Local-First Network Evidence: Debugging API, Mobile, AI, and Web3 Traffic on macOS

Seeing a request is not enough anymore

A modern product action rarely maps to one tidy HTTP call. A mobile screen loads configuration, checks identity, opens a WebSocket, runs a GraphQL query, uploads analytics, calls an API gateway, and sometimes talks to model or RPC endpoints. A failure can hide in a header, a retry, a cookie, a timing shift, a request body field, or the order of calls.

That is why Rockxy's public strategy uses the phrase network evidence. A debugging proxy should help an engineer move from "I can see a request" to "I understand what happened, what failed, what changed, what leaked, and what evidence I can safely share."

For Rockxy, evidence has six parts: capture the real traffic, inspect it with useful protocol context, reproduce the failure, compare runs, redact sensitive data, and export only what the next person needs.

The local-first boundary

Rockxy is a native macOS app and a local HTTP debugging proxy. The proxy, certificate trust, captured sessions, replay workflow, diff workflow, and redaction controls run on the user's Mac. Captured data should stay there unless the user chooses to export, copy, publish, or hand selected data to another tool.

That boundary matters because network debugging data is sensitive by default. Request headers carry bearer tokens, cookies, API keys, tenant identifiers, device identifiers, and internal hostnames. Response bodies can include user records and operational state. If a tool captures traffic first and asks privacy questions later, the damage is already done.

A local-first design changes the default. The first copy of the evidence is local. The raw traffic is inspectable before export. Redaction is part of the handoff path, not an afterthought.

What Rockxy captures today

The current shipped workflow covers the core traffic that engineers debug every day: HTTP and HTTPS capture, HTTPS decryption through local certificate trust, WebSocket and GraphQL inspection, advanced filters and search, request replay with Compose, diff and compare, rules, breakpoints, map local, map remote, header modification, and network conditions.

The Developer Setup Hub helps route traffic from runtimes, clients, devices, frameworks, and environments into the local proxy. Sessions can be saved, HAR can be imported or exported, requests can be copied as cURL or JSON, and sensitive fields can be redacted before sharing.

Rockxy also includes local MCP integration so an AI-assisted debugging workflow can work with captured traffic from the local app. The important constraint is the same: give the assistant the evidence you chose to expose, not a blanket copy of everything your machine captured.

Evidence workflow: capture, inspect, reproduce, compare

The workflow is intentionally practical. Start by capturing real app or device traffic. Use filters to reduce noise by host, method, status, header, body, domain, content type, or process. Open a request and inspect headers, body, timing, WebSocket frames, or GraphQL shape.

When the failure is isolated, Compose turns the captured request into a controlled replay. You can edit method, URL, query params, headers, and body without switching to a separate replay tool. Rules, breakpoints, map local, map remote, and network conditions let you test failure states that are difficult to trigger in production.

The diff step is where evidence gets sharper. Two requests can look "basically the same" in a log and still differ in the one field that matters: an auth header, a JSON enum, a stale cookie, a timing gap, an omitted GraphQL variable, or a host rewrite. Diff and compare workflows make those changes visible.

AI and blockchain traffic need the same discipline

The AI and blockchain era does not remove the network layer. Model calls, tool calls, streaming responses, JSON-RPC requests, payment-gated HTTP flows, and mobile app calls still move over protocols that can be captured, inspected, replayed, and compared.

Rockxy's product direction is narrow and useful for developers: make modern network traffic easier to understand from one local macOS workflow for capture, inspection, replay, comparison, redaction, and evidence sharing.

That direction includes deeper protocol-aware debugging for AI traffic, Web3/RPC flows, x402-style payment flows, safer evidence bundles, mobile setup automation, HTTP/2, gRPC, richer WebSocket lifecycle, and better timing analysis. Those are direction statements, not claims that every protocol-specific workflow is complete today.

Why open source matters here

Traffic debugging tools sit close to sensitive systems. Engineers should be able to inspect how the proxy works, how certificate trust is handled, how exports are built, and where captured data can flow. Rockxy's open-source core makes that review possible.

Open source is not magic security. It does not replace design review, tests, threat modeling, or responsible disclosure. But for a local proxy that terminates TLS and stores captured traffic, source visibility is a real trust lever. You can audit the assumptions, build from source, open issues, and verify that the product's local-first claim matches its architecture.

Related technical series

This post is the strategy layer. For the security model behind local HTTPS debugging, read Trust, TLS, and Redaction. For the native macOS implementation details, read Inside a Native macOS Network Debugger.

Frequently asked questions