See the traffic behind the bug.

Capture traffic beyond the browser: desktop apps, CLIs, services, simulators, mobile devices, WebSocket sessions, GraphQL APIs, model calls, and RPC endpoints. Rockxy keeps the full request trail on your Mac.

Turn noisy sessions into signal. Combine method, host, status, header, body, process, and full-text filters to find the request that explains the failure.

Pick your runtime, client, browser, container, or device. Copy the right proxy setup and run Run Test instead of debugging the debugger.

A P-256 ECDSA root CA generated on first launch, sealed in your Keychain. Decrypt HTTPS on the first try; pinned hosts pass through automatically.

Pick which hosts get TLS decryption. Decrypted traffic shows real headers and JSON; everything else passes through encrypted. Wildcard rules let you scope by domain in one click.

Skip specific hosts so cert-pinned apps, internal services, or noisy telemetry never enter the capture. Wildcards keep the list short and your request log focused on what you actually care about.

Block any host to test how your app handles a missing API, tracker, or third-party dependency—no code change or redeploy.

Serve a saved file or a directory tree in place of a live response. Swap a JSON payload, replay a snapshot, or pin a flaky third-party API to a local copy while you debug.

Send a captured request to staging, localhost, or a teammate's machine without changing app code or /etc/hosts.

Pause a request or response, edit it, and continue. Test a 401, bad payload, or missing header without waiting for backend changes.

Add, remove, or replace headers without redeploying. Test CORS, auth, and cache behavior against live app traffic.

Override headers per host with full control over both phases. Inject auth tokens on outgoing requests, strip Set-Cookie on responses, or pin a custom User-Agent — saved as named rules you can toggle anytime.

Throttle to 3G, EDGE, LTE, WiFi, or a custom delay. Your laptop is on fiber; your users aren’t — see the UX at 400 ms RTT before they do.

Reopen the exact failed request, change only what matters, and send it again from the same capture. No manual reconstruction, no lost context.

Compare status, headers, JSON, body, and timing in place. See what changed between the failure and the fix without exporting payloads.

Render request and response bodies the way you want. Pin extra tabs to the inspector for JSON, GraphQL, JWT, image, or your own format — reusable across every captured request.

Package the evidence: saved sessions, HAR import/export, cURL, JSON, raw request bodies, and response bodies. Redact authorization headers, cookies, and bearer tokens before you hand off a working bug repro.

Keep staging, production, and device captures in separate tabs, each with its own filters and inspector state. Switch targets without losing your place.

JS hooks on requests and responses for the cases a static rule can’t cover — redact PII, sign tokens, rewrite payloads. Errors surface inline instead of corrupting traffic.