Cloak Proxy

com.subcloak由 subcloak.com 发布v0.7.4更新于 Oct 30, 2026

Read, mock, pause and replay HTTPS traffic captured by Cloak Proxy, a free macOS debugging proxy.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

让助手驱动免费的 macOS 调试代理 Cloak Proxy，读取、模拟、暂停和重放捕获的 HTTPS 流量。

可以做什么
  • 读取并查看代理捕获的 HTTPS 流量，包括按应用分组的请求
  • 通过代理的调试规则暂停、模拟、改写或重放请求与响应
  • 操作内置 API 客户端的集合、环境、测试与流程
  • 以 HAR、CSV、Postman、OpenAPI 等格式导出或分享抓包会话
  • 运行自动化或无头代理会话，并对敏感信息做脱敏
适用场景
适合在 Mac 上调试 Web 应用、API 或 AI 代理时使用，让助手直接查看、拦截或重放实时 HTTPS 流量，而不必手工复制请求。也适用于以其他用户身份重放流量等安全测试场景。
运行要求
需在本机安装 Cloak Proxy（macOS 14 Sonoma 或更高版本，Apple 芯片或 Intel），通过签名并公证的应用或 Homebrew 安装。MCP 服务器以 stdio 本地运行，仅支持桌面端。无需账号、许可证密钥或 API 密钥。
安装前请注意
该代理会解密 HTTPS 流量，根证书密钥保存在本机，捕获的请求可能包含令牌、Cookie 和私有主机名。README 称 MCP 使用时会脱敏，但连接助手前仍应确认暴露的内容。规则可改写、拦截或重放流量，会改变应用和测试者看到的结果。应用源码未公开，但发布版本已签名并公证。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Cloak Proxy，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

[图片]

Cloak Proxy

See every request your Mac makes. A free, native macOS debugging proxy with an API client built in.

Download · Docs · Release notes · Report a bug

[Cloak Proxy capturing a Mac app's requests, then pausing one at a breakpoint and editing it]

Cloak Proxy decrypts HTTPS, lets you pause, mock and rewrite any request, catches apps that ignore the system proxy, and lets Claude or any MCP client drive it.

  • Free for life. No trial, no license key, no account, no sign-up. Optional: Personal Cloud ($3 a month or $25 a year) adds end-to-end encrypted sync between your Macs and share links; nothing in the app needs it.
  • Native and universal. Swift, for Apple silicon and Intel, macOS 14 Sonoma or later.
  • Local only. No telemetry. Traffic, collections and the root certificate's key stay on your Mac.

What it does

CaptureHTTPS decryption by host or app, traffic grouped by app with icons, HTTP/2, WebSocket, gRPC and GraphQL, and App Capture, a network extension for apps that ignore the system proxy (Go and Rust tools, curl, many Electron apps)
12 debugging toolsBreakpoints, Map Local, Map Remote, Rewrite (no code), Scripting, Block List, Allow List, Network Conditions, DNS Spoofing, No Caching, Mock Sets and Alerts. Any rule can be limited to chosen apps
DevicesOne-click iOS Simulator and Android setup, a certificate page with a QR code for iPhone, iPad and other devices, and Safari, Chrome and Firefox extensions that tag requests with their tab
API clientCollections, environments, tests, flows and monitors, stored as plain files you can keep in Git
InspectJSON tree, jq and JSONPath, Protobuf, request diffs, copy as cURL or 21 other languages, types from JSON
ShareHAR, Charles sessions, CSV, Postman collections and OpenAPI, with secret redaction
AI and securityLLM Inspector (tokens, cost, time to first token and prompt-cache misses for OpenAI, Anthropic, Gemini and Ollama) and an Authorization Matrix that replays traffic as another user to find IDOR bugs
AutomateAn MCP server with 148 tools for Claude Code, Cursor and Codex, with secrets redacted, and cloakctl for headless runs in CI
[A request paused at a breakpoint, being edited before it continues][The LLM Inspector showing tokens, cost and cache use for an AI API call]
[The Authorization Matrix comparing what each user gets back for each endpoint][Claude Code reading captured traffic through Cloak Proxy's MCP server]

A one-minute tour: youtu.be/ffpkFZRhO5g.

Install

  1. Download Cloak-Proxy.dmg from subcloak.com/apps/cloak-proxy or from Releases.
  2. Optional: check the file with shasum -a 256 ~/Downloads/Cloak-Proxy.dmg and compare it with the SHA-256 on the download page or in the release notes.
  3. Drag Cloak Proxy into Applications and open it. It's signed with a Developer ID and notarized by Apple, so it opens like any other app.

Step by step, with screenshots: Install Cloak Proxy.

Or with Homebrew: brew install --cask subcloak/tap/cloak-proxy.

Linux (beta): a .deb for Debian and Ubuntu, an RPM for Fedora and RHEL 10, or an AppImage or portable .tar.gz for any distribution with WebKitGTK 6.0, on x86_64 and ARM64, from the same download page or Releases. See Install on Linux.

Why it's free, and why the source isn't public

Subcloak is a security testing company: we test web apps, APIs and AI agents for a living, and a debugging proxy is open on our screens all day. We built Cloak Proxy for our own work and give it away. Security testing pays for it, so nothing in the app is held back to upsell and there's no data to sell: the app has no account, no analytics, and update checks are off until you turn them on. The one paid extra, Personal Cloud, is optional, end-to-end encrypted, and only for syncing between your own Macs and sharing links.

The app's source isn't public. The in-app SDK, CloakProxyKit, is MIT. Releases are signed and notarized by Apple, and SECURITY.md explains how to report issues.

This repository

This repository holds the issue tracker, release downloads and the changelog.

  • Bugs and feature requests: open an issue. Please remove tokens, cookies and private hostnames from anything you paste.
  • Security issues: don't open a public issue. See SECURITY.md.
  • Questions: the docs cover every feature, and the FAQ answers the common ones.

Built by Subcloak, an independent security practice for teams that ship.

来源：README.md，提交 513ac83

工具

0
SourceWeft 曾在隔离沙箱中以无凭据方式启动该软件包一次，以列出其工具，但未能完成：该软件包类型无法在沙箱中运行。

版本历史

8
  1. v0.7.4最新Oct 30, 2026
  2. v0.7.2Oct 30, 2026
  3. v0.7.1Oct 29, 2026
  4. v0.5.5Oct 25, 2026
  5. v0.5.4Oct 25, 2026
  6. v0.5.2Oct 24, 2026
  7. v0.5.1Oct 22, 2026
  8. v0.5.0Oct 20, 2026

评分

已满足适用检查项的 40%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分

    请保持端点能够响应 MCP 握手；SourceWeft 每 30 天探测一次。

  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具15 分

    请让服务器在无凭据时响应 tools/list，或发布可在沙箱中无凭据启动的软件包。

  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分

    请在仓库或注册中心条目中声明许可证。