Neko Proxy

See every request.
Change any of them.

A fast, free HTTP and HTTPS debugging proxy. Inspect traffic from your browser, terminal or phone, mock and pause requests mid-flight, and let your AI assistant read along.

Download Take the tour

Free and open source · macOS 13+ and Linux

The Neko Inspector showing 87 captured requests, with a JSON product response open in a tree view

Real traffic, captured by Neko on a Mac, with one mock, one throttle and one breakpoint switched on.

Why Neko exists

Debugging the network
shouldn’t feel like a chore.

Every app talks to a server, and when something breaks, the answer is almost always in the traffic. The tools we reached for were slow, closed and paid, phones were a scavenger hunt, and our AI assistants were blind to the wire. So we built the proxy we wanted: fast enough to forget about, simple enough to set up in a minute, open to everyone, and ready for AI from day one.

Cost

The proxy everyone uses is a paid, closed-source Java app.

Free and open source under MIT or Apache-2.0. Read it, fork it, ship it inside your team.

Speed

Big sessions make the window stutter, and it takes a while just to start.

A Rust core that is ready in 18 ms, and a native app that draws its first frame in about 200 ms.

Phones

Getting a phone to trust the certificate is a scavenger hunt through settings.

One page at neko.local walks each platform through it. The in-app SDK skips it for your own app.

Mocks

Mocks and breakpoints feel bolted on, buried in dialogs.

Mock, map, rewrite, throttle and break are first-class rules, one click from any request.

Your assistant can’t see the traffic you’re staring at.

A built-in MCP server lets Claude search flows and propose rules, with secrets redacted and your approval required.

The agenda

Four promises,
kept in the code.

The goals every change is measured against. They’re written into the project’s design notes, and the benchmarks keep them honest.

Fast

Startup and scrolling feel instant, even at 100,000 requests. The proxy adds microseconds, not milliseconds.

Simple

Zero-config capture. A phone is one Gradle line or one web page away, not a tutorial.

Open

MIT or Apache-2.0. Your traffic, your certificate and your rules stay on your machine.

AI-ready

An MCP server lives in the core, so a local Claude session can read traffic and propose fixes.

House rules

The constraints new work must not break.

The data path never waits.: Requests are never held up by the UI or the disk. Saving and publishing happen off to the side.
The UI holds no logic.: Parsing, decoding, search and redaction live in the Rust core. Every app is a thin, swappable shell.
Your key never leaves.: Each install makes its own certificate authority. The private key stays in your keychain.
Captured bodies are data.: Traffic is untrusted input. It is redacted before AI clients see it and never treated as instructions.
Rules are files.: Mocks and breakpoints are plain JSON you can diff, review and commit next to your code.
Loopback by default.: The proxy listens on your machine only. Phones join through pairing, with a token on every connection.

A quick tour

Everything a proxy should do.
None of the hairballs.

Real screenshots of the Neko app, recorded while it captured live traffic. Drag, swipe or pick a screen.

Inspector with a dummyjson product search response shown as a JSON tree

Every request, the moment it happens.

Hosts on the left, flows in the middle, the full request and response below. Bodies are decoded for you: gzip, brotli and zstd unpacked, JSON folded into a tree, images previewed.

Search 100,000 flows in milliseconds
Errors, Slow and Pinned filters
Copy as cURL, replay, mock or break from any row

Under the hood

The life of a request,
in eight steps.

The data path never waits on the UI or the disk. Your app gets its response first, and Neko writes things down afterwards. Tap a step to follow a request through.

Accept
Intercept TLS
Parse
Request rules
Forward
Response rules
Persist
Publish

Step 1 of 8

Accept

A connection arrives on 127.0.0.1:8899: plain HTTP, CONNECT or SOCKS5.

How the pieces fit

Clients

Desktop appRust and egui on Linux, AppKit on macOS In-app SDKAndroid, iOS in progress AI clientsMCP over loopback HTTP CLInekod flows, export, ca

WebSocket + protobuf · token on every connection

nekod, the Rust core

neko-netlisteners, HTTP/1.1, HTTP/2, WebSocketneko-tlsCA, leaf cache, pinning detectionneko-flowflow model and pipelineneko-rulesmock, map, rewrite, throttle, breakneko-storeSQLite WAL, zstd blobs, FTSneko-decodegzip, br, zstd, JSON, imagesneko-apiWebSocket + protobufneko-mcpMCP server and redactionneko-cliheadless runs, HAR export

HTTP/1.1 · HTTP/2 · WebSocket

Your apps, browsers and phones ⇄ the internet

Measured, not promised

Fast is a feature.
Here are the receipts.

Every goal was set before the first line of code and benchmarked from the first milestone. Release builds on a 12-core Linux desktop.

0ms

Core cold start

Goal: under 50 ms

0.000ms

Proxy overhead per request

p50. Goal: under 2 ms

0req/s

Sustained throughput

12× the goal of 5,000

0ms

Search across 100k flows

Slowest query. Goal: under 100 ms

0ms

App first frame

Goal: under 1 s

0.0MB

Core memory at idle

Goal: under 40 MB

Overhead and throughput are plain HTTP with the origin on the same machine, so treat them as lower bounds. Method and caveats: docs/bench.md.

AI-ready

Your assistant can
finally see the wire.

Neko ships an MCP server inside the core. Point Claude Code, or any MCP client, at it and it can search your captured traffic, explain a failing call, diff two requests or set up a mock, while you stay in charge.

claude — ~/shop-app

› Checkout fails on the Pixel. What’s going on?

⏺ proxy · search_flows status:5xx host:dummyjson.com

⎿ 1 flow · POST /carts/add → 503 in 301 ms

⏺ proxy · get_flow 12

⎿ matched rule “Checkout is down” (mock) · server never contacted
authorization: [redacted]

The 503 isn’t from your backend: a local mock rule named “Checkout is down” is answering every POST /carts/add. Want me to replay the request against the real server to compare?

› Yes, replay it.

⏺ proxy · replay_request 12

⎿ waiting for approval in Neko…

AI client

Replay POST dummyjson.com/carts/add

› Exact request

✓ AllowDeny

An example session. The tool names and the approval card are real.

Reading is free.

list_flowssearch_flowsget_flowdiff_flowsexport_har

Changes wait for your Allow.

create_mockadd_breakpointreplay_requeststart_capturestop_capture

Secrets never leave.

Authorization, cookies, API keys and token-shaped values are redacted in the core, and captured bodies are marked as untrusted data, so a response can’t steer your assistant.

Loopback and a token.

The server listens on 127.0.0.1:8898 and rejects anyone without the bearer token. One command prints the setup line:

terminal

nekod mcp
# claude mcp add --transport http proxy http://127.0.0.1:8898/mcp \
#   --header "Authorization: Bearer …"

Phones without the pain

Two ways in.
Neither is a scavenger hunt.

Proxying a phone used to mean Wi-Fi settings, a certificate download, a trust toggle three menus deep, and an app that ignores it anyway. Neko gives you a shortcut for your own app and a guide for everything else.

Android · beta iOS · in progress

Your own app.
The in-app SDK.

Add one Gradle plugin to a debug build. The app finds Neko on its own: emulators and USB phones connect automatically, Wi-Fi phones confirm a six-digit code. No proxy settings, no certificate, and nothing ships in release builds.

Kotlin DSL

// settings.gradle.kts: add the Neko repository
pluginManagement {
    repositories { maven("https://bharath914.github.io/neko-proxy-sdk-maven/"); google(); mavenCentral(); gradlePluginPortal() }
}
dependencyResolutionManagement {
    repositories { maven("https://bharath914.github.io/neko-proxy-sdk-maven/"); google(); mavenCentral() }
}

// app/build.gradle.kts: one plugin, debug builds only
plugins {
    id("com.android.application")
    id("dev.nekoproxy.inspector") version "0.1.0"
}

SDK quickstart

iPhone Android macOS Windows Linux

Everything else.
neko.local

Point any device at the proxy and open http://neko.local. Neko serves its own certificate page: the right steps for that platform, PEM, DER and an Apple profile, and a live check that turns green once the device trusts it.

Every install creates its own certificate, and its private key never leaves your computer. That’s why there’s nothing to download from this website.

Certificate guide for every platform

Roadmap

Built in the open,
one milestone at a time.

Capture core first, then the app, then rules and AI, then phones. Here’s where things stand.

Shipped

Rust capture coreHTTP/1.1, HTTP/2, WebSocket, SOCKS5, TLS interception, pinning detection
Linux desktop app.deb, .rpm, AppImage and a no-root installer, x86_64 and aarch64
Rules and breakpointsMock, map remote, map local, rewrite, throttle, replay
MCP serverRead tools, approved writes, redaction
Headless CLIRun, list flows, HAR export, CA tools
Android SDKGradle plugin, auto-pairing, runtime CA trust

In progress

macOS appNative AppKit: Inspector, Rules, Breakpoints, Devices, Settings and a command palette are built
iOS SDKSwift package for URLSession, partly verified
Device testingEnd-to-end runs of the SDKs on real phones and emulators

Any phone over Wi-FiLAN proxy mode with QR pairing, no SDK needed
Windows appSame core, native shell
HTTP/3QUIC capture
ScriptingJS or Lua hooks on requests and responses
MCP for SDK dataLet AI clients see in-app traffic and routes

Get Neko.

Free, open source, and yours to keep.

macOS

macOS 13 or later · Apple silicon and Intel

See releases

Or build it from source below. Takes about a minute.

Linux

glibc 2.35+ · Ubuntu 22.04, Debian 12, Fedora 36, RHEL 9 and newer

See releases

.deb, .rpm, AppImage and a tarball, for x86_64 and aarch64.

Windows

On the roadmap

The core already runs headless anywhere Rust does. A native Windows app comes after macOS.

Or build it yourself.

Needs only Rust, plus Swift for the Mac app. The app starts the core for you and stops it when you quit.

terminal

git clone https://github.com/bharath914/neko-proxy.git
cd neko-proxy
cargo run --release -p neko-desktop
# needs only Rust from rustup.rs

All releases · Source code · MIT or Apache-2.0

See every request.Change any of them.

Debugging the networkshouldn’t feel like a chore.

Four promises,kept in the code.

Fast

Simple

Open

AI-ready

House rules

Everything a proxy should do.None of the hairballs.

Every request, the moment it happens.

The life of a request,in eight steps.

Accept

How the pieces fit

Fast is a feature.Here are the receipts.

Core cold start

Proxy overhead per request

Sustained throughput

Search across 100k flows

App first frame

Core memory at idle

Your assistant canfinally see the wire.

Reading is free.

Changes wait for your Allow.

Secrets never leave.

Loopback and a token.

Two ways in.Neither is a scavenger hunt.

Your own app.The in-app SDK.

Everything else.neko.local

Built in the open,one milestone at a time.

Shipped

In progress

Next

Get Neko.

macOS

Linux

Windows

Or build it yourself.

See every request.
Change any of them.

Debugging the network
shouldn’t feel like a chore.

Four promises,
kept in the code.

Everything a proxy should do.
None of the hairballs.

The life of a request,
in eight steps.

Fast is a feature.
Here are the receipts.

Your assistant can
finally see the wire.

Two ways in.
Neither is a scavenger hunt.

Your own app.
The in-app SDK.

Everything else.
neko.local

Built in the open,
one milestone at a time.