A local HTTP/HTTPS debugging proxy built for the age of coding agents.
When you're working with Cursor, GitHub Copilot, Claude Code, Windsurf and friends on code that talks to some API, they debug fastest when they can see the real traffic themselves, instead of relying on your description of it. EasyIntercept writes every captured request/response as a plain JSON file in a local sessions/ folder, so your agent can read or grep the exact request and response directly — no copy-pasting payloads into a chat window. It also captures, inspects, mocks, and diffs that traffic through a single lightweight app, with native understanding of OpenAI, Anthropic, Gemini, and GitHub Copilot requests baked in for when the API in question is an LLM provider.
Free, open source, and runs great on both Windows and macOS. If something isn't working the way you'd like, that's a PR waiting to happen.
- Agent-accessible session files — every request/response is saved to disk as its own plain JSON file in
sessions/(in addition to an in-memory index for a snappy UI), so a coding agent with filesystem access can read or grep the exact traffic directly — no manual copy-pasting of headers/bodies into a prompt. - Auto Responder as mock files — mock rules are plain JSON files too, matched on method/URL/body with optional latency injection, and hot-reload into the running proxy the moment they change on disk. Turn a captured response into a mock in one click yourself, or let your agent write/edit a rule file directly to stub out an API while it iterates on your code — no UI required either way.
- Live updates — the session list updates in real time over SignalR as traffic happens, so both you and your agent are always looking at current state.
- Built-in guide for agents — the running app serves
http://localhost:1337/llms.txt: a markdown cheat-sheet with the actual ports, the session and mock-rule folders of this machine, the on-disk JSON schemas, and the full API, so an agent can drive EasyIntercept without you explaining it. Drop one line into your project'sCLAUDE.md/AGENTS.md: "EasyIntercept runs locally; read http://localhost:1337/llms.txt before capturing or mocking HTTP traffic." (Folder paths are only included for requests from the machine itself.)
- Zero-config provider detection — automatically recognizes OpenAI, Anthropic, Google Gemini, and GitHub Copilot traffic just from the request URL.
- Streaming reconstruction — reassembles SSE/streamed responses (including fragmented tool-call arguments and Anthropic "thinking" blocks) so streamed and non-streamed traffic look identical in the UI.
- Built-in cost & token accounting — per-model pricing tables for every major provider, computed client-side from the intercepted token usage. No extra API calls, no external service.
- Chat transcript view — normalizes all four providers into one readable conversation: token pills (prompt/cached/thinking/response/cost), collapsible tool-call and tool-result blocks, and a schema panel for declared tools. Falls back to the raw payload if anything fails to parse.
- Session list superpowers for LLM traffic — an "LLM only" filter with dedicated Tools/Results/Cost columns, an inline chat preview right in the list, and automatic color-grouping of requests that belong to the same multi-turn conversation.
- Timeline mode — a waterfall-style view of request start time and duration, live-updating for in-flight requests. Great for seeing how a burst of requests actually overlaps or sequences.
- Compare view — select any two sessions and get a true side-by-side diff (headers and body, both directions) with JSON/XML pretty-printing.
- Protocol-aware detail viewers — GraphQL and Elasticsearch traffic also get their own smart, structured views (operation/query parsing, hit counts and timings), not just raw JSON.
- Copy, mark, and organize — copy a request's URL or its on-disk file path, tag sessions with colored marks, filter by request kind (document/asset/API/backend), and multi-select with keyboard navigation for bulk delete.
- Right-click actions — compare, reveal the session file in Explorer or Finder (on Linux: open its folder), or delete, all from the session list's context menu.
- First-class on Windows and macOS — not just a Windows-first port: CA install scripts, the system-proxy toggle, and the dev build/run scripts (
restart.ps1/restart.sh) all have a native counterpart on each OS. - HTTPS interception via a locally-generated root CA and on-the-fly per-host certificates — plus a QR-code mobile install page (
/install) so phones can install the cert by scanning a code, no cables or file transfers needed. - One-click system proxy toggle that actually flips the OS-level proxy setting (Windows registry / macOS
networksetup), not just an in-app flag. - Session replay — right-click any session to resend it; replays round-trip back through EasyIntercept itself, so they're just as interceptable and mockable as the original traffic.
Download EasyIntercept-Setup-<version>.exe from the Releases page and run it. No .NET runtime or Node.js needed. The installer:
- asks which port the web UI should use (default
1337; change it if e.g. Strapi already uses that port — the proxy itself is always9999), - can register EasyIntercept to start automatically at Windows login (it runs quietly with a tray icon: right-click for Open, System proxy on/off, Launch proxied browser, Open sessions folder, Copy link for coding agents, Exit),
- can install the EasyIntercept root CA into the Windows trust store and add a Windows Firewall rule.
Launching EasyIntercept from the Start Menu opens the UI in your browser; if it is already running, only the browser opens. If the configured UI port is taken at startup, a small dialog lets you pick another one.
Data (captured sessions, mock rules, browser profiles, the CA) lives in %LOCALAPPDATA%\EasyIntercept and is kept when you uninstall. %LOCALAPPDATA%\EasyIntercept\appsettings.json can hold user overrides such as UiPort or DataRoot; both also work as environment variables or --UiPort=… / --DataRoot=… command-line arguments.
To build the installer yourself, install Inno Setup 6 (winget install JRSoftware.InnoSetup) and run .\build-installer.ps1 -Version 0.1.0; the setup exe lands in dist/.
Releasing is driven by the version number: bump <Version> in EasyIntercept/EasyIntercept.csproj in your PR and merge it. GitHub Actions then tags v<version>, builds the Windows installer and the macOS disk image and publishes the release with generated notes. Merges that don't change the version don't release anything. Pushing a v* tag by hand still works, and a manual workflow run builds both as downloadable artifacts without publishing.
Download EasyIntercept-<version>-arm64.dmg (Apple Silicon) from the Releases page, open it and drag EasyIntercept to Applications. No .NET runtime or Node.js needed.
The build is not yet signed with an Apple Developer ID, so the first launch needs one extra step: macOS reports that the app "cannot be verified". Close that message, open System Settings → Privacy & Security, scroll down and click Open Anyway next to EasyIntercept (on older macOS versions, right-click the app → Open does the same). Alternatively, in a terminal:
xattr -dr com.apple.quarantine /Applications/EasyIntercept.appEasyIntercept then runs quietly with a ⚡ icon in the menu bar (top right, next to Wi-Fi and the clock), without a window or Dock icon, and opens the UI in your browser. The first launch asks whether it should install the root CA (macOS prompts for your password; the CA is trusted for your user only) and whether it should open at login; both can be changed later from the menu. The icon's menu offers Open EasyIntercept, System proxy on/off, Launch proxied browser, Open sessions folder, Copy link for coding agents, Install CA certificate, Open at login and Quit.
Launching the app while it is already running only opens the browser. If the configured UI port is taken at startup, a dialog lets you pick another one. With the macOS firewall enabled, macOS asks once whether EasyIntercept may accept incoming connections (needed for the phone setup); allow it.
Data lives in ~/Library/Application Support/EasyIntercept (same layout and appsettings.json overrides as on Windows) and the server log in ~/Library/Logs/EasyIntercept/server.log. To uninstall, turn off Open at login, quit, and drag the app to the Trash; the data folder, the trusted CA (remove it in Keychain Access or with security remove-trusted-cert) and the system-proxy setting are yours to clean up.
To build the disk image yourself you need the .NET 10 SDK, Node.js and the Xcode Command Line Tools (xcode-select --install); run ./build-macos.sh --version 0.1.0 and find the .dmg in dist/. Setting MACOS_SIGN_IDENTITY (plus APPLE_ID, APPLE_TEAM_ID and APPLE_APP_PASSWORD for notarization) produces a properly signed image; the release workflow does the same when the matching repository secrets exist.
Prerequisites: .NET 10 SDK, Node.js (for building the frontend).
git clone https://github.com/gluip/easy-intercept.git
cd easy-intercept
# Build the frontend
cd frontend
npm install
npx vite build --emptyOutDir
# Run the backend (serves the UI, REST API, and proxy)
cd ../EasyIntercept
dotnet run- Web UI: http://localhost:1337 (configurable via
UiPort) - Proxy listens on port
9999
On Windows/macOS, restart.ps1 / restart.sh do the same build-and-run in one step and keep the data folders (sessions/, auto-responder/, certs/) inside EasyIntercept/ by setting DataRoot. A plain dotnet run without DataRoot uses %LOCALAPPDATA%\EasyIntercept (Windows), ~/Library/Application Support/EasyIntercept (macOS) or ~/.local/share/EasyIntercept (Linux) instead.
A build run from source doesn't open a browser on start: it serves EasyIntercept/wwwroot as of the last frontend build, which dotnet build doesn't redo, so that page is easily stale. While working on the frontend, run npm run dev in frontend/ (it proxies /api and /proxy-hub to the backend) and use the URL it prints. The installed app still opens the UI when it starts.
- Windows: the installer can do this for you; otherwise run
EasyIntercept.exe --install-ca(orinstall-ca.ps1). - macOS: the app offers this on first launch and under Install CA certificate… in its menu (trusts the CA for your user, no admin rights needed); the same from a terminal is
./EasyIntercept --install-carun insideEasyIntercept.app/Contents/Resources/server/. For a build run from source,install-ca.shinstalls it system-wide withsudo, or download the cert directly fromhttp://localhost:1337/ca. - Mobile: open
http://localhost:1337/installon your phone (or scan the QR code it shows) for step-by-step iOS install instructions.
Both install-ca.sh and install-ca.ps1 fetch the certificate from the running instance (http://localhost:<UI_PORT>/ca) and only fall back to $DataRoot, the default data root and the repo's dev folder if nothing is listening. That matters because the CA lives inside the data root: switching between restart.sh/restart.ps1 (data root = the repo) and a normal run (default data root) means two different CAs, and the browser will show certificate errors for the one that isn't trusted. The scripts warn when a different EasyIntercept CA is already trusted; pass an explicit path (./install-ca.sh path/to/easyntercept-ca.crt) to install a specific one.
Then point your device or app at <host>:9999 as its HTTP/HTTPS proxy.
Being upfront about where EasyIntercept isn't there yet — these are also good first contributions:
- Auto Responder rules match on method + exact URL + an optional body predicate — no host-wildcard, path-prefix, or header matching yet, and no "modify a real passthrough response" transform.
- No certificate-pinning bypass (apps that pin certificates won't be interceptable without extra tooling).
- Packaged builds exist for Windows (installer) and macOS (disk image, Apple Silicon only and not yet signed with a Developer ID). Linux can run the proxy and UI from source, and revealing a session file opens its folder there, but it has no system-proxy toggle or CA install script yet.
- Session history is capped at 1000 entries (oldest are evicted), not unlimited retention.
| EasyIntercept | Fiddler | |
|---|---|---|
| LLM-aware traffic parsing (OpenAI/Anthropic/Gemini/Copilot) | ✅ built-in | ❌ |
| Token usage & cost calculator | ✅ built-in | ❌ |
| Streaming SSE reconstruction | ✅ built-in | ❌ |
| Side-by-side session diff/compare | ✅ built-in | ❌ |
| Mock rules as version-controllable JSON files with hot reload | ✅ | partial |
| Mobile CA install via QR code | ✅ | ❌ |
| License | Free & open source (MIT) | Free tier + paid tiers |
PRs welcome — whether it's closing one of the gaps above or adding support for another API provider. This project is MIT-licensed specifically so you can take it, change it, and make it better.
MIT — see LICENSE.