- Home
- Web Debugging Proxies
- Tucano Proxy
Tucano Proxy
What it is
Tucano Proxy is a free, MIT-licensed HTTP/HTTPS debugging proxy with a native CLI, terminal inspector, local web UI, and desktop app. It captures HTTP, HTTPS, and WebSocket traffic through a configurable local MITM proxy. The inspector shows request and response headers, timing, and bodies, with viewers for JSON, XML, HTML, raw text, hex, images, and forms. Debugging tools include filtering, searching, comparing captures, notes, color marks, editable request replay, and exports such as cURL, HAR, and Python requests. The CLI, terminal UI, and web UI share persistent named sessions, and the CLI runs without a graphical session. The standalone service listens on loopback and requires authentication for inspection and changes. Desktop installers are listed for macOS and Windows, while CLI releases cover macOS, Linux, and Windows. Certificate trust and system proxy changes are explicit rather than automatic. Interception may not work with certificate pinning, application-specific trust stores, or clients that ignore proxy settings.
For and against
For
- Captures HTTP, HTTPS, and WebSocket traffic.
- Provides request replay and multiple export formats.
- CLI works without a graphical session.
- Service requires authentication and listens on loopback.
- Free and MIT-licensed.
Against
- Certificate pinning can prevent interception.
- Some clients ignore proxy settings.
- Alpine/musl is not a listed prebuilt target.
- Redaction does not guarantee anonymity.
The verdict
Tucano Proxy offers multiple interfaces and a substantial set of capture and inspection tools at no cost. Its interception limits and privacy caveats matter when choosing it for a particular client or sensitive traffic.
Who it suits
It suits developers who need to inspect and replay web traffic across CLI, terminal, or graphical workflows. It may be less suitable when target clients prevent interception or when a prebuilt Alpine/musl Linux CLI is needed.
Plans and prices
MIT License
Open-source software under MIT license
Read 9 Oct 2026 · github.com
On the record
- Certificate handling
- The app can create a root CA and offer OS trust-store installation, while CLI setup treats trust installation as opt-in and ordinary proxy startup does not install a certificate.github.com · read 9 Oct 2026
- Data handling
- Private capture and no-log compose are documented; the security guide cautions that built-in redaction does not reliably sanitize opaque binary bodies or guarantee anonymity.github.com · read 9 Oct 2026
- Desktop platforms
- Desktop installers are listed for macOS Apple Silicon and Intel, and Windows; Linux is listed for standalone CLI binaries.github.com · read 9 Oct 2026
- Distribution
- Native CLI archives include SHA-256 checksums, and documented installers verify checksums before replacing the executable; the security guide says checksums are not independent publisher signatures.github.com · read 9 Oct 2026
- Downloads
- Desktop installers are listed for macOS Apple Silicon and Intel and Windows, while standalone CLI releases include macOS, Linux, and Windows targets.github.com · read 9 Oct 2026
- Inspection
- The inspector displays request and response headers, timing, and bodies, with viewers for JSON, XML, HTML, raw text, hex, images, and forms.github.com · read 9 Oct 2026
- Integrations
- The product documents MCP integration and an installable coding-agent skill, and can open the web inspector in Maestri or Orca environments.github.com · read 9 Oct 2026
- Interfaces
- CLI, terminal UI, and local web UI share persistent named sessions, and the CLI runs without a graphical session.github.com · read 9 Oct 2026
- License
- The repository identifies the project as MIT-licensed and credits Paulo Cabral.github.com · read 9 Oct 2026
- Limitations
- The security documentation says certificate pinning, application-specific trust stores, and clients that ignore proxy settings can prevent interception.github.com · read 9 Oct 2026
- Linux support
- Prebuilt CLI targets include Linux ARM64 and x64 using glibc; Alpine/musl is not listed as a supported prebuilt target.github.com · read 9 Oct 2026
- Local security
- The standalone service listens on loopback and requires authentication for inspection and mutations; the security guide says not to expose it through a tunnel, reverse proxy, or public bind address.github.com · read 9 Oct 2026
- Maker location
- The maker's GitHub profile lists Rio de Janeiro.github.com · read 9 Oct 2026
- Network changes
- Starting the ordinary proxy does not silently change system proxy settings or install a certificate; certificate trust and system proxy changes are explicit.github.com · read 9 Oct 2026
- Privacy controls
- The product supports private capture and no-log compose; its documentation says built-in redaction does not guarantee anonymity, particularly for opaque binary bodies.github.com · read 9 Oct 2026
- Product
- Tucano Proxy is an open source HTTP/HTTPS debugging proxy with a native CLI, terminal inspector, local web UI, and desktop app.github.com · read 9 Oct 2026
- Purpose
- Tucano Proxy is an open-source HTTP/HTTPS debugging proxy with a native CLI, terminal inspector, local web UI, and desktop app.github.com · read 9 Oct 2026
- Security
- The standalone service listens on loopback and requires authentication for inspection and mutations, with Host and Origin validation for its browser-facing API.github.com · read 9 Oct 2026
