Open-source alternatives to Proxyman

Hetty is an HTTP intercepting proxy and web security research toolkit used to capture, inspect, and modify traffic between a browser and a server. It functions as an HTTP request editor for creating and replaying manual requests to test server behavior and as a project-based traffic logger that isolates network logs across different security research engagements. The tool provides a request-response interception loop that pauses outgoing requests and incoming responses in transit, allowing for manual editing or cancellation. It includes a manual request replay engine to construct and transmit

proxy.py is a lightweight, dependency-free HTTP and reverse proxy framework built in Python that handles network traffic through asynchronous event loops and multi-core connection distribution. It acts as a customizable proxy server and embedded web server, allowing developers to inspect, route, and modify web traffic programmatically or via command-line execution wrappers. The platform provides in-flight TLS interception and traffic decryption using generated root certificates, alongside modular extension hooks that support custom dashboard interfaces, request handling plugins, and REST API

Mockserver is a multi-protocol mock server and API verification proxy used to simulate HTTP, gRPC, and WebSocket endpoints. It functions as a tool for testing client applications without relying on live backend services, providing a system to simulate chat completions and streaming responses for large language model integrations. The project automates behavior by generating request expectations and response behaviors from OpenAPI and Swagger specification files. It differentiates itself through a network traffic simulator that introduces latency, dropped connections, and failures to verify ho

Proxypin is a cross-platform HTTP and HTTPS proxy debugger designed to capture, inspect, and modify network traffic. It functions as a man-in-the-middle interceptor, allowing developers to analyze application data flows and validate network communication during development and testing. The tool distinguishes itself through its focus on mobile and remote device integration, utilizing QR-code-based configuration synchronization to simplify the setup of proxy settings and security certificates. It includes an event-driven scripting engine that enables programmatic manipulation of requests and re

Higress is an AI API gateway and cloud-native traffic manager that functions as a Kubernetes ingress controller. It provides a centralized system for routing, securing, and optimizing traffic directed toward large language models, AI agents, and microservice architectures. The project distinguishes itself through deep AI orchestration, including the ability to host and manage Model Context Protocol servers that transform REST APIs into tools for AI agents. It features specialized AI infrastructure for model request proxying, protocol translation across multiple providers, and semantic-based c

Moto is a cloud service mockery framework and API mock server that simulates AWS infrastructure locally. It allows developers to test cloud-dependent code and verify infrastructure-as-code templates without deploying real resources or incurring costs. The project functions as an SDK interceptor that can patch existing service clients to redirect requests to a local mock environment. It can also be run as a standalone HTTP server, enabling any programming language to interact with the simulated endpoints. The framework covers a vast array of simulated capabilities, including data storage, com

NetBird is a zero-trust networking platform that builds secure, encrypted peer-to-peer overlay networks using the WireGuard protocol. It functions as a software-defined perimeter, connecting distributed infrastructure across cloud environments and physical locations while hiding network resources from the public internet. By integrating with external identity providers, the platform enforces granular access control and identity-based segmentation for every user and device. The platform distinguishes itself through extensive automation and programmatic management capabilities. It provides a ce

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

WireMock is a suite of tools for service virtualization, providing mock servers for HTTP APIs and WebSocket communication. It serves as an HTTP API mock server and request verifier, allowing for the simulation of responses and the interception of network requests to test client applications without a live backend. The project differentiates itself through a service virtualization model that records real network traffic and replays it as stubs to mimic external service behavior. It includes a network fault injector to simulate response delays and connectivity issues, and a stateful scenario ma

OWASP ZAP is a dynamic application security testing tool and intercepting HTTP proxy used to find vulnerabilities in web applications. It functions as a penetration testing framework that enables both automated security scanning and manual security testing of running web services. The tool provides a suite of capabilities for analyzing web applications from the outside in, including the ability to capture and modify traffic between a browser and a target application. It is designed to integrate into DevSecOps pipelines to provide consistent security checks across different environments.

Tamperchrome is a browser-based API debugger and network interceptor designed for the real-time manipulation of HTTP traffic. It functions as a proxy alternative that allows for the capturing and modification of requests and responses directly within the browser environment. The tool enables API response mocking and the alteration of server data before it reaches the page. It provides capabilities for modifying outgoing request headers and bodies, as well as injecting content into response bodies to test client-side behavior. The project covers a broad surface of network debugging, including

Reqable is a cross-platform network debugging tool that functions as an HTTP/HTTPS debugging proxy, a REST API client, and a traffic replay tool. It captures, inspects, and modifies live traffic using a local MITM proxy engine, supports VPN tunnel capture for mobile devices, and provides a Python scripting sandbox for custom traffic processing. The application is available on Windows, macOS, Linux, iOS, and Android. The tool distinguishes itself by combining traffic interception with breakpoint-based request modification, allowing users to pause live HTTP traffic for manual inspection and alt

Ettercap is a network utility tool used for ARP spoofing, packet filtering, traffic interception, passive scanning, and DHCP hijacking. It functions as a network traffic interceptor and man-in-the-middle packet filter to monitor and manipulate live TCP/UDP connections on a local area network. The project provides specialized capabilities for traffic redirection via ARP cache poisoning, DHCP server spoofing, ICMP redirects, and switch port stealing. It also enables the emulation of rogue services and the decryption of SSH1 session streams by substituting public keys. Additional capabilities i

An HTTP proxy library for Go

Betwixt is a system-wide network monitor and web debugging proxy that captures network requests from any installed application. It functions as an HTTPS traffic inspector, routing operating system and command line interface traffic through a local proxy for analysis. The tool utilizes a Chrome DevTools compatible interface to render captured traffic, allowing for the inspection of requests and responses from non-browser sources. It performs man-in-the-middle HTTPS decryption by generating a trusted root certificate to inspect encrypted communication between clients and servers. The project c

Opensnitch is a host-based application firewall for Linux that monitors and intercepts outbound network connections in real time. By hooking into kernel-level interfaces, it tracks system-wide network activity and maps connection attempts to specific local processes, allowing users to explicitly permit or deny traffic on a per-application basis. The project distinguishes itself through its ability to manage security policies across multiple distributed nodes from a single, unified dashboard. This centralized management is secured via encrypted socket communication, enabling consistent rule en

CrowdSec is a collaborative, distributed security engine designed for threat detection and infrastructure protection. It functions as an intrusion detection system that parses logs and network traffic to identify malicious patterns, utilizing a bucket-based threshold detection model to aggregate events and trigger alerts. The platform is built on a modular architecture that includes a centralized local API server for managing security signals and a relational database for persistent storage of remediation decisions. What distinguishes the project is its decoupled enforcement model, which offl

This project is a censorship circumvention utility designed to maintain connectivity to restricted online services by evading deep packet inspection. It functions as a network traffic redirection service that manipulates packet headers at the transport layer to bypass regional network filters and censorship systems. The tool distinguishes itself by providing granular control over traffic management, allowing users to define specific lists of domains and IP addresses for targeted interception. By applying custom bypass strategies only to these designated hosts, the utility ensures that the rem

Toxiproxy is a framework designed for chaos engineering and network resilience testing. It functions as a programmable TCP proxy that intercepts and routes data streams between clients and servers, allowing developers to simulate unstable network conditions such as latency, bandwidth throttling, and connection failures. The tool provides a control plane that enables the dynamic manipulation of network conditions on active connections in real time. By integrating into automated test suites, it allows for the programmatic injection of faults to validate how distributed systems and microservices

Lego is an ACME certificate manager and lifecycle tool used to automate the request, renewal, and revocation of SSL and TLS certificates. It implements the ACME protocol to communicate with compliant certificate authorities and manages the full issuance process, including account registration and private key rollovers. The project distinguishes itself through extensive DNS automation, utilizing a provider-based abstraction to solve DNS-01 challenges across various third-party DNS providers. It supports advanced verification workflows such as CNAME-based challenge delegation, DNS zone discover

Coraza is a web application firewall engine designed to filter malicious HTTP traffic using standardized security directives. It functions as a library for embedding request filtering and security transaction processing directly into web servers or reverse proxies. The engine implements the ModSecurity WAF engine and the OWASP Core Rule Set to identify and block common web attack patterns. It utilizes a library-first integration model, allowing security capabilities to be embedded into a host process as a dependency rather than running as a standalone proxy. The project covers rule-based pat

mosdns is a DNS forwarding server and traffic filter that routes DNS queries to multiple upstream providers. It functions as a rule-based DNS router and a proxy for DNS-over-HTTPS and DNS-over-TLS to ensure secure DNS resolution. The system utilizes a pipeline-based request processing model and rule-based query routing to direct specific domain queries to different upstream servers. It implements pluggable transport layers and forwarding protocols, including HTTPS, TLS, and QUIC, to encrypt traffic and prevent eavesdropping. The project includes capabilities for upstream load balancing to di

Vue-typescript-admin-template is a TypeScript-based admin panel starter built with Vue CLI 3, providing a complete foundation for building enterprise back-office interfaces. It enforces type safety across Vue components using TypeScript, reducing runtime errors and improving code maintainability, while offering a dynamic route permission system that controls sidebar navigation and page access by mapping user roles to route permissions at runtime. The template includes a mock API service layer that simulates backend responses for frontend development without a live server, along with internati

Zen Desktop is a cross-platform proxy client and network request filter for Windows, macOS, and Linux. It functions as a system-wide ad blocker and privacy protection tool that intercepts network traffic across all operating system applications to block advertisements, trackers, and malware. The software employs a network request filtering system that modifies HTTP headers and prunes JSON data using custom rules and regular expressions. It specifically removes tracking parameters and sanitizes network headers to prevent activity monitoring. The project provides capabilities for blocklist man

Databasus is a self-hosted backup platform that automates PostgreSQL backups, verifies their restorability, and stores them across multiple destinations while managing team access with role-based permissions. It combines on-the-fly AES-256-GCM encryption, cron-driven scheduling, job-queue-based verification, multi-destination storage, WAL streaming, throwaway container restore testing, and workspace-based role access control into a unified backup system. The platform distinguishes itself through automatic backup verification that restores each backup into a temporary database container for in

xcodebuildmcp is a Model Context Protocol server that exposes Xcode build, test, and device management tools for AI coding agents to automate iOS and macOS development workflows. It operates as a background daemon per workspace, communicating tool requests and responses over standard input/output using JSON-RPC messages, and streams progress and results as newline-delimited JSON objects for machine parsing. The project provides an interactive setup wizard and file-based client configuration to install skill files into predefined directories for supported AI coding clients. It manages the full