elcapture documentation
elcapture is a native HTTPS debugging proxy for Mac. It sits between your apps and the network, decrypts the traffic, and lets you read it, filter it, pause it, change it, replay it, or answer it yourself. These pages cover setup and every feature, with the exact names, fields and commands.
Start here
- Getting started — install, trust the certificate, turn on the system proxy, read your first request.
- Capture a phone or simulator — an iPhone on your Wi-Fi, an Android device over adb, or the iOS Simulator.
Capturing
- The traffic list — columns, type and status chips, colors, search, split view and the explorer.
- Filtering — the full query language: every field, operator and
is:value. - Inspecting a request — the Summary, Headers, Body and Raw panels, timing, TLS and connection details.
Changing traffic
- Rules — all twelve rule types and the fields of each.
- Scripting — JavaScript, Python or Rhai on any request, response or WebSocket message.
Features
- AI model calls — model, token counts and estimated cost for OpenAI, Anthropic and Gemini.
- API client — compose, send and repeat requests, with browser impersonation.
- Pentesting — Intruder, passive scanner, sequencer and comparer.
- Tools — encode, decode, hash, JWT and crypto helpers.
- Network settings — throttling, HTTPS decryption, DNS and upstream proxies.
Automate
- Command line —
elcapture-clifor the terminal and scripts. - HTTP API — the local REST API the CLI speaks to.
- MCP for AI agents — let Claude Code or Cursor read the traffic and change rules.