proxyman-traffic-debugging — Claude Code skill

What proxyman-traffic-debugging does

The skill treats Proxyman MCP as a local control plane for the app you already have open. Your MCP client starts Proxyman's bundled mcp-server over stdio; that bridge performs a local handshake and passes calls to an authenticated server inside the running app. You never hardcode the HTTP port or token, and each bridge stays alive only while its stdin is open.

Every session follows the same opening: discover tools and resources, call get_version, then get_proxy_status for recording state, proxy port and SSL Proxying. From there the agent narrows candidates with get_flows or filter_flows, reads details through get_flow_detail, and returns a verdict — passed, suspicious, failed or inconclusive — backed by flow IDs. Before any mutation it states what the change touches: capture, certificate trust, traffic or disk. Then it verifies with a read call.

Flow lists are snapshots. A flow ID can vanish after a clear, an import, a source switch or a restart. get_flows and filter_flows cap out at 500 results and body previews may be cut short, so full archival data needs an export to a destination you approve. MCP redaction covers common secret headers, cookies and JWTs, yet it does not sanitize the original HAR written by export_flows — treat those files as sensitive. System proxy, Terminal injection and Electron .app injection are mostly macOS operations; on Windows and Linux rely on live tool discovery.