A local HTTP/HTTPS proxy with a built-in WAF, MITM interception, AI agent controls, and zero telemetry. Native to macOS, notarized for distribution.
Block domains, IPs, and content patterns with O(1) rule matching. Ships with curated lists (Steven Black, NoCoin, URLhaus, TOR exits) totalling ~90K entries.
Per-installation root CA stored AES-encrypted, Keychain-bound. Forges leaf certs on demand via an embedded mitmproxy sidecar. Auto-excludes pinned apps.
Detects Claude Code, Cursor, Codex and every major model API. Tracks tokens, estimates cost, blocks loops and model budget overruns.
Strip trackers, inject DNT + GPC, rewrite User-Agent, filter tracking cookies. Per-host policy, configurable in seconds.
Aho-Corasick for content matching, connection pool with LRU keepalive, in-process L1 + SQLite L2 cache. Benchmarked at <1ms added latency.
Beaconing heuristic (periodic callback patterns), C2 framework fingerprints (Cobalt Strike, Sliver, Mythic), exfiltration pattern packs for PII and credentials.
Round-robin, least-connections, weighted, geo, latency-based routing across multiple upstream proxies. Health checks with circuit breaker.
SOCKS5 listener, PAC server with smart bypass, DNS-over-HTTPS, Prometheus metrics, webhooks, iCloud sync of your rule sets.
