See what your Mac says behind your back

• Mouchard CA api.example.com Decrypted

  pinned-app.example Pinned · tunneled

  HTTPS, decrypted

  Trust Mouchard’s certificate once and HTTPS traffic shows up in clear. Apps that pin their own certificate are left alone.

• System proxyOffOn

  One switch for the whole Mac

  Turn it on and everything your Mac sends goes through Mouchard. Turn it off and your settings are back as they were, even after a crash.

• JWT, expires in 12 min GraphQL: GetProfile CORS: * Cacheable for 12 hours Redirect → /login Slow: 2.4 s

  Clues at a glance

  Mouchard spots the details for you: when a token expires, which GraphQL query ran, a redirect, a slow or heavy response.

• ⌄{
    "id": 101,
    "title": "Hello from Mouchard",
  ⌄  "author": {
      "name": "Leanne", "admin": true
    },
  ›  "tags": [ 3 items ]
  }

  A readable inspector

  JSON, HTML and XML in color, with folding. Images are previewed, compressed bodies are decoded, and responses appear as they arrive.

• ↑{"subscribe": "prices"} ↓{"symbol": "AAPL", "price": 231.4} ↓{"symbol": "MSFT", "price": 417.9}

  WebSockets

  Follow messages both ways, encrypted or not, with readable JSON.

• ▯iPhoneWi-Fi ▯iPhone 17 Simulator✓ Trusted ▭This MacLocal

  iPhone and simulators

  Scan a QR code to set up your iPhone, or click once for a simulator. Each request tells you which device sent it.

• ⌘R Replayed

  Replay and edit

  Send a request again as is, or tweak it first.

• api.example.com/v1 localhost:3000/api

  GET/config.json Local file

  Redirect and rewrite

  Point production requests at staging or your local server, or answer them with a file you edit yourself.

• + Authorization: Bearer •••• − Cookie ads.example.com403 Blocked

  Modify headers, block hosts

  Add, change or remove a header. Block a host and its requests never reach the server.

1. Install

   Drag Mouchard to Applications. If macOS asks about “Mouchard CA”, click Always Allow.

2. Trust the certificate

   Click the seal in the toolbar and follow along. In Keychain Access, pick Trust → Always Trust.

3. Capture

   Turn on the system proxy and requests start showing up. When you quit Mouchard, your settings are put back.

$ curl -x http://127.0.0.1:9090 https://example.com   # or point a single tool at the proxy