Rockxy

Rockxy

English | Tiếng Việt | 中文 | 繁體中文 | Español | Português do Brasil | 日本語 | 한국어 | Français | Deutsch | Italiano | Türkçe | Polski | Nederlands | Русский | Українська | العربية | فارسی | বাংলা | Română | ქართული

The AGPL-licensed Community source edition of Rockxy for macOS.

Intercept, inspect, and modify HTTP/HTTPS/WebSocket/GraphQL traffic with a native Swift app you can inspect, build, and trust.
Built for API, mobile, MCP-assisted, AI, and blockchain-era debugging workflows as Rockxy evolves.
A local-first, AGPL-3.0 alternative to Proxyman and Charles Proxy.

[!TIP] Translation improvements are welcome in every language. Found wording that is awkward, inaccurate, culturally inappropriate, truncated, or too literal? Open a translation issue or send a focused PR. Small repairs can be made without Xcode. See the localization guide for both repair and new-language workflows.

[!IMPORTANT] This repository contains the public Rockxy Community source edition under AGPL-3.0-or-later. Builds made solely from this repository are AGPL builds. Official signed Rockxy downloads are produced from a separate downstream distribution, run in free Community mode by default, can unlock paid Pro capabilities, and—when they include or present Binary EULA v1.0—are licensed under that Rockxy Binary EULA. Earlier downloads remain subject to the terms represented with their release. This repository is not represented as the complete source tree used to build the official DMG. See LICENSING.md for the artifact-by-artifact licensing boundary.

---

Latest Tagged Release

v0.41.0 — 2026-10-08

Added

• Explore the active traffic tab with Traffic Insights: spot slow requests and failures, compare traffic over time, find top apps and hosts, and export a Markdown report.
• Keep investigations organized in local Projects with saved traffic history, tab layouts, and filters. Project configuration can be imported and exported without moving captured traffic.
• Redact credentials and other sensitive values when exporting Rockxy sessions, HAR, CSV, or Postman files, while keeping the original captured session intact.
• Inspect recognized model API and Web3 RPC traffic with dedicated details, and find model API, Web3, gRPC, GraphQL, WebSocket, and HTTP exchanges through protocol labels and filters.
• Review nearby iPhone transfers in their own workspace while keeping the Mac’s current traffic available.
• Apply HTTPS decryption and tunnel rules to specific apps, route traffic through an upstream proxy, import cURL into Compose, and copy requests as Swift, Python, JavaScript, or Go snippets.

Fixed

• Imports keep every request instead of trimming to the live history limit. HAR exports preserve content types, timestamps, readable streamed bodies, and measured durations more reliably.
• Repeat, Edit and Repeat, and Compose results appear as inspectable traffic rows; replay also handles plain HTTP and edited destinations correctly.
• WebSocket upgrades, plain HTTP inside CONNECT tunnels, upstream proxy routing, and TLS failure reporting are more reliable and easier to diagnose.
• Header rules work alongside Map Local, Block, and other rules; invalid headers no longer break a response, and No Caching prevents clients from reusing stale responses.
• Redacted shares, MCP exports, and inspections of compressed responses better protect credentials while keeping useful debugging details visible.
• Developer Setup no longer hits the reported window layout crash, and proxy stop/recovery handles delayed helper responses without requiring a second click.
• Perpetual license access remains available after its included update period instead of falling back to Community.

Changed

• Developer Setup is now a compact, target-aware workflow with clearer manual and automatic paths, certificate trust status, and more useful readiness and launch results.
• Server-Sent Events, NDJSON, and WebSocket exchanges appear while they are active, with stream and frame details updated as traffic arrives.
• Counts, sizes, durations, dates, and translated interface text follow the app language and the Mac’s region more consistently.
• Large captures remain more responsive through reduced per-row analysis and paced Traffic Insights updates.

See CHANGELOG.md for the full release history.

Current Branch Highlights

• AI Assistant now investigates one or more selected requests with built-in local analysis, optional Ollama or configured provider models, explicit Review Data confirmation, bounded redaction, streaming responses, evidence reveal, and user-initiated handoffs.
• The native sidebar now includes reusable Focus Sets for app/domain/path scopes plus workspace-scoped Noise Control that hides matching domains or paths without stopping capture.
• The main workspace now uses native vertical and horizontal split views for the Context Dock and bottom inspector, preserving full-height dividers, coordinated toolbar/footer separators, and automatic layout resizing.
• Upstream Proxy now includes free/core Automatic Proxy Configuration with PAC URL routing for DIRECT, HTTP, and HTTPS routes while preserving existing SOCKS5 and authentication policy boundaries.
• Export workflows now cover OpenAPI YAML/HTML and selected-traffic Gist publishing with redaction-aware payload building.
• Inspector tools now include JSONPath/key/value filtering and quick previews for selected payload text such as JWTs.
• AI and Web3 traffic inspection now adds protocol labels, inspector tabs, and debug summaries for recognized model calls, JSON-RPC traffic, and x402-style payment hints.
• Node.js Developer Setup now mirrors the selected client during validation and has a fuller localhost sample guide.
• Developer Setup Hub now covers runtimes, browsers, clients, devices, frameworks, and environments with target-specific snippets, validation watchers, and honest guide content.
• WebSocket binary-frame inspection now includes bounded, on-demand Protobuf wire-format heuristics without adding decoder work to the capture hot path.
• Public roadmap planning now focuses on deeper protocol-aware rules, replay, comparison, and safer redacted evidence sharing.

Features

The tools you reach for when browser DevTools are not enough. Core traffic debugging for Mac and iOS work — native on macOS, with public releases and a local-first workflow.

Traffic Capture

Inspect HTTP, HTTPS, WebSocket, and GraphQL traffic from any Mac app, CLI, or iOS device. Browser DevTools end at the browser — Rockxy sees the rest of your stack.

HTTP / HTTPS · WebSocket · GraphQL · iOS Device & Simulator · Filter by Process ID · Timing Waterfall

Advanced Filter & Search

Narrow thousands of captured requests in seconds. Combine method, host, status, header, body, and process filters — or run a full-text search across the whole session.

Multi-Field Filters · Full-Text Search · Status / Method · Header / Body Match · Process / Host · Saved Filters

Focus Sets & Noise Control

Turn recurring investigations into reusable sidebar scopes. Focus Sets combine application, domain, and path includes with domain or path exclusions, persist across launches, and remain available in every workspace. Noise Control keeps telemetry and other low-value domains or paths captured but hidden from the current workspace.

Reusable Focus Sets · App / Domain / Path Scope · Include & Exclude · Workspace Noise Control · Capture Continues

AI Assistant

Select one or more captured requests and ask what happened, what failed, what changed, or what to verify next. Rockxy starts with evidence-grounded analysis on this Mac; a configured Ollama or provider model runs only after Review Data shows the exact bounded, redacted context. Responses can reveal their source request and prepare native follow-up workflows, but the Assistant never mutates traffic or executes those actions automatically.

Built-in Local Analysis · Multi-Request Context · Ollama & Provider Models · Review Data · Sensitive-Data Redaction · Read-only Actions

Read the AI Assistant guide.

MCP Server for External AI Clients

Let Claude Desktop, Claude Code, or another MCP client inspect captured traffic through ten read-only tools in Rockxy’s local MCP server. Ask “why did this 500?” instead of pasting headers into chat. Ten more tools can create mock, breakpoint, redirect, block, and script rules or pause recording, but Rockxy refuses them until you turn on Allow MCP Clients to Change Rules and Capture. The implementation is open source, token-authenticated, and keeps sensitive-data redaction enabled by default.

Claude Desktop · Claude Code · Local stdio · Redaction · Open Source

Developer Setup Hub

Copy-paste proxy snippets for Python, Node.js, Go, Rust, cURL, Docker, and browsers, then click Run Test to confirm traffic is actually flowing.

Python · Node.js · Go / Rust / Java · cURL / Docker · One-Click Verify · Trust Diagnostics

Certificate Management for HTTPS Debugging

A P-256 ECDSA root CA generated on first launch, sealed in your Keychain. Decrypt HTTPS on the first try; pinned hosts pass through automatically.

P-256 ECDSA Root CA · Keychain-Sealed Key · Per-Host Leaf Certs · Trust Wizard · Pinned-Host Passthrough · Rotate / Reset

SSL Proxy & HTTPS Decryption

Pick which hosts get TLS decryption. Decrypted traffic shows real headers and JSON; everything else passes through encrypted. Wildcard rules let you scope by domain in one click.

Per-Host Decryption · Wildcard Rules · Allow / Deny List · TLS 1.2 / 1.3 · Pinned Host Passthrough

Bypass Proxy

Skip specific hosts so cert-pinned apps, internal services, or noisy telemetry never enter the capture. Wildcards keep the list short and your request log focused on what you actually care about.

Per-Host Bypass · Wildcard Patterns · Skip Pinned Hosts · Mute Telemetry · Reduce Noise · Toggle Anytime

Block List

Make any host fail. Drop ad networks, third-party trackers, or a flaky dependency to see how your app degrades when it’s gone — without changing a line of code.

Per-Host Block · Wildcard Match · Simulate Outage · Test Fallbacks · Strip Trackers · Toggle Anytime

Map Local

Serve a saved file or a directory tree in place of a live response. Swap a JSON payload, replay a snapshot, or pin a flaky third-party API to a local copy while you debug.

File or Directory · Response Snapshot · Regex Patterns

Map Remote

Rewrite the destination of a captured request without touching app code or /etc/hosts. Point production traffic at staging, your dev server, or a colleague’s machine for a reproducible bug repro.

Host Rewrite · Regex Patterns · Preserve Host Header

Breakpoints & Rules

Pause a request or response, edit method, headers, body, or status, then continue. The fastest way to test “what if the API returns 401?” without touching the backend.

Request Breakpoints · Response Breakpoints · Block · Throttle · Regex / Wildcard Match · Inject Failure States

Modify Headers

Add, remove, or replace headers on any host without redeploying. Test CORS, auth, or cache changes in seconds with built-in presets.

Add / Remove / Replace · CORS Presets · Auth Stripping · Request Phase · Response Phase · URL Pattern Scope

Custom Request & Response Headers

Promote any request or response header into a first-class traffic-table column. Keep request and response sources separate, save the headers you care about, then scan request IDs, trace IDs, cache state, or custom metadata without opening each inspector.

Request Headers · Response Headers · Saved Columns · Trace IDs · Case-Insensitive Match · Live Table Update

Network Conditions

Throttle to 3G, EDGE, LTE, WiFi, or a custom delay. Your laptop is on fiber; your users aren’t — see the UX at 400 ms RTT before they do.

3G · EDGE · LTE · WiFi · Very Bad Network · Custom Latency

Compose — Edit & Replay

Rebuild any captured HTTP request — change method, URL, headers, query params, or body — and re-send without leaving Rockxy. No Postman, Insomnia, or curl copy-paste loop. Iterate on LLM prompts, fuzz auth boundaries, or reproduce a failing case for OpenAI, Anthropic, and Cohere endpoints in seconds.

Edit Headers · Edit Body · Edit Query · Edit Method · LLM Prompt Iteration · Postman Alternative · OAuth Flow Debug · Webhook Replay

Compare

Stack two captured transactions or pasted payloads side-by-side and spot every field that flipped — status, headers, JSON keys, or body bytes. Catch silent API regressions, non-deterministic LLM outputs, and prompt drift without piping anything into a third-party diff tool.

Diff Compare · Side-by-Side · JSON Diff · Header Diff · Body Diff · LLM Output Compare · Non-determinism · API Regression · Schema Drift

Custom Previewer Tabs

Render request and response bodies the way you want. Pin extra tabs to the inspector for JSON, GraphQL, JWT, image, or your own format — reusable across every captured request.

JSON · GraphQL · JWT Decoder · Image / Hex · Custom Format · Pinned per Inspector

Sessions & Export

Save sessions, import/export HAR for cross-tool handoff, copy any request as cURL or JSON. Redact authorization headers, cookies, and bearer tokens before sharing — hand a teammate a working bug repro without leaking secrets.

.rockxysession · HAR Import / Export · Copy as cURL · Copy as JSON · Raw HTTP · Secret Redaction · Token Sanitize · Privacy-Safe Share

Projects & Traffic Tabs

Group work into local Projects — one Project for checkout, another for authentication, each with tabs for errors, devices, or environments. New requests are assigned to the active Project when they begin; switching back restores that Project’s in-memory traffic and durable tab setup.

3 Local Projects · Project-Scoped Traffic · Durable Tab Filters · Per-Tab Inspector · Config Import / Export · No Captured Bodies in Catalog

JavaScript Scripting

JS hooks on requests and responses for the cases a static rule can’t cover — redact PII, sign tokens, rewrite payloads. Errors surface inline instead of corrupting traffic.

Request Hooks · Response Hooks · Programmatic Filtering · PII Redaction · Inline Error Feedback

Protocol-Aware Inspection

Rockxy ships protocol-aware AI, Web3 RPC, and x402 inspection inside the normal HTTP debugging workflow.

AI Traffic Inspection

Rockxy detects recognized AI requests inside the normal capture workflow. Inspect selected model calls, streaming state, usage fields when present, warnings, retrieval hints, and tool-call summaries without pasting sensitive payloads into another service.

AI Requests · Model Inspector · Streaming State · Tool Calls · Retrieval Hints · Usage Signals

Web3/RPC Inspection

Rockxy turns blockchain-era network calls into readable debugging evidence. Inspect EVM and Solana-style HTTP JSON-RPC traffic with provider host, request ID, method, batch summary, error, chain, transaction, payload, and debug-intent details without turning Rockxy into a wallet or block explorer.

JSON-RPC · Solana RPC · Request ID · RPC Errors · Batch Summary · Network Evidence

x402 Payment Flow Hints

Rockxy highlights payment-required and retry-oriented hints so payment-gated HTTP flows are understandable from the network layer while debugging evidence stays local and redaction-aware.

Payment Required · Retry Flow · Headers · Redaction · Local First

Future Work

The following sections describe public direction rather than current behavior.

Protocol-Aware Rules

Rockxy can label and inspect AI and Web3 traffic today. Deeper rule matching by model, tool call, JSON-RPC method, chain, transaction hash, or batch subcall remains future work; current traffic modification tools still match URL, HTTP method, and headers.

Smart Filters · Request Badges · Protocol Column · Inspector Tabs · Future Rule Metadata

Redacted Evidence Bundles Coming Soon

Share the facts needed to reproduce a bug without leaking secrets. Package selected traffic with protocol summaries, redaction previews, and source-backed context a teammate can audit.

Debug Bundles · Protocol Summary · Export Preview · Secret Redaction · Repro Context

Team Sharing & Collaboration Coming Soon

Send a captured session to a teammate with one click. Annotate failing requests inline, see who’s looking at what in real time, and pair-debug HTTPS traffic without screen-sharing. Targeted for a future release.

Shared Sessions · Team Workspaces · Inline Comments · Live Cursor · Cloud Sync · Pair Debug · SSO · Audit Log

Native macOS app shell — no Electron. SwiftUI + AppKit + SwiftNIO, with WebKit used only for HTML body preview.

Quick Start

These commands build the public AGPL Community source edition. That build is not the same artifact as the official signed DMG published on GitHub Releases.

git clone https://github.com/RockxyApp/Rockxy.git
cd Rockxy
open Rockxy.xcodeproj

Build and run in Xcode. The Welcome window guides you through root CA setup, helper installation, and proxy activation.

Requirements: macOS 14.0+, Xcode 16+, Swift 5.9

If you want to connect Rockxy to a local MCP client after installation, see the MCP Integration guide.

Rockxy vs. Alternatives

The main matrix covers general-purpose web-debugging proxies. Security-testing suites and browser/API-oriented interceptors with substantial workflow overlap are listed separately so unlike products are not presented as interchangeable. Packet analyzers and API-only clients are outside this comparison.

Direct web-debugging proxies

	Rockxy	Proxyman	Charles Proxy	mitmproxy	HTTP Toolkit	Fiddler Everywhere
Product shape	Native macOS debugging proxy	Native macOS app; Electron-based Windows/Linux editions	Cross-platform desktop debugging proxy	Cross-platform CLI/TUI and web UI proxy toolkit	Cross-platform Electron desktop proxy and HTTP client	Cross-platform desktop debugging proxy
Source and build model	Public Community source under AGPL-3.0-or-later; buildable with Xcode. The official DMG also contains non-public downstream components	Closed source; no public application source identified in the official materials reviewed	Closed source; no public application source identified in the official materials reviewed	Public MIT-licensed source; buildable from source	Public AGPL desktop source; buildable from source; published binaries have additional licensing options	Closed source; distributed as object code under the Fiddler Everywhere EULA
Capture and setup	Local system proxy with guided setup for Mac apps, runtimes, iOS devices, and Simulator	Automatic setup for Mac apps, runtimes, and mobile devices	Local proxy with macOS, iOS, and cross-platform setup guides	Regular, local-process, WireGuard, reverse, transparent, and other capture modes	Targeted and manual proxy interception for browsers, runtimes, containers, and mobile devices	System, network, browser, terminal, explicit, and remote-device capture modes
Modify and mock	Breakpoints, Map Local/Remote, header rules, blocking, and latency rules	Breakpoints, Map Local/Remote, block lists, network conditions, and JavaScript rules	Breakpoints, Rewrite, Map Local/Remote, blocking, and throttling	Map Local/Remote, body/header modification, blocking, and server replay	Breakpoints plus rule-based rewrite, redirect, mock, and error injection; some automation is plan-limited	Rules, breakpoints, redirects, response modification, and mocking
Replay and compare	Compose/replay plus local side-by-side request, header, and body comparison	Compose, Repeat, and Diff	Repeat and edit requests	Client-side and server-side replay	Built-in HTTP client for composing and sending requests	API Composer, traffic replay, and traffic comparison documented as beta
WebSocket workflows	Text/binary frame inspection with bounded Protobuf heuristics	WS/WSS inspection; scripts can modify handshake URL/headers, not messages	WebSocket support is documented in the official version history	WebSocket interception and scripting; WebSocket replay is not supported	WebSocket inspection plus WebSocket-specific rules	WebSocket capture and inspection
Scripting and extensibility	Sandboxed JavaScriptCore hooks with a bounded API and execution timeout	JavaScript request/response scripting	Rewrite rules and a control Web Interface; no general JavaScript scripting feature documented	Python addons and command-line automation	Rule-based automation plus public source and proxy libraries	Rule-based automation; no first-party general scripting feature documented
Upstream routing	HTTP/HTTPS upstream proxy and PAC URL routing; Community policy disables proxy authentication and SOCKS5 and caps bypass rules at three	External HTTP/HTTPS/SOCKS and PAC routing with bypass rules	External HTTP/HTTPS/SOCKS proxies with authentication and bypass rules	HTTP/HTTPS upstream mode plus reverse and SOCKS listener modes	System, HTTP, HTTPS, and SOCKS upstream settings; plan limits may apply	Automatic chaining to system proxies plus reverse-proxy capture
AI and MCP	In-app AI Assistant and built-in local MCP with 10 read-only tools, 10 opt-in rule and capture controls (off by default), token authentication, and redaction on by default	Built-in MCP for external AI clients, including traffic reads and app/rule controls	Not documented	Not documented	A bundled local MCP bridge is present in the current official source; no in-app assistant documented	Built-in MCP plus a Pro-tier Debugging Assistant whose current documentation requires captured traffic details to be pasted into chat

Adjacent interception tools

These products overlap meaningfully with Rockxy but lead with security testing, browser rules, or API-client workflows rather than the same general-purpose native debugging-proxy focus.

Product	Why it is adjacent	Source and build model	Relevant overlap	AI and MCP
Burp Suite	Web-security testing suite with an intercepting proxy	Closed-source application; its EULA states that users have no right to the application source. Extensions can use separate licenses	Proxy interception and match/replace, Repeater, WebSockets, upstream/SOCKS proxying, and a large extension ecosystem	Burp AI is available in Repeater; PortSwigger also maintains a public MCP Server extension for external AI clients
ZAP	Security scanner and intercepting proxy	Public Apache-2.0 source; buildable from source	Intercept/edit, manual resend, WebSocket breakpoints and scripts, multi-language scripting, add-ons, and automation	Official MCP Integration and optional LLM Support add-ons
Requestly HTTP Interceptor	Browser-extension and cross-platform desktop interceptor/mock tool	Public AGPL desktop-interceptor source; the separate Requestly API Client is proprietary according to its public community-repository notice	System-wide/browser capture, redirect, Map Local/Remote, header/body modification, JavaScript transforms, mocks, and delay/error simulation	A separate official MCP server manages rules and groups; no in-app traffic-analysis assistant documented

Feature availability can vary by edition, plan, platform, or add-on. “Not documented” means that a capability was not found in the official first-party sources reviewed on 2026-08-22; it is not proof that the capability is absent. Product and feature statements above were checked against vendor documentation, vendor-maintained source repositories, or vendor license terms on that date and may change. Product names and trademarks belong to their respective owners; Rockxy is not affiliated with or endorsed by them. Corrections are welcome through the Rockxy issue tracker.

On the roadmap: deeper protocol-aware rules, safer redacted evidence bundles, stronger replay and comparison workflows, broader Developer Setup guidance, and continued HTTP/2 and HTTP/3 research.

Security

Rockxy intercepts network traffic — security is foundational, not optional.

• XPC helper validates callers via certificate-chain comparison, not just bundle ID
• Plugins run in sandboxed JavaScriptCore with 5-second timeout, no filesystem/network access
• Input validation on all boundaries — body size caps, URI limits, regex DoS protection, path traversal prevention
• Credentials automatically redacted in captured logs
• Sensitive files stored with 0o600 permissions

Report vulnerabilities via SECURITY.md. See the full security architecture for details.

Roadmap

Rockxy’s public roadmap is workflow-oriented and date-free. It focuses on reliability, native macOS UX, debugging workflows, protocol support, AI/Web3-era traffic visibility, documentation, and contributor onboarding.

• ROADMAP.md: high-level public engineering direction
• Rockxy Public Roadmap: operational visibility for roadmap-tracked issues

Documentation

Full documentation available at the Rockxy Docs:

• Quickstart Guide — get up and running in minutes
• Developer Setup Hub — runtime snippets, device guides, validation probes, and support matrix
• AI Assistant — investigate selected traffic with local analysis or an explicitly reviewed configured model
• Filters and Search — use sidebar scopes, Focus Sets, Noise Control, toolbar filters, and search
• AI and Web3 Inspection — inspect recognized model API, JSON-RPC, and x402-style traffic
• MCP Integration — connect Rockxy to local MCP clients
• Architecture — proxy engine, actor model, data flow
• Security Model — trust boundaries, XPC validation, certificate management
• Design Decisions — why SwiftNIO, NSTableView, actors
• Building from Source — build, test, lint, and debug
• Code Style — SwiftLint, SwiftFormat, and conventions
• Changelog — unreleased work and tagged releases

Contributing

Contributions welcome — code, tests, docs, bug reports, and UX feedback.

See CONTRIBUTING.md for setup instructions, code style, and the full PR checklist.

Good first issues are labeled good first issue. By opening a PR, you agree to the CLA.

Sponsors & Partners

Rockxy is independently maintained. Sponsorships help fund continued development, release infrastructure, documentation, and security work.

Rockxy is fiscally hosted by Open Source Collective. Contributions and project expenses are recorded on Rockxy’s public Open Collective page, giving supporters a transparent view of how funds are received and used.

Tier	Contribution	What it supports
Backer	From $5/month	Open-source maintenance, documentation, testing, and releases
Builder	From $25/month	Regression testing, performance improvements, and everyday debugging workflows
Sponsor	$100/month	Long-term maintenance of a privacy-focused tool that remains freely available to developers
Sustaining Sponsor	$500/month	Focused maintenance and product development, including release automation and protocol support

Partnership inquiries — developer tool companies, security firms, and enterprise teams looking for custom integrations or white-label solutions: [email protected]

Support

• Open Collective — contribute to Rockxy through its transparent project budget
• GitHub Sponsors — support Rockxy’s development
• GitHub Issues — bug reports and feature requests
• GitHub Discussions — questions and community chat
• Email — [email protected]
• Security issues — see SECURITY.md for responsible disclosure

License

The source in this public repository is available under the GNU Affero General Public License v3.0 or later, except identified third-party material. Official signed DMG downloads that include or present Binary EULA v1.0 are governed by that Rockxy Binary EULA. See LICENSING.md for the complete artifact boundary and COPYRIGHT.md for ownership and attribution information.

Star History

---

_{Made by Stephen. Built with Swift, SwiftNIO, SwiftUI, and AppKit.}