Native macOS proxy debugger

The traffic inspector that respects your Mac.

Inspect, decrypt and edit HTTP/HTTPS, WebSocket and gRPC traffic from your Mac, Simulator or phone. Ask Claude Code or Cursor about it over MCP. Nothing leaves your Mac.

Download Free See Pricing

Free with 30-minute sessions · PRO $69 once, 3 Macs, no subscription

Notarized by Apple Signed with Developer ID Apple Silicon & Intel macOS 12 or later

Checked by Apple for malicious software and signed by us, so it opens without security warnings.

MinPin main window showing captured requests and the split Request/Response detail

What sets MinPin apart

Built for the way you debug today.

An AI assistant that can read your traffic, one window for every paused request, and a timeline that shows where the time went.

MCP · PRO

Ask your AI assistant about your traffic.

MinPin has a built-in MCP server. Claude Code, Cursor, VS Code and Windsurf get 27 tools to search captured requests, read headers and bodies (gzip, deflate, br and zstd decoded), and act on what they find: set breakpoints, add Map Local and Map Remote rules, block hosts and read Security Mode alerts. It listens on a local socket, never on the network, and redacts secrets before anything reaches the assistant.

> Why does checkout fail on staging?

search_requests("/v2/checkout")

POST /v2/checkout · 402 Payment Required

get_request(10)

error.code: "card_declined", retryable: false

add_map_local("/v2/checkout", success.json)

Rule added. Retry the checkout to test the happy path.

Debug Window · PRO

Every paused request, in one window.

When a breakpoint fires, the request or response opens in the Debug Window with its headers, body and status ready to edit. Pause several and work through them as a queue, with undo and find in the editors. Closed the window? Everything still waiting comes back with one shortcut. Breakpoints also pause WebSocket frames and edit Protobuf payloads.

MinPin Debug Window with a checkout response paused at a breakpoint, its 402 status and JSON body ready to edit

Waterfall · PRO

See where the time went.

Switch the request list to the Waterfall and every request becomes a bar on one timeline, split into queued, connecting, waiting and downloading. Slow calls stand out, failures are drawn in red, and HTTPS tunnels you haven't decoded still show up. A legend, tooltips and arrow keys make it quick to read.

MinPin Waterfall view: each request drawn as a bar split into connecting, waiting and downloading, with a slow 500 response in red

Building a quick proxy is easy. These parts are not.

Certificate trust, pinning, HTTP/2 and gRPC, a privileged helper and a UI that stays fast under load. MinPin handles each one.

Certificate trust

One-click install and trust on this Mac and for booted iOS Simulators. Phones get a QR code. Android takes a short adb step.

Certificate pinning

Pinned hosts are detected and labelled, then passed through untouched, so the app keeps working. MinPin does not bypass pinning.

HTTP/2, gRPC, WebSocket

Per-stream HTTP/2 rows, gRPC and gRPC-Web decoding, and WebSocket frame breakpoints. HTTP/3 is not intercepted.

Signed system helper

A signed and notarized helper switches the system proxy and restores your previous proxy settings exactly.

Fast under load

A burst of 10,000 requests stays live, and the MCP server keeps answering while it runs.

Catch leaked secrets before they ship.

Security Mode checks captured traffic against 98 built-in rules: API keys and tokens sent in the clear, personal data in URLs, missing security headers, tracking and beacon patterns, and known-bad domains. Each finding explains the risk and the fix, and links to the request that caused it. Import Sigma rules or write your own.

AWS access key in a headerHigh

Email address in a query stringMedium

HSTS header missingLow

Regular beacon to one hostInfo

Built for trust, priced for indies.

SSL decoding is opt-in per host, with a CA created on your Mac. Usage and crash telemetry is anonymous, never includes captured traffic, and can be turned off. The free tier is full capture in 30-minute sessions you can restart any time; PRO removes the limit and unlocks the modification and automation suite.

Telemetryopt-out

SSL decodeopt-in / host

PRO personal$69 once

Commercial$49/seat/yr

Every device on your desk.

One setup window covers this Mac, the iOS Simulator, iPhone and iPad, Android and your code. It shows live certificate status, a QR code for phones, and guides for eight frameworks.

This Mac one-click CA and system proxy
iOS Simulator one-click for booted simulators
iPhone & iPad QR code and trust step
Android step-by-step with adb
Your code 8 framework guides

And the rest of the toolkit.

Everything you expect from a debugging proxy is here too, built to the same standard. Each one has its own page in the documentation.

Change trafficMap Local, Map Remote, rewrite rules, DNS overrides
Networkthrottling presets, upstream and reverse proxy
ReplayCompose, Repeat, Batch Repeat up to 1,000
CodeSwift, Python, fetch and Go, Copy as cURL
ExportHAR, CSV, Gist, saved sessions

Questions developers ask first

Is it safe to install MinPin's root certificate?

The certificate is generated on your Mac, and its private key is stored with owner-only permissions and never leaves the device. MinPin only decrypts HTTPS for hosts you switch on one by one, and checks the real server's certificate on the way out.

Does my traffic leave my Mac?

No. Captured requests and responses stay on your Mac, and the MCP server listens on a local socket, never on the network. Anonymous usage and crash telemetry never includes captured traffic, and you can turn it off.

Does it work with my iPhone, Android phone or the Simulator?

Yes. One setup window installs the certificate in booted iOS Simulators with one click, gives iPhones and iPads a QR code, and walks Android through it with adb. Apps that pin their certificates are detected and passed through untouched.

Will it fight with my VPN or company proxy?

MinPin sets the system proxy while it runs and restores your previous settings exactly when it stops. If your network routes traffic through a proxy, PRO can chain MinPin to it over HTTP CONNECT or SOCKS5.

What happens after 30 minutes on the free tier?

Capture pauses and a banner offers Restart Session, which starts a fresh 30-minute session as often as you like. Restarting clears the request list, so copy anything you need first. PRO removes the limit for $69, once.