Request and response
Read method, URL, headers, status, timing, and a decoded body preview in text mode or the terminal UI.
httpmon · Go CLI
See the HTTP traffic
Wrap curl, aws, Python, or any proxy-aware command and read its requests and responses live — the command's own response unchanged.
$ httpmon curl https://api.github.com/users/octocat
REQUEST #1 GET https://api.github.com/users/octocat
Host: api.github.com · Accept: */*
RESPONSE HTTP/1.1 200 OK
Content-Type: application/json · 245ms
{"login":"octocat","id":583231,...} local HTTPS inspectionoriginal response stream stays with the command
One command, one local layer
Only the wrapped process is configured
httpmon starts a local MITM proxy, gives its address and temporary CA to one child process, and forwards the original response stream to that process unchanged.
- 01
Start locally
Put `httpmon` before curl, aws, Python, Node, or another proxy-aware command. No system proxy is changed.
- 02
Configure one child
The proxy address and ephemeral CA live in that command's environment, not in your global network settings.
- 03
Forward and display
The command receives its original stream. Beside it, httpmon shows headers, status, timing, and a decoded preview.
- 04
Save when needed
Write NDJSON, HAR, or a recording when the session needs to be replayed or shared.
Beside the wrapped command
Beside the wrapped command
The original stream
The wrapped command still receives its original response. Decompression is only for httpmon's display preview.
Focused traffic
Use `--filter` when a command is noisy and only a URL or host matters to the investigation.
Keep a session only when useful
Keep a session only when useful
A structured record
Write NDJSON for another command or HAR 1.2 for an inspector that understands web traffic.
Record and replay
Record request-response pairs, then replay an authorized session against its original target or a comparison environment.
wss and recordings
wss and recordings
HTTPS and the wss handshake
It handles HTTPS and captures the `wss://` upgrade handshake. After the 101 response, WebSocket frames are spliced in both directions.
Recordings can hold secrets
Headers, cookies, query parameters, and response bodies may contain credentials or business data. Capture and replay only in authorized environments, and handle NDJSON, HAR, and recording files as sensitive logs.