM API call, capture apps that ignore the macOS proxy with a network extension, and let Claude Code, Cursor or Codex read your traffic and set up mocks, with secrets redacted first. There's no account, no paid tier and no telemetry: everything stays on your Mac.
Developers who need to see and change the HTTP traffic of what they build: iOS, Android and web developers debugging their apps on devices and simulators, backend and API developers testing and mocking services, QA engineers simulating failures and slow networks, security testers looking for authorization bugs, and teams building AI agents who want to see every LLM and MCP call. It's for anyone who uses Proxyman, Charles, HTTP Toolkit, mitmproxy or Postman today.
It's free for life, with the features other proxies keep behind a licence: breakpoints, Map Local, Map Remote, scripting, network throttling and HAR export. It's a native Mac app, signed and notarized by Apple, and it also replaces a separate API client, since collections, environments, tests and a runner are built in. On top of that it adds things most proxies don't have: an LLM Inspector for AI API calls, an Authorization Matrix for IDOR testing, App Capture for apps that ignore the proxy, and an MCP server with 133 tools for AI coding agents. It never asks for an account and sends nothing to us. The honest trade-offs: the source isn't public, Linux is a beta, and there's no Windows version yet.
Subcloak is a security testing company: we test web apps, APIs and AI agents for a living, so a debugging proxy is open on our screens all day. The proxies we liked kept the features we use most, like breakpoints, Map Local, scripting and HAR export, behind a paid licence, and none of them understood the AI agent traffic our clients now ship. So we built our own for our own testing, and decided to give it away for free. Security testing pays for it, so there's no paid tier to upsell.
Swift and SwiftUI for the Mac and iPad apps, with SwiftNIO for the proxy engine, AsyncHTTPClient and swift-nio-ssl for upstream connections, JavaScriptCore for scripts and API client tests, and Apple's Network Extension framework for App Capture. The Linux beta shares the same Swift engine, with a TypeScript web UI shown in WebKitGTK. The MCP server follows the Model Context Protocol over stdio.
We have collected here some useful links to help you find out if Cloak Proxy is good.
Check the traffic stats of Cloak Proxy on SimilarWeb. The key metrics to look for are: monthly visits, average visit duration, pages per visit, and traffic by country. Moreoever, check the traffic sources. For example "Direct" traffic is a good sign.
Check the "Domain Rating" of Cloak Proxy on Ahrefs. The domain rating is a measure of the strength of a website's backlink profile on a scale from 0 to 100. It shows the strength of Cloak Proxy's backlink profile compared to the other websites. In most cases a domain rating of 60+ is considered good and 70+ is considered very good.
Check the "Domain Authority" of Cloak Proxy on MOZ. A website's domain authority (DA) is a search engine ranking score that predicts how well a website will rank on search engine result pages (SERPs). It is based on a 100-point logarithmic scale, with higher scores corresponding to a greater likelihood of ranking. This is another useful metric to check if a website is good.
The latest comments about Cloak Proxy on Reddit. This can help you find out how popualr the product is and what people think about it.
Do you know an article comparing Cloak Proxy to other products?
Suggest a link to a post with product alternatives.
Is Cloak Proxy good? This is an informative page that will help you find out. Moreover, you can review and discuss Cloak Proxy here. The primary details have been verified within the last quarter. So they could be considered up to date. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.
