A native HTTP testing workspace for macOS and Windows, built with Rust and GPUI Kit. Capture traffic, edit and replay requests, keep findings with evidence, and connect an MCP client to the same project.
Download · Releases · Changelog
Download the Apple Silicon ZIP, extract it and move Recon.app to Applications. Rust and Node.js are not required.
The app uses an ad-hoc signature and is not notarized. macOS may block the first launch. After attempting to open it, use System Settings → Privacy & Security → Open Anyway for Recon if available. If macOS still refuses the app, and you have verified the download source, remove quarantine from this app only:
xattr -dr com.apple.quarantine /Applications/Recon.appSHA-256 checksums accompany release packages. About → Check for updates downloads and verifies stable releases; save your work before restarting to update. The installation folder must be writable.
Windows x64 has an unsigned installer and portable ZIP. Linux x86_64 packaging is experimental; see the release assets for available builds.
- Proxy captures HTTP and HTTPS, with request/response interception and WebSocket history. Enable the listener in Settings → Proxy; use the certificate help there to configure HTTPS clients.
- Repeater edits raw HTTP with an independent connection target, send history and searchable Request / Response panes.
- Target and Logger organize observed endpoints and traffic. Search with plain text or HTTPQL.
- Intruder, Comparer and Decoder run payload variations, compare messages and transform text.
- Findings and Resources keep evidence, test guides, variables and credential references with the project.
Create a named project for work you need to retain. Settings opens in its own window with ⌘,. Recon starts in English; choose 简体中文 in Settings → General to switch languages. The colour scheme follows the system by default; choose Light or Dark in Settings → General.
| Shortcut on macOS | Action |
|---|---|
| ⌘↵ / ⌘. | Send / cancel |
| ⌘T / ⌘W / ⇧⌘T | New / close / reopen a Repeater tab |
| ⌘1–9 | Switch tool in sidebar order |
| ⌃1–9 | Select a Repeater tab by position |
| ⌘F | Find in the focused message |
| ⌘K | Search commands |
| ⌘, | Open Settings |
Menus and tooltips show the remaining shortcuts. Windows uses Ctrl for the main commands and Alt+1–9 for Repeater tabs.
Enable the server on MCP, then copy its URL and bearer token into a client that supports Streamable HTTP. The default URL is http://127.0.0.1:9877/mcp; the server is off by default.
Agents can inspect traffic, send requests, use Repeater, manage findings and read project resources. Select the tools and permissions you need on MCP. Copy for Agent shares an HTTP snapshot or finding reference from its context menu.
Recon saves named projects outside the application folder. Uninstalling the app does not delete them. Credentials and captured traffic are stored on disk without application-level encryption; credential references hide values from ordinary MCP resource reads, but do not redact every response or log.
Use one Recon instance per project directory. Recon is not a complete vulnerability scanner. Its session profiles keep cookies per origin but there is no global cookie jar or login macro; local canaries correlate recorded traffic and do not receive external DNS/HTTP callbacks.
cargo run # isolated development profile
cargo test --locked
./icon/bundle.sh # target/Recon.app; RELEASE=1 also writes the macOS ZIPs
python3 icon/test-macos-install.py # verify the built macOS package
python3 scripts/check_repository.pyThe macOS package test uses temporary settings, state, projects and local HTTP/TLS services. It launches a separate app and does not install a system certificate. It requires a logged-in macOS graphical session and Python 3.11 or newer.
Debug builds use separate data directories and proxy/MCP ports 18080 / 19877; release defaults are 8080 / 9877.
For development, see the repository conventions.
Recon is licensed under Apache-2.0. Report bugs or suggestions in Issues; include the app version and steps to reproduce, and remove credentials and sensitive HTTP data before attaching examples.