# Cloak Proxy

Gives your coding agent a handle on HTTPS requests caught by the Cloak Proxy debugger on macOS: inspect them, pause them, rewrite the response, replay a set.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed
- Author: subcloak
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/subcloak/cloak-proxy
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/mcp/cloak-proxy

## What it does

The server hooks into the Cloak Proxy app and hands captured traffic to the agent. You can pull apart a request, swap the response mid-flight, hold a call at a breakpoint or run a saved mock set again. Secrets get redacted before anything reaches the model, so tokens and cookies stay out of the context window.

Cloak Proxy itself is a free native macOS proxy. It decrypts HTTPS per host or per app, ships breakpoints, Map Local and Map Remote, scripting and a built-in API client, and has beta Linux builds. Nothing shows up until the proxy is running and capture is on, so install the app first: `brew install --cask subcloak/tap/cloak-proxy` or the `Cloak-Proxy.dmg` from the download page.

The README claims 148 tools for Claude, Cursor and Codex. Some pieces need macOS 14 Sonoma or later. HTTPS decryption also depends on a root certificate being trusted — skip that step and you only see hostnames, not bodies. CI runs without a GUI go through `cloakctl`.

## Install

### Claude Code (native platform)

**Install**
- The MCP registry has no launch command for it: see the repository README

## When to use it
- inspect a captured HTTPS request and read its body
- mock a server response without touching the code
- hold a request at a breakpoint and edit it before it continues
- replay a stored mock set to test error handling
- hunt IDOR bugs by replaying traffic as another user

## Example prompts
- Show the last requests captured for `api.example.com` and walk me through the payload.
- Mock this endpoint to return 500 and check how the app handles the failure.
- Pause the auth request, let me look at the headers, then release it.

## Similar
- [Front-End Checklist](https://affpapa.org/en/nevibecode/mcp/front-end-checklist.md) — MCP server · ★ 74569
- [Keploy](https://affpapa.org/en/nevibecode/mcp/keploy.md) — MCP server · ★ 18779
- [SeleniumBase MCP](https://affpapa.org/en/nevibecode/mcp/seleniumbase-mcp.md) — MCP server · ★ 13181
- [mobile-mcp](https://affpapa.org/en/nevibecode/mcp/mobile-mcp.md) — MCP server · ★ 10025
- [e2e](https://affpapa.org/en/nevibecode/mcp/e2e.md) — MCP server · ★ 11962
- [mockserver](https://affpapa.org/en/nevibecode/mcp/mockserver.md) — MCP server · ★ 4999

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md