one-click-proxy

HTTPS intercepting proxy for local development. Generates an ephemeral CA, launches Chrome with it pre-trusted, and routes Node/Python/Go/Rust traffic through it — no system keychain changes, no manual cert installs.

Install

npm install -g one-click-proxy

Quick start

# Start proxy with Chrome
ocp start --browser

# In another terminal, configure your shell
eval "$(ocp env --lang node)"

# All HTTPS traffic from that shell now flows through the proxy
curl https://example.com  # intercepted

Commands

ocp start

Start the proxy server.

ocp start                          # port 8080
ocp start -p 3128                  # custom port
ocp start --browser                # launch Chrome with proxy pre-configured
ocp start --log                    # print traffic to stdout
ocp start --log-filter '*.api.com' # filter logged traffic by URL glob
ocp start --log-file traffic.har   # write HAR file
ocp start --rules '[{"action":"mock-response","match":"https://api.example.com/health","status":200,"body":"{\"ok\":true}"}]'

ocp env

Print shell export commands for proxy env vars. Pipe into eval to configure the current shell.

eval "$(ocp env)"                  # generic HTTP_PROXY / HTTPS_PROXY
eval "$(ocp env --lang node)"      # + NODE_EXTRA_CA_CERTS
eval "$(ocp env --lang python)"    # + SSL_CERT_FILE / REQUESTS_CA_BUNDLE
eval "$(ocp env --lang go)"        # + GOFLAGS (Linux) or instructions (macOS)
eval "$(ocp env --lang rust)"      # + SSL_CERT_FILE

ocp shell

Spawn a subshell with proxy env vars already set.

ocp shell                          # generic
ocp shell --lang python            # Python-specific vars included

Rule engine

Rules are passed as a JSON array via --rules. First match wins. Supported actions:

| Action | Description | |---|---| | passthrough | Forward request unmodified | | mock-response | Return a fixed response | | map-local | Serve a local file | | map-remote | Forward to a different host | | modify-request | Rewrite request headers before forwarding | | modify-response | Rewrite response headers/status after forwarding |

How it works

1. Ephemeral CA — generates a temporary certificate authority on each run (via mockttp)
2. Chrome trust — uses --ignore-certificate-errors-spki-list to trust the CA without touching the system keychain
3. Lockfile IPC — writes $TMPDIR/ocp-lock.json so ocp env and ocp shell can discover the running instance
4. Clean shutdown — LIFO cleanup manager stops proxy, removes lockfile, and deletes temp CA on exit

License

MIT