Caido

Caido is a web security auditing toolkit designed to support manual testing with AI and teamwork. Its proxy intercepts and monitors HTTP and WebSocket traffic, with history for reviewing intercepted traffic and WebSocket messages. HTTPQL filtering helps search requests and responses. Node-based workflows support ad-hoc automation, and automated attacks can use custom payloads and placeholders. Users can connect existing LLM providers, including Anthropic, Google, OpenAI, and providers available through OpenRouter. AI agents can access Caido programmatically through its Client SDK. The toolkit supports community plugins and custom extensions; its free Basic plan limits users to three plugins, two projects, seven workflows, five filter presets, and one pipeline session at a time. Basic is free forever, while the listed paid starting price is $20/user/mo. Caido presents itself for pentesters, security engineers, and bug bounty hunters, and lists Linux, macOS, Windows, web, API, and self-hosted platforms. The company says it was founded in 2021 and is bootstrapped and independent.

Caido brings traffic inspection, filtering, automation, and AI-provider connections into a web security auditing toolkit. The free Basic plan has defined project, workflow, plugin, and pipeline limits.

Caido is aimed at pentesters, security engineers, and bug bounty hunters who need tools for manual web security auditing. Its traffic history, filtering, and workflow features may suit users building repeatable review processes.

Overview

Caido is a web security auditing toolkit for inspecting traffic and scaling manual testing. It suits pentesters, security engineers, and bug bounty hunters who want filtering, automation, and optional AI connections in one workspace. The free tier offers a practical starting point, but its project and workflow caps may constrain sustained work.

It supports web, API, and mobile testing, along with finding management. Founded in 2021, Caido describes itself as bootstrapped and independent. Compare it with other tools in our Penetration Testing Software list.

Key features

Traffic inspection and search

Caido’s proxy intercepts and monitors HTTP and WebSocket traffic, keeping history for intercepted traffic and WebSocket messages. That history gives testers material to revisit during an assessment, while HTTPQL filtering helps locate relevant requests and responses without relying only on manual browsing.

Automation, extensions, and AI

Node-based workflows support ad-hoc automation, and automated attacks can use custom payloads and placeholders. This makes Caido more useful for repeatable testing than a traffic viewer alone, though Basic limits users to seven workflows and three plugins. Community plugins and custom extensions add flexibility beyond the built-in toolkit.

Users can connect an existing LLM provider, including Anthropic, Google, OpenAI, and services available through OpenRouter. AI agents can also access Caido programmatically through its Client SDK. These connections suit teams that already use those providers; Caido is not a bundled AI service based on the described setup.

Privacy and support

When users register, Caido collects account name, email, and user-agent. When connecting to cloud services, it collects instance IP addresses and API-call actions and timestamps; it says it does not collect instance data or in-app activity. A Trust Portal lets visitors request access to trust documents. Basic and Individual include public Discord support, while Team includes a dedicated support channel.

Pricing

Caido is freemium, with paid plans from $20/user/mo. Basic costs nothing and remains free forever. It includes two projects, seven workflows, three plugins, five filter presets, and one pipeline session at a time. Those caps make it a low-cost way to assess the workflow, but they may become restrictive for users managing several engagements or relying on more concurrent pipeline sessions.

The Education Plan costs nothing for a free one-year license for students and teachers at accredited institutions. Its defined audience and one-year term make it a useful route for eligible learners, not a continuing free plan for general professional use.

Individual offers unlimited projects and workflows, AI Assistant, nightly builds, and one user, with monthly or yearly billing; its price is not published on the opened page. It removes two important Basic caps, but remains a single-user plan. Team has custom pricing per seat, with shared instances, reassignable licenses, and a dedicated support channel; its monthly or yearly billing makes seat count central to the cost. Enterprise uses custom pricing per seat and adds unlimited users, purchase orders, and custom integrations built on request. No free trial is offered, so prospective buyers cannot use a trial period to evaluate paid plans.

Platforms

Caido is available for API, Linux, macOS, self-hosted, web, and Windows environments. That spread supports both local and web-based setups, including self-hosting for teams that prefer to run an instance in their own environment.

Who it's for

Caido is a strong fit for practitioners who regularly inspect HTTP or WebSocket traffic and want to combine filtering, repeatable workflows, and optional AI-provider connections. Individual is the more natural fit for solo testers who need room beyond Basic’s project and workflow limits. Teams that need shared instances, reassigned seats, or dedicated support should look at Team; organizations needing unlimited users or custom integrations have an Enterprise option.

It is less compelling for buyers who need published paid-plan prices before evaluating costs, or for users whose work outgrows Basic but does not justify an individually priced subscription. The free Education Plan is restricted to students and teachers at accredited institutions.

Pros and cons

• Pros: HTTP and WebSocket interception with history supports review of both live and previously captured assessment traffic.
• Pros: HTTPQL, node-based workflows, and custom-payload attacks bring search and automation together in one toolkit.
• Pros: Existing LLM-provider connections and a Client SDK provide options for AI-assisted or programmatic access without requiring one named provider.
• Cons: Basic’s two-project, seven-workflow, three-plugin, five-filter-preset, and single-pipeline-session caps can limit growing assessments.
• Cons: Prices for Individual and Team are not published on the opened page, while Enterprise uses custom per-seat pricing, making paid-plan cost comparison difficult.
• Cons: No free trial is offered for evaluating paid plans.

Alternatives

Pick Kali Linux if a free, open-source distribution is a better fit than a focused freemium auditing toolkit. Dradis is worth considering when a free-forever, open-source Community Edition with one project at a time and community forum support fits the need.

OWASP Amass is a free, open-source framework for readers seeking that kind of tool. Pentesterra offers a free DevGuard tier with one project, three scans per month, CLI, IDE plugin, web console, and community support, a better match for readers prioritizing that combination.

Aircrack-ng is a free software suite with no license fee. Reconmap is a free and open-source option with no usage limits stated, while RedAmon offers a free, MIT-licensed self-hosted Docker stack for commercial and personal use.

Revelion has a free PAYG tier with no monthly commitment and 10,000 starting credits.

Verdict

Choose Caido if you are a pentester, security engineer, or bug bounty hunter who wants traffic inspection, search, workflow automation, and optional AI connections in one toolkit. Its free Basic plan gives solo users a defined way to start, and Individual removes the project and workflow limits for one user. Look elsewhere if published upgrade pricing is essential to your decision or Basic’s caps do not fit your workload.