HTTPS debugging proxy · MCP server

Your agent should read the request, not your description of it.

Charlotte captures the HTTPS your app actually sent, then hands it to your coding agent over MCP. Claude Code, Copilot and Cursor can search a whole session, open any request and response, replay it, and change the traffic — without you pasting a single header into a chat window.

Get it for Windows Watch the 56-second demo

Loopback only · Role-scoped tokens · Write tools off by default · No cloud inference

A 401 debugged by an agent reading the real request. 56s, no sound.

MCP server built in Claude Code & Copilot RBAC & OAuth 2.1 Replay & breakpoints Nothing leaves your machine

Stop pasting cURL output into a chat window

The request fails. You copy the cURL out of devtools, paste it into a chat window, and the model reasons about your description of the request — which is exactly the thing that is wrong, most of the time.

Reproduce the bug

Point your app, phone or emulator at Charlotte. It decrypts the HTTPS and keeps the whole session.

Ask in plain language

“The login call is coming back 401 — look at what Charlotte actually captured and tell me what's wrong.”

The agent reads the bytes

It calls search_flows for status:401, opens the flow, and finds the header you got wrong.

Read tools — always on

list_flows · get_flow — page through captures, open any request in full
search_flows — status:>=400, host:*.stripe.com, body:"token"
stats · audit_session — totals, hosts, and a security audit as Markdown

Write tools — off until you allow them

replay_flow — re-send a captured request, with or without changes
create_rewrite · create_map_local — change headers, bodies, or serve from disk
set_breakpoint — pause matching traffic so it can be edited in flight

Everything stays local. The MCP server binds to 127.0.0.1 and is never exposed to the network. Charlotte has no backend, no account and no telemetry — there is no server to send your traffic to.

Connect your agent Compare with Fiddler

One debugging workflow, heading for two desktops

Charlotte ships on Windows today. The macOS app is built on the same capture engine and is coming soon.

macOS Coming soon

Native for Apple teams

Inspect macOS traffic, review request bodies, and work through device and simulator sessions without leaving the app.

Charlotte on macOS showing live traffic capture — Mac capture workspace and live traffic timeline

Readable HTTP bodies with JSON, Protobuf, Text, and Hex views
Local request replay, map rules, and breakpoint-driven edits
Useful for API troubleshooting, auth flows, and regression checks

Windows

Built for desktop validation

Use Charlotte to watch requests from Windows desktop apps, reproduce flaky network conditions, and verify releases before they ship.

Charlotte on Windows showing traffic capture and request inspection — Windows capture workspace and request inspection

Designed for QA labs, release validation, and API verification
Highlight auth headers, payload changes, and endpoint mismatches quickly
Built for teams that need repeatable debugging on a Windows desktop

Everything you need to debug the network

A focused desktop toolset for developers and QA teams — no Electron, no cloud round-trips.

Capture & decrypt

Terminate TLS as a proxy with a root CA Charlotte generates (or one you import). Read HTTP/1.1, HTTP/2 per-stream, and WebSocket frames.

Body viewers

Auto, JSON, Protobuf, Text, and Hex views with gzip / deflate decoding, so you always see the real payload.

Device & Simulator

Guided setup for iOS devices, the iOS Simulator, and Android emulators — including one-click cert install and a QR code for physical devices.

Tools Pro

Map Remote, Map Local, and Rewrite rules. Set breakpoints to pause and edit live requests and responses.

Throttling & chaos Pro

Add latency, cap bandwidth, and randomly drop connections to test how your app behaves on flaky networks.

On-device AI Pro

Explain a flow and flag anomalies or security issues with Apple's Foundation Models. Traffic never leaves your Mac.

MCP server Pro

Expose captured traffic to AI agents (Claude, Copilot, …) over a local, loopback-only Model Context Protocol endpoint, gated by an access token you hand out yourself. How it works →

Access control Pro

Give each agent its own token with a role — Viewer, Editor, or Admin — or let it sign in with OAuth 2.1 and PKCE. Add a policy to keep agents read-only or block PII replay, and a sandbox that blocks cloud-metadata addresses. Read more →

Import / export

Native sessions, HAR 1.2, and copy-as-cURL — move your captures wherever you need them.

Screenshots

The Windows app is what ships today; the macOS build shares the same request-centric workflow and is coming soon.

macOS captures

Charlotte Tools — Map Remote rules — Map Remote, Rewrite & Breakpoints

Charlotte settings — root CA and proxy — Certificate & proxy setup

Charlotte device setup with QR code — Device & Simulator setup

Charlotte Pro upgrade screen — Charlotte Pro — one-time unlock

Windows captures

Charlotte AI agent access control on Windows — RBAC tokens, OAuth 2.1 and policy — Access control — RBAC, OAuth 2.1 & policy

Charlotte MCP server settings on Windows — MCP server — your AI agent reads the real traffic

Charlotte Tools on Windows — Map Remote rules — Map Remote, Rewrite & Breakpoints

Charlotte session audit on Windows — security and privacy findings — Session audit — security & privacy findings

Charlotte Device Setup on Windows — proxy and certificate trust — Certificate & proxy setup

How it works

HTTPS can't be read from raw packets — so Charlotte terminates TLS as a proxy.

1
Set up a root CA

Generate a Charlotte root CA (saved to your Keychain) or import your own as a password-protected .p12.
2
Point traffic at Charlotte

Set your Mac's system proxy, or use guided setup for iOS, the Simulator, and Android.
3
Inspect & act

Select any request to see headers and body. Rewrite, replay, breakpoint, or ask the on-device AI to explain it.

Privacy & permissions

A tool that decrypts your traffic owes you a plain account of what it touches.

1
Nothing leaves your machine

There is no Charlotte server, no telemetry, no analytics and no account. Captures stay in memory unless you export them yourself, and the AI features run on-device with no cloud fallback. Full privacy policy →
2
Charlotte does not install certificates

On Windows it saves its root certificate and opens Windows' own certificate window; you run the import, choose the store, and answer Windows' security warning. The app has no code path that writes to a certificate store.
3
Agents get a token, not an open door

The MCP server is off by default, binds to loopback, and requires an access token you copy from Settings — so no other program on your PC can read your traffic just because the server is running. Passwords, tokens and cookies are hidden from agents by default, and write tools stay off until you enable them.
4
Two things change, and both come back

Outside its own folder Charlotte changes your per-user proxy setting and your trusted root certificates, and only after you ask it to. The proxy is restored every time you quit, and Settings ▸ Before you uninstall puts both back in one click before you remove the app.

Ready to inspect your traffic?

Charlotte.Pro is on the Microsoft Store. Free for 14 days with every feature unlocked — no account, no card. Then one payment, owned forever.

Get it for Windows See the MCP server

Or from a terminal: winget install --id 9PD5RZKFCM19 --source msstore
macOS version coming soon.

Built for software developers and QA personnel who need clear, repeatable network debugging.