HTTPS debugging proxy · MCP server

Your agent should read the request, not your description of it.

Charlotte captures the HTTPS your app actually sent, then hands it to your coding agent over MCP. Claude, OpenAI Codex, GitHub Copilot, Cursor and other MCP clients can search a whole session, open any request and response, replay it, and change the traffic — without you pasting a single header into a chat window.

Get it for Windows Get it for macOS Watch the 56-second demo

Charlotte 2.3 for macOS is out now. The update adds governance and an MCP gateway, regression tests from captured traffic, end-to-end encrypted live sharing and Git-friendly API diffs. Get it from the Mac App Store.

Loopback only · Role-scoped tokens · Write tools off by default · No cloud inference

A 401 debugged by an agent reading the real request. 56s, no sound.

MCP server built in Claude · Codex · Copilot · Cursor RBAC & OAuth 2.1 gRPC & Protobuf Editions OpenAPI contract checks Nothing leaves your machine

Stop pasting cURL output into a chat window

The request fails. You copy the cURL out of devtools, paste it into a chat window, and the model reasons about your description of the request — which is exactly the thing that is wrong, most of the time.

Reproduce the bug

Point your app, phone or emulator at Charlotte. It decrypts the HTTPS and keeps the whole session.

Ask in plain language

“The login call is coming back 401 — look at what Charlotte actually captured and tell me what's wrong.”

The agent reads the bytes

It calls search_flows for status:401, opens the flow, and finds the header you got wrong.

Read tools — always on

list_flows · get_flow — page through captures, open any request in full
search_flows — status:>=400, host:*.stripe.com, body:"token"
stats · audit_session — totals, hosts, and a security audit as Markdown
validate_openapi — which captured calls break your OpenAPI contract, and exactly where (macOS)

Write tools — off until you allow them

replay_flow — re-send a captured request, with or without changes
create_rewrite · create_map_local — change headers, bodies, or serve from disk
set_breakpoint — pause matching traffic so it can be edited in flight

Everything stays local. The MCP server binds to 127.0.0.1 and is never exposed to the network. Charlotte has no backend, no account and no telemetry — there is no server to send your traffic to.

Connect your agent Compare with Fiddler

One debugging workflow, native on two desktops

Charlotte is available for Windows and macOS, with native interfaces, the same request-centric workflow, and interchangeable session files.

macOS

Native for Apple teams

Inspect macOS traffic, review request bodies, and work through device and simulator sessions without leaving the app.

Charlotte on macOS showing live traffic capture — Mac capture workspace and live traffic timeline

gRPC and Protobuf decoded with real field names: import .proto files (proto2, proto3, Editions 2023–2026) or load them by reflection over TLS and mTLS
Check every captured call against your OpenAPI 3.0 or 3.1 contract
A Setup Guide for this Mac, the iOS Simulator, Android, and real devices
Local request replay, map rules, and breakpoint-driven edits

Get for macOS

Windows

Built for desktop validation

Use Charlotte to watch requests from Windows desktop apps, reproduce flaky network conditions, and verify releases before they ship.

Charlotte on Windows showing traffic capture and request inspection — Windows capture workspace and request inspection

Designed for QA labs, release validation, and API verification
gRPC status and trailers, with schemas loaded by reflection over TLS and mTLS
A charlotte command on your PATH for headless capture and CI checks

Get for Windows

Everything you need to debug the network

A focused desktop toolset for developers and QA teams — no Electron, no cloud round-trips.

Capture & decrypt

Terminate TLS as a proxy with a root CA Charlotte generates (or one you import). Read HTTP/1.1, HTTP/2 per-stream, and WebSocket frames.

Body viewers

Auto, JSON, Tree, HTML, XML, Protobuf, gRPC, Text, Hex and image views, with gzip, deflate, brotli and zstd decoding, so you always see the real payload.

gRPC & Protobuf

See gRPC calls with real field names, final status and trailers. On macOS, Charlotte compiles your .proto files itself — proto2, proto3 and Protobuf Editions 2023, 2024 and 2026 — or fetches the schema from the server by reflection over TLS or mutual TLS.

OpenAPI contract checks macOS

Attach an OpenAPI 3.0 or 3.1 description and every captured request and response is checked: parameters, authentication, bodies, status codes and headers. A Contract tab shows each violation and where it is; filter with openapi:fail.

Import, export & CI

Native sessions, HAR 1.2 and copy-as-cURL. Run headless, export the live capture, and check saved sessions in CI: fail on leaked secrets, deprecated calls, latency limits or contract violations, with text, JSON or JUnit reports.

Team workspaces

Publish rules, saved filters and collections to a shared folder or Git checkout and pull them on another machine. Local credentials and file paths are left out.

Device & Simulator

A step-by-step Setup Guide for your computer, the iOS Simulator, Android emulators and real phones — with certificate export, a QR code for physical devices, and a check that traffic really reaches Charlotte.

Tools Pro

Map Remote, Map Local, and Rewrite rules. Set breakpoints to pause and edit live requests and responses.

Throttling & chaos Pro

Add latency, cap bandwidth, and randomly drop connections to test how your app behaves on flaky networks.

On-device AI Pro

Explain a flow and flag anomalies or security issues with Apple's Foundation Models. Traffic never leaves your Mac.

MCP server Pro

Expose captured traffic to Claude, Codex, Copilot, Cursor and other MCP clients over a local, loopback-only endpoint, gated by an access token you hand out yourself. How it works →

Access control Pro

Give each agent its own token with a role — Viewer, Editor, or Admin — or let it sign in with OAuth 2.1 and PKCE. Add a policy to keep agents read-only or block PII replay, and a sandbox that blocks cloud-metadata addresses. Read more →

Screenshots

The Windows and macOS apps share a request-centric workflow and compatible session format. The macOS captures show version 2.3, available now on the Mac App Store.

macOS captures

Charlotte Assert compares a captured checkout journey against a new build and shows changed response values — Assert — regression-test captured traffic

Charlotte governance shows an AI agent's proposed traffic rule and asks for approval — Governance — review agent changes before they go live

Charlotte Relay shares a live, redacted capture with a teammate — Share Live — end-to-end encrypted Relay

Charlotte command-line output shows a semantic diff between API golden files — Git for HTTP — review semantic API diffs

Charlotte configures repeatable fault injection for selected API requests — Repeatable fault injection for resilient APIs

Windows captures

Charlotte AI agent access control on Windows — RBAC tokens, OAuth 2.1 and policy — Access control — RBAC, OAuth 2.1 & policy

Charlotte MCP server settings on Windows — MCP server — your AI agent reads the real traffic

Charlotte Tools on Windows — Map Remote rules — Map Remote, Rewrite & Breakpoints

Charlotte session audit on Windows — security and privacy findings — Session audit — security & privacy findings

Charlotte Device Setup on Windows — proxy and certificate trust — Certificate & proxy setup

How it works

HTTPS can't be read from raw packets — so Charlotte terminates TLS as a proxy.

1
Set up a root CA

Generate a Charlotte root CA (saved to your Keychain) or import your own as a password-protected .p12.
2
Point traffic at Charlotte

Follow the Setup Guide: route this computer through Charlotte, or connect the iOS Simulator, an Android emulator, or a real phone.
3
Inspect & act

Select any request to see headers and body. Rewrite, replay, breakpoint, check it against your OpenAPI contract, or hand the session to your AI agent.

Privacy & permissions

A tool that decrypts your traffic owes you a plain account of what it touches.

1
Nothing leaves your machine

There is no Charlotte server, no telemetry, no analytics and no account. Captures stay in memory unless you export them yourself, and the AI features run on-device with no cloud fallback. Full privacy policy →
2
Charlotte does not install certificates

On Windows it saves its root certificate and opens Windows' own certificate window; you run the import, choose the store, and answer Windows' security warning. The app has no code path that writes to a certificate store.
3
Agents get a token, not an open door

The MCP server is off by default, binds to loopback, and requires an access token you copy from Settings — so no other program on your PC can read your traffic just because the server is running. Passwords, tokens and cookies are hidden from agents by default, and write tools stay off until you enable them.
4
Two things change, and both come back

Outside its own folder Charlotte changes your per-user proxy setting and your trusted root certificates, and only after you ask it to. The proxy is restored every time you quit, and Settings ▸ Before you uninstall puts both back in one click before you remove the app.

Ready to inspect your traffic?

Charlotte is available on the Microsoft Store and Mac App Store, where Charlotte 2.3 for macOS is out now. Free for 14 days with every feature unlocked — no account, no card. Then one payment, owned forever.

Get it for Windows Get it for macOS See the MCP server

Windows terminal install: winget install --id 9PD5RZKFCM19 --source msstore

Built for software developers and QA personnel who need clear, repeatable network debugging.