English | Tiếng Việt | 中文 | 繁體中文 | Español | Português do Brasil | 日本語 | 한국어 | Français | Deutsch | Italiano | Türkçe | Polski | Nederlands | Русский | Українська | العربية | فارسی | বাংলা | Română | ქართული
The AGPL-licensed Community source edition of Rockxy for macOS.
Intercept, inspect, and modify HTTP/HTTPS/WebSocket/GraphQL traffic with a native Swift app you can inspect, build, and trust.
Built for API, mobile, MCP-assisted, AI, and blockchain-era debugging workflows as Rockxy evolves.
A local-first, AGPL-3.0 alternative to Proxyman and Charles Proxy.
Tip
Translation improvements are welcome in every language. Found wording that is awkward, inaccurate, culturally inappropriate, truncated, or too literal? Open a translation issue or send a focused PR. Small repairs can be made without Xcode. See the localization guide for both repair and new-language workflows.
Important
This repository contains the public Rockxy Community source edition under AGPL-3.0-or-later. Builds made solely from this repository are AGPL builds. Official signed Rockxy downloads are produced from a separate downstream distribution, run in free Community mode by default, can unlock paid Pro capabilities, and—when they include or present Binary EULA v1.0—are licensed under that Rockxy Binary EULA. Earlier downloads remain subject to the terms represented with their release. This repository is not represented as the complete source tree used to build the official DMG. See LICENSING.md for the artifact-by-artifact licensing boundary.
v0.37.0 — 2026-08-29
- Added native toolbar customization with a broader set of workspace actions.
- Completed the Map Local response workflow for serving local files, directories, and custom responses.
- Added complete Simplified Chinese localization across Rockxy and Pro workflows, including licensing, advanced inspection, Android automation, Project Cloud Sync, and Workspace login and upload.
- Added live in-app language switching, with System Default following macOS immediately.
- Prevented side-by-side Diff views from overflowing their window.
- Refined focus sheets and restored reliable sidebar toggle behavior.
- Restored localized titles across app and utility windows.
See CHANGELOG.md for the full release history.
- AI Assistant now investigates one or more selected requests with built-in local analysis, optional Ollama or configured provider models, explicit Review Data confirmation, bounded redaction, streaming responses, evidence reveal, and user-initiated handoffs.
- The native sidebar now includes reusable Focus Sets for app/domain/path scopes plus workspace-scoped Noise Control that hides matching domains or paths without stopping capture.
- The main workspace now uses native vertical and horizontal split views for the Context Dock and bottom inspector, preserving full-height dividers, coordinated toolbar/footer separators, and automatic layout resizing.
- Upstream Proxy now includes free/core Automatic Proxy Configuration with PAC URL routing for
DIRECT, HTTP, and HTTPS routes while preserving existing SOCKS5 and authentication policy boundaries. - Export workflows now cover OpenAPI YAML/HTML and selected-traffic Gist publishing with redaction-aware payload building.
- Inspector tools now include JSONPath/key/value filtering and quick previews for selected payload text such as JWTs.
- AI and Web3 traffic inspection now adds protocol labels, inspector tabs, and debug summaries for recognized model calls, JSON-RPC traffic, and x402-style payment hints.
- Node.js Developer Setup now mirrors the selected client during validation and has a fuller localhost sample guide.
- Developer Setup Hub now covers runtimes, browsers, clients, devices, frameworks, and environments with target-specific snippets, validation watchers, and honest guide content.
- WebSocket binary-frame inspection now includes bounded, on-demand Protobuf wire-format heuristics without adding decoder work to the capture hot path.
- Public roadmap planning now focuses on deeper protocol-aware rules, replay, comparison, and safer redacted evidence sharing.
The tools you reach for when browser DevTools are not enough. Core traffic debugging for Mac and iOS work — native on macOS, with public releases and a local-first workflow.
Inspect HTTP, HTTPS, WebSocket, and GraphQL traffic from any Mac app, CLI, or iOS device. Browser DevTools end at the browser — Rockxy sees the rest of your stack.
HTTP / HTTPS · WebSocket · GraphQL · iOS Device & Simulator · Filter by Process ID · Timing Waterfall
Narrow thousands of captured requests in seconds. Combine method, host, status, header, body, and process filters — or run a full-text search across the whole session.
Multi-Field Filters · Full-Text Search · Status / Method · Header / Body Match · Process / Host · Saved Filters
Turn recurring investigations into reusable sidebar scopes. Focus Sets combine application, domain, and path includes with domain or path exclusions, persist across launches, and remain available in every workspace. Noise Control keeps telemetry and other low-value domains or paths captured but hidden from the current workspace.
Reusable Focus Sets · App / Domain / Path Scope · Include & Exclude · Workspace Noise Control · Capture Continues
Select one or more captured requests and ask what happened, what failed, what changed, or what to verify next. Rockxy starts with evidence-grounded analysis on this Mac; a configured Ollama or provider model runs only after Review Data shows the exact bounded, redacted context. Responses can reveal their source request and prepare native follow-up workflows, but the Assistant never mutates traffic or executes those actions automatically.
Built-in Local Analysis · Multi-Request Context · Ollama & Provider Models · Review Data · Sensitive-Data Redaction · Read-only Actions
Let Claude Desktop or Cursor inspect captured traffic through ten read-only tools in Rockxy's local MCP server. Ask "why did this 500?" instead of pasting headers into chat. The implementation is open source, token-authenticated, and keeps sensitive-data redaction enabled by default.
Claude Desktop · Cursor · Local stdio · Redaction · Open Source
Copy-paste proxy snippets for Python, Node.js, Go, Rust, cURL, Docker, and browsers, then click Run Test to confirm traffic is actually flowing.
Python · Node.js · Go / Rust / Java · cURL / Docker · One-Click Verify · Trust Diagnostics
A P-256 ECDSA root CA generated on first launch, sealed in your Keychain. Decrypt HTTPS on the first try; pinned hosts pass through automatically.
P-256 ECDSA Root CA · Keychain-Sealed Key · Per-Host Leaf Certs · Trust Wizard · Pinned-Host Passthrough · Rotate / Reset
Pick which hosts get TLS decryption. Decrypted traffic shows real headers and JSON; everything else passes through encrypted. Wildcard rules let you scope by domain in one click.
Per-Host Decryption · Wildcard Rules · Allow / Deny List · TLS 1.2 / 1.3 · Pinned Host Passthrough
Skip specific hosts so cert-pinned apps, internal services, or noisy telemetry never enter the capture. Wildcards keep the list short and your request log focused on what you actually care about.
Per-Host Bypass · Wildcard Patterns · Skip Pinned Hosts · Mute Telemetry · Reduce Noise · Toggle Anytime
Make any host fail. Drop ad networks, third-party trackers, or a flaky dependency to see how your app degrades when it's gone — without changing a line of code.
Per-Host Block · Wildcard Match · Simulate Outage · Test Fallbacks · Strip Trackers · Toggle Anytime
Serve a saved file or a directory tree in place of a live response. Swap a JSON payload, replay a snapshot, or pin a flaky third-party API to a local copy while you debug.
File or Directory · Response Snapshot · Regex Patterns
Rewrite the destination of a captured request without touching app code or /etc/hosts. Point production traffic at staging, your dev server, or a colleague's machine for a reproducible bug repro.
Host Rewrite · Regex Patterns · Preserve Host Header
Pause a request or response, edit method, headers, body, or status, then continue. The fastest way to test "what if the API returns 401?" without touching the backend.
Request Breakpoints · Response Breakpoints · Block · Throttle · Regex / Wildcard Match · Inject Failure States
Add, remove, or replace headers on any host without redeploying. Test CORS, auth, or cache changes in seconds with built-in presets.
Add / Remove / Replace · CORS Presets · Auth Stripping · Request Phase · Response Phase · URL Pattern Scope
Promote any request or response header into a first-class traffic-table column. Keep request and response sources separate, save the headers you care about, then scan request IDs, trace IDs, cache state, or custom metadata without opening each inspector.
Request Headers · Response Headers · Saved Columns · Trace IDs · Case-Insensitive Match · Live Table Update
Throttle to 3G, EDGE, LTE, WiFi, or a custom delay. Your laptop is on fiber; your users aren't — see the UX at 400 ms RTT before they do.
3G · EDGE · LTE · WiFi · Very Bad Network · Custom Latency
Rebuild any captured HTTP request — change method, URL, headers, query params, or body — and re-send without leaving Rockxy. No Postman, Insomnia, or curl copy-paste loop. Iterate on LLM prompts, fuzz auth boundaries, or reproduce a failing case for OpenAI, Anthropic, and Cohere endpoints in seconds.
Edit Headers · Edit Body · Edit Query · Edit Method · LLM Prompt Iteration · Postman Alternative · OAuth Flow Debug · Webhook Replay
Stack two captured transactions or pasted payloads side-by-side and spot every field that flipped — status, headers, JSON keys, or body bytes. Catch silent API regressions, non-deterministic LLM outputs, and prompt drift without piping anything into a third-party diff tool.
Diff Compare · Side-by-Side · JSON Diff · Header Diff · Body Diff · LLM Output Compare · Non-determinism · API Regression · Schema Drift
Render request and response bodies the way you want. Pin extra tabs to the inspector for JSON, GraphQL, JWT, image, or your own format — reusable across every captured request.
JSON · GraphQL · JWT Decoder · Image / Hex · Custom Format · Pinned per Inspector
Save sessions, import/export HAR for cross-tool handoff, copy any request as cURL or JSON. Redact authorization headers, cookies, and bearer tokens before sharing — hand a teammate a working bug repro without leaking secrets.
.rockxysession · HAR Import / Export · Copy as cURL · Copy as JSON · Raw HTTP · Secret Redaction · Token Sanitize · Privacy-Safe Share
Group work into local Projects — one Project for checkout, another for authentication, each with tabs for errors, devices, or environments. New requests are assigned to the active Project when they begin; switching back restores that Project's in-memory traffic and durable tab setup.
3 Local Projects · Project-Scoped Traffic · Durable Tab Filters · Per-Tab Inspector · Config Import / Export · No Captured Bodies in Catalog
JS hooks on requests and responses for the cases a static rule can't cover — redact PII, sign tokens, rewrite payloads. Errors surface inline instead of corrupting traffic.
Request Hooks · Response Hooks · Programmatic Filtering · PII Redaction · Inline Error Feedback
Rockxy ships protocol-aware AI, Web3 RPC, and x402 inspection inside the normal HTTP debugging workflow.
Rockxy detects recognized AI requests inside the normal capture workflow. Inspect selected model calls, streaming state, usage fields when present, warnings, retrieval hints, and tool-call summaries without pasting sensitive payloads into another service.
AI Requests · Model Inspector · Streaming State · Tool Calls · Retrieval Hints · Usage Signals
Rockxy turns blockchain-era network calls into readable debugging evidence. Inspect EVM and Solana-style HTTP JSON-RPC traffic with provider host, request ID, method, batch summary, error, chain, transaction, payload, and debug-intent details without turning Rockxy into a wallet or block explorer.
JSON-RPC · Solana RPC · Request ID · RPC Errors · Batch Summary · Network Evidence
Rockxy highlights payment-required and retry-oriented hints so payment-gated HTTP flows are understandable from the network layer while debugging evidence stays local and redaction-aware.
Payment Required · Retry Flow · Headers · Redaction · Local First
The following sections describe public direction rather than current behavior.
Rockxy can label and inspect AI and Web3 traffic today. Deeper rule matching by model, tool call, JSON-RPC method, chain, transaction hash, or batch subcall remains future work; current traffic modification tools still match URL, HTTP method, and headers.
Smart Filters · Request Badges · Protocol Column · Inspector Tabs · Future Rule Metadata
Share the facts needed to reproduce a bug without leaking secrets. Package selected traffic with protocol summaries, redaction previews, and source-backed context a teammate can audit.
Debug Bundles · Protocol Summary · Export Preview · Secret Redaction · Repro Context
Send a captured session to a teammate with one click. Annotate failing requests inline, see who's looking at what in real time, and pair-debug HTTPS traffic without screen-sharing. Targeted for a future release.
Shared Sessions · Team Workspaces · Inline Comments · Live Cursor · Cloud Sync · Pair Debug · SSO · Audit Log
Native macOS app shell — no Electron. SwiftUI + AppKit + SwiftNIO, with WebKit used only for HTML body preview.
These commands build the public AGPL Community source edition. That build is not the same artifact as the official signed DMG published on GitHub Releases.
git clone https://github.com/RockxyApp/Rockxy.git
cd Rockxy
open Rockxy.xcodeprojBuild and run in Xcode. The Welcome window guides you through root CA setup, helper installation, and proxy activation.
Requirements: macOS 14.0+, Xcode 16+, Swift 5.9
If you want to connect Rockxy to a local MCP client after installation, see the MCP Integration guide.
The main matrix covers general-purpose web-debugging proxies. Security-testing suites and browser/API-oriented interceptors with substantial workflow overlap are listed separately so unlike products are not presented as interchangeable. Packet analyzers and API-only clients are outside this comparison.
| Rockxy | Proxyman | Charles Proxy | mitmproxy | HTTP Toolkit | Fiddler Everywhere | |
|---|---|---|---|---|---|---|
| Product shape | Native macOS debugging proxy | Native macOS app; Electron-based Windows/Linux editions | Cross-platform desktop debugging proxy | Cross-platform CLI/TUI and web UI proxy toolkit | Cross-platform Electron desktop proxy and HTTP client | Cross-platform desktop debugging proxy |
| Source and build model | Public Community source under AGPL-3.0-or-later; buildable with Xcode. The official DMG also contains non-public downstream components | Closed source; no public application source identified in the official materials reviewed | Closed source; no public application source identified in the official materials reviewed | Public MIT-licensed source; buildable from source | Public AGPL desktop source; buildable from source; published binaries have additional licensing options | Closed source; distributed as object code under the Fiddler Everywhere EULA |
| Capture and setup | Local system proxy with guided setup for Mac apps, runtimes, iOS devices, and Simulator | Automatic setup for Mac apps, runtimes, and mobile devices | Local proxy with macOS, iOS, and cross-platform setup guides | Regular, local-process, WireGuard, reverse, transparent, and other capture modes | Targeted and manual proxy interception for browsers, runtimes, containers, and mobile devices | System, network, browser, terminal, explicit, and remote-device capture modes |
| Modify and mock | Breakpoints, Map Local/Remote, header rules, blocking, and latency rules | Breakpoints, Map Local/Remote, block lists, network conditions, and JavaScript rules | Breakpoints, Rewrite, Map Local/Remote, blocking, and throttling | Map Local/Remote, body/header modification, blocking, and server replay | Breakpoints plus rule-based rewrite, redirect, mock, and error injection; some automation is plan-limited | Rules, breakpoints, redirects, response modification, and mocking |
| Replay and compare | Compose/replay plus local side-by-side request, header, and body comparison | Compose, Repeat, and Diff | Repeat and edit requests | Client-side and server-side replay | Built-in HTTP client for composing and sending requests | API Composer, traffic replay, and traffic comparison documented as beta |
| WebSocket workflows | Text/binary frame inspection with bounded Protobuf heuristics | WS/WSS inspection; scripts can modify handshake URL/headers, not messages | WebSocket support is documented in the official version history | WebSocket interception and scripting; WebSocket replay is not supported | WebSocket inspection plus WebSocket-specific rules | WebSocket capture and inspection |
| Scripting and extensibility | Sandboxed JavaScriptCore hooks with a bounded API and execution timeout | JavaScript request/response scripting | Rewrite rules and a control Web Interface; no general JavaScript scripting feature documented | Python addons and command-line automation | Rule-based automation plus public source and proxy libraries | Rule-based automation; no first-party general scripting feature documented |
| Upstream routing | HTTP/HTTPS upstream proxy and PAC URL routing; Community policy disables proxy authentication and SOCKS5 and caps bypass rules at three | External HTTP/HTTPS/SOCKS and PAC routing with bypass rules | External HTTP/HTTPS/SOCKS proxies with authentication and bypass rules | HTTP/HTTPS upstream mode plus reverse and SOCKS listener modes | System, HTTP, HTTPS, and SOCKS upstream settings; plan limits may apply | Automatic chaining to system proxies plus reverse-proxy capture |
| AI and MCP | In-app AI Assistant and built-in local MCP with 10 read-only tools, token authentication, and redaction on by default | Built-in MCP for external AI clients, including traffic reads and app/rule controls | Not documented | Not documented | A bundled local MCP bridge is present in the current official source; no in-app assistant documented | Built-in MCP plus a Pro-tier Debugging Assistant whose current documentation requires captured traffic details to be pasted into chat |
These products overlap meaningfully with Rockxy but lead with security testing, browser rules, or API-client workflows rather than the same general-purpose native debugging-proxy focus.
| Product | Why it is adjacent | Source and build model | Relevant overlap | AI and MCP |
|---|---|---|---|---|
| Burp Suite | Web-security testing suite with an intercepting proxy | Closed-source application; its EULA states that users have no right to the application source. Extensions can use separate licenses | Proxy interception and match/replace, Repeater, WebSockets, upstream/SOCKS proxying, and a large extension ecosystem | Burp AI is available in Repeater; PortSwigger also maintains a public MCP Server extension for external AI clients |
| ZAP | Security scanner and intercepting proxy | Public Apache-2.0 source; buildable from source | Intercept/edit, manual resend, WebSocket breakpoints and scripts, multi-language scripting, add-ons, and automation | Official MCP Integration and optional LLM Support add-ons |
| Requestly HTTP Interceptor | Browser-extension and cross-platform desktop interceptor/mock tool | Public AGPL desktop-interceptor source; the separate Requestly API Client is proprietary according to its public community-repository notice | System-wide/browser capture, redirect, Map Local/Remote, header/body modification, JavaScript transforms, mocks, and delay/error simulation | A separate official MCP server manages rules and groups; no in-app traffic-analysis assistant documented |
Feature availability can vary by edition, plan, platform, or add-on. "Not documented" means that a capability was not found in the official first-party sources reviewed on 2026-08-22; it is not proof that the capability is absent. Product and feature statements above were checked against vendor documentation, vendor-maintained source repositories, or vendor license terms on that date and may change. Product names and trademarks belong to their respective owners; Rockxy is not affiliated with or endorsed by them. Corrections are welcome through the Rockxy issue tracker.
On the roadmap: deeper protocol-aware rules, safer redacted evidence bundles, stronger replay and comparison workflows, broader Developer Setup guidance, and continued HTTP/2 and HTTP/3 research.
Rockxy intercepts network traffic — security is foundational, not optional.
- XPC helper validates callers via certificate-chain comparison, not just bundle ID
- Plugins run in sandboxed JavaScriptCore with 5-second timeout, no filesystem/network access
- Input validation on all boundaries — body size caps, URI limits, regex DoS protection, path traversal prevention
- Credentials automatically redacted in captured logs
- Sensitive files stored with 0o600 permissions
Report vulnerabilities via SECURITY.md. See the full security architecture for details.
Rockxy's public roadmap is workflow-oriented and date-free. It focuses on reliability, native macOS UX, debugging workflows, protocol support, AI/Web3-era traffic visibility, documentation, and contributor onboarding.
- ROADMAP.md: high-level public engineering direction
- Rockxy Public Roadmap: operational visibility for roadmap-tracked issues
Full documentation available at the Rockxy Docs:
- Quickstart Guide — get up and running in minutes
- Developer Setup Hub — runtime snippets, device guides, validation probes, and support matrix
- AI Assistant — investigate selected traffic with local analysis or an explicitly reviewed configured model
- Filters and Search — use sidebar scopes, Focus Sets, Noise Control, toolbar filters, and search
- AI and Web3 Inspection — inspect recognized model API, JSON-RPC, and x402-style traffic
- MCP Integration — connect Rockxy to local MCP clients
- Architecture — proxy engine, actor model, data flow
- Security Model — trust boundaries, XPC validation, certificate management
- Design Decisions — why SwiftNIO, NSTableView, actors
- Building from Source — build, test, lint, and debug
- Code Style — SwiftLint, SwiftFormat, and conventions
- Changelog — unreleased work and tagged releases
Contributions welcome — code, tests, docs, bug reports, and UX feedback.
See CONTRIBUTING.md for setup instructions, code style, and the full PR checklist.
Good first issues are labeled good first issue. By opening a PR, you agree to the CLA.
Rockxy is independently maintained. Sponsorships help fund continued development, release infrastructure, documentation, and security work.
Rockxy is fiscally hosted by Open Source Collective. Contributions and project expenses are recorded on Rockxy's public Open Collective page, giving supporters a transparent view of how funds are received and used.
| Tier | Contribution | What it supports |
|---|---|---|
| Backer | From $5/month | Open-source maintenance, documentation, testing, and releases |
| Builder | From $25/month | Regression testing, performance improvements, and everyday debugging workflows |
| Sponsor | $100/month | Long-term maintenance of a privacy-focused tool that remains freely available to developers |
| Sustaining Sponsor | $500/month | Focused maintenance and product development, including release automation and protocol support |
Partnership inquiries — developer tool companies, security firms, and enterprise teams looking for custom integrations or white-label solutions: rockxyapp@gmail.com
- Open Collective — contribute to Rockxy through its transparent project budget
- GitHub Sponsors — support Rockxy's development
- GitHub Issues — bug reports and feature requests
- GitHub Discussions — questions and community chat
- Email — rockxyapp@gmail.com
- Security issues — see SECURITY.md for responsible disclosure
The source in this public repository is available under the GNU Affero General Public License v3.0 or later, except identified third-party material. Official signed DMG downloads that include or present Binary EULA v1.0 are governed by that Rockxy Binary EULA. See LICENSING.md for the complete artifact boundary and COPYRIGHT.md for ownership and attribution information.
Made by Stephen. Built with Swift, SwiftNIO, SwiftUI, and AppKit.