Proxelar is a single-binary MITM (Man-in-the-Middle) proxy designed to capture, inspect, intercept, replay, and rewrite HTTP/HTTPS and WebSocket traffic. It provides developers with a versatile toolset for debugging, testing, and automating network interactions.
Key Features:
Multiple Interfaces: Access Proxelar through a terminal user interface (TUI), plain terminal output, web GUI, or headless REST API.
Lua Scripting: Modify traffic using Lua scripts to rewrite requests/responses, block or mock endpoints, and automate complex transformations.
Session Persistence: Save and reload captures for further analysis or replay, with support for HAR, curl, and raw HTTP exports.
HTTPS MITM: Generate and manage certificates for secure interception of encrypted traffic, with a built-in certificate installation page.
WebSocket Support: Inspect and modify WebSocket connections, viewing frames by direction, opcode, and payload.
Audience & Benefit:
Ideal for developers working on API debugging, browser or mobile app testing, WebSocket client development, and network automation. Proxelar enables precise control over network interactions, simplifying tasks like header injection, service mocking, and traffic analysis without requiring a full security suite.
Installed via winget, Proxelar offers a lightweight yet powerful solution for developers seeking to understand and modify their application’s network behavior.
README
Proxelar
A scriptable local traffic workbench for HTTP, HTTPS, and WebSocket debugging.
Capture, inspect, intercept, replay, and rewrite traffic from your terminal or browser.
What is Proxelar?
Proxelar is a single-binary MITM proxy for developers who need to see and change what an app is doing on the wire without running a full security suite.
Your app ──► Proxelar :8080 ──► Upstream service
│
Inspect · Intercept · Rewrite · Mock
It is useful for debugging APIs, inspecting browser or mobile traffic, testing WebSocket clients, injecting headers, mocking local services, replaying captured requests, and automating request/response transforms with Lua.
Proxelar is intentionally developer-oriented: terminal-first, scriptable, Rust-native, and usable as a CLI tool or as the proxyapi library.
Why use it?
One local binary — install with Homebrew, winget, Cargo, Docker/Podman, or GitHub releases.
Four interfaces — TUI, plain terminal output, browser GUI, or a headless REST API.
Lua scripting — on_request and on_response hooks can rewrite, block, short-circuit, or mock traffic.
function on_request(request)
if request.method == "GET" and string.find(request.url, "/api/user/me") then
return {
status = 200,
headers = { ["Content-Type"] = "application/json" },
body = '{"id":1,"name":"Local Test User"}',
}
end
end
Then call http://127.0.0.1:8080/api/user/me to receive the mocked response.
More scripts are in examples/scripts/, including auth injection, CORS headers, HTML rewriting, cookie stripping, redirects, traffic logging, and JSON body edits.
Portable addons use a versioned proxelar-addon.json manifest with semantic
versioning, declared hooks/native-code requirements, and SHA-256 coverage for
every package file. Proxelar rejects traversal, symlinks, undeclared files, and
tampered content before installation or execution:
See examples/addons/header-tagger/ for a
minimal distributable package. Existing manifest-free --script directories
remain supported for local development.
Interfaces
proxelar # interactive TUI (default)
proxelar -i terminal # plain terminal output
proxelar -i gui # web GUI at http://localhost:8081
proxelar -i api # headless REST API at http://localhost:8081
Common options:
proxelar -m reverse --target http://localhost:3000 # reverse proxy
proxelar -b 0.0.0.0 -p 9090 # custom bind/port
proxelar --script examples/scripts/block_domain.lua # with a Lua script
proxelar --body-capture-limit 1048576 # cap captured/editable body bytes
proxelar --upstream-trust default+ca:/path/ca.pem # trust an extra upstream CA
proxelar --save-session debug.proxelar.json # save on Ctrl+C
proxelar -i gui --launch-browser # isolated Chromium proxy profile
proxelar -m wireguard -b 0.0.0.0 -p 51820 \
--wireguard-endpoint 192.168.1.10:51820 # mobile/IoT capture
Declarative routing, mocks, redirects, and rewrites
—
--api-token
Fixed bearer token for the GUI/headless API; random when omitted
random
--launch-browser
Launch an isolated Chromium-family profile using the proxy
off
--wireguard-endpoint
Public/LAN HOST:PORT written to the generated client config
derived from bind route
--upstream-trust insecure disables upstream certificate and hostname verification. Use it only for controlled debugging.
How it compares
Tool
Best fit
Proxelar tradeoff
mitmproxy
Mature general-purpose MITM proxy with a large addon ecosystem, local capture modes, rich flow formats, and years of protocol hardening.
Proxelar is smaller and Rust-native, with integrity-checked Lua addon packages and TUI/web interfaces, but it does not yet match mitmproxy's protocol depth or community inventory.
proxyfor
Lightweight Rust proxy with TUI/WebUI and export-oriented workflows.
Proxelar adds interactive interception, replay, portable/redacted exports, Lua transforms, rules, and an embeddable core.
Burp Suite / Caido
Professional web security testing, scanning, collaboration, and deep manual testing workflows.
Proxelar is not a security suite. It is better suited to local debugging, scripting, and development workflows.
Charles / Proxyman / HTTP Toolkit
Polished desktop app experience for inspecting app traffic.
Proxelar is terminal-first and scriptable, with less desktop polish but a simpler open-source CLI workflow.
Proxelar is usable today, but it intentionally has a narrower scope than a full security suite:
HTTP/2 clients are accepted, but HTTP/2 MITM streams are normalized and forwarded upstream as HTTP/1.1. HTTP/3/QUIC interception is not supported.
Generic TCP streams are captured as directional chunks, and fixed-target or WireGuard UDP traffic records request/response datagrams. Protobuf has a lossless wire-field JSON editor and MessagePack has a JSON editor; descriptor-backed field names and raw-TCP schemas are not yet available.
WireGuard mode currently generates one client identity per CA directory. Proxelar does not modify system proxy settings; --launch-browser uses a reversible, isolated browser profile instead.
HTTPS interception requires trusting Proxelar's local CA. Certificate-pinned apps and many Android apps will not trust user-installed CAs.
Remote web GUI use is not a hardened multi-user deployment mode; keep it local or tunnel it carefully.
