Skip to content
SPECIFICTION
Get listed

Tucano Proxy

github.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.2 #12 of 27 in Web Debugging Proxies

What it is

Tucano Proxy is a free, MIT-licensed open-source HTTP/HTTPS debugging proxy for inspecting and replaying network traffic. It runs through a configurable local MITM proxy and captures HTTP, HTTPS, and WebSocket connections. A native CLI, terminal inspector, local web interface, and desktop app provide several ways to work, with named sessions shared across the CLI, terminal UI, and web UI. The inspector presents request and response headers, timing, and bodies, with viewers for JSON, XML, HTML, raw text, hex, images, and forms. Filtering, search, capture comparison, notes, color marks, editable request replay, and exports to cURL, HAR, and Python requests support investigation. The project documents MCP integration and a coding-agent skill. Desktop installers cover macOS Apple Silicon, macOS Intel, and Windows; standalone CLI releases include macOS, Linux, and Windows. It can create a root CA and offer trust-store installation, while ordinary startup does not install certificates or change system proxy settings.

Spec sheet

Purpose
Tucano Proxy is an open-source HTTP/HTTPS debugging proxy with a native CLI, terminal inspector, local web UI, and desktop app.Read 9 Oct 2026 · github.com
Product
Tucano Proxy is an open source HTTP/HTTPS debugging proxy with a native CLI, terminal inspector, local web UI, and desktop app.Read 9 Oct 2026 · github.com
Integrations
The product documents MCP integration and an installable coding-agent skill, and can open the web inspector in Maestri or Orca environments.Read 9 Oct 2026 · github.com
Security
The standalone service listens on loopback and requires authentication for inspection and mutations, with Host and Origin validation for its browser-facing API.Read 9 Oct 2026 · github.com
License
The repository identifies the project as MIT-licensed and credits Paulo Cabral.Read 9 Oct 2026 · github.com
Certificate handling
The app can create a root CA and offer OS trust-store installation, while CLI setup treats trust installation as opt-in and ordinary proxy startup does not install a certificate.Read 9 Oct 2026 · github.com
Data handling
Private capture and no-log compose are documented; the security guide cautions that built-in redaction does not reliably sanitize opaque binary bodies or guarantee anonymity.Read 9 Oct 2026 · github.com
Desktop platforms
Desktop installers are listed for macOS Apple Silicon and Intel, and Windows; Linux is listed for standalone CLI binaries.Read 9 Oct 2026 · github.com
Distribution
Native CLI archives include SHA-256 checksums, and documented installers verify checksums before replacing the executable; the security guide says checksums are not independent publisher signatures.Read 9 Oct 2026 · github.com
Downloads
Desktop installers are listed for macOS Apple Silicon and Intel and Windows, while standalone CLI releases include macOS, Linux, and Windows targets.Read 9 Oct 2026 · github.com
Inspection
The inspector displays request and response headers, timing, and bodies, with viewers for JSON, XML, HTML, raw text, hex, images, and forms.Read 9 Oct 2026 · github.com
Interfaces
CLI, terminal UI, and local web UI share persistent named sessions, and the CLI runs without a graphical session.Read 9 Oct 2026 · github.com
Limitations
The security documentation says certificate pinning, application-specific trust stores, and clients that ignore proxy settings can prevent interception.Read 9 Oct 2026 · github.com
Linux support
Prebuilt CLI targets include Linux ARM64 and x64 using glibc; Alpine/musl is not listed as a supported prebuilt target.Read 9 Oct 2026 · github.com
Local security
The standalone service listens on loopback and requires authentication for inspection and mutations; the security guide says not to expose it through a tunnel, reverse proxy, or public bind address.Read 9 Oct 2026 · github.com
Maker location
The maker's GitHub profile lists Rio de Janeiro.Read 9 Oct 2026 · github.com
Network changes
Starting the ordinary proxy does not silently change system proxy settings or install a certificate; certificate trust and system proxy changes are explicit.Read 9 Oct 2026 · github.com
Privacy controls
The product supports private capture and no-log compose; its documentation says built-in redaction does not guarantee anonymity, particularly for opaque binary bodies.Read 9 Oct 2026 · github.com
Support and license
The repository identifies Paulo Cabral as creator and maintainer and licenses the project under MIT; no dedicated support terms are stated on the repository page.Read 9 Oct 2026 · github.com
Support and reporting
For sensitive issues, the project asks users to provide a minimal sanitized reproduction, affected version and platform, observed behavior, and relevant capture IDs through an appropriate private reporting channel.Read 9 Oct 2026 · github.com
Traffic capture
It captures HTTP, HTTPS, and WebSocket traffic through a configurable local MITM proxy.Read 9 Oct 2026 · github.com
Workflow
Features include filtering, capture comparison, search, notes, color marks, editable request replay, and exports including cURL, HAR, and Python requests.Read 9 Oct 2026 · github.com

Plans and prices

MIT License Free Open-source software under MIT license Read 9 Oct 2026 · github.com

Every Tucano Proxy plan and price →

Strong points and limits

Strong points

  • Captures HTTP, HTTPS, and WebSocket traffic
  • Inspectors show headers, timing, and bodies
  • Editable replay and multiple export formats
  • CLI runs without a graphical session
  • Free MIT-licensed open source

Limits

  • No breakpoint rules
  • No response mocking
  • Certificate pinning can prevent interception

Who it suits

It suits developers and security practitioners who need local inspection of HTTP, HTTPS, or WebSocket traffic through CLI, terminal, web, or desktop interfaces. Self-hosted deployments and explicit certificate controls fit users managing their own debugging environment.

Verdict

Tucano Proxy combines broad traffic inspection with CLI, terminal, web, and desktop interfaces. Its documented security controls and explicit certificate handling are useful, but interception has stated client and certificate limitations.

Where Specifiction places it

Alternatives to Tucano ProxyAll alternatives →