Reference
Data and privacy
On this page
This page lists what ReqRes keeps in memory, what it writes to disk, and what it sends over the network.
What stays in memory
- Captured requests stay in memory. ReqRes writes one to disk only when you save it, or when an agent saves it, exports it as HAR or makes a rule from it.
- All traffic and each host filter keep their 5,000 most recent requests. Older ones are dropped.
- Quitting ReqRes discards captured requests, and so does Clear Captured Traffic. Stopping capture does not.
- When you quit ReqRes, it stops capture. If ReqRes quits unexpectedly, after a crash or a Force Quit, capture keeps running without it, as it does while the window is closed. The capture extension keeps the most recent requests in its own memory until ReqRes opens again and lists them. To end it, open ReqRes and stop capture.
To keep a request after you quit, save it. See Save a session.
What is written to disk
| Data | Where | Notes |
|---|---|---|
| Host filters, rules and saved sessions | A database in ReqRes's app group container. Settings ▸ Storage ▸ Where it is kept shows the file. | Saved sessions keep real values, unmasked. |
| HAR files an agent exports | A folder in ReqRes's container. Settings ▸ MCP ▸ Activity has Show in Finder for it. | Redacted. |
| Files an agent's Map Local rule serves | An MCP Fixtures folder in ReqRes's container | Can hold a captured response body, unmasked. |
| The agent activity log | ReqRes's preferences | The latest 100 entries are kept between launches. Clear Log empties it. |
| An activity log you export | The file you choose after Export… | Redacted. |
| The MCP handshake file | ReqRes's container, readable by your user account only | Holds the MCP server's port and a token. A client needs it to connect. |
| The certificate you export | The file you choose after Export CA Certificate… | "The certificate only — the file contains no private key." |
| The ReqRes CA certificate, its private key, and the key its per-site certificates share | The Cert folder in ReqRes's app group container, in files only your user account can open | Created the first time ReqRes runs. See The ReqRes certificate. |
| The apps that refused the ReqRes certificate | ReqRes's preferences | Each app with the domain ReqRes passes through for it. Settings ▸ Capture ▸ SSL-pinned apps lists them, with Forget and Forget All. |
Settings ▸ Storage warns about the saved-session database: "That file is not a vault. It is readable by anything running as you, and it is included in any backup of your home folder — so treat a saved session the way you would treat the traffic itself."
What leaves your Mac
| What | Where it goes | When |
|---|---|---|
| Map tiles | Apple Maps. Apple receives the map area you view, which ReqRes frames around your destinations, never the addresses of your requests. | While the Destinations window shows the map. |
| Crash reports and a 10% sample of performance traces | Sentry. No captured traffic is included. | While Share crash and performance reports is on. It is on by default. |
| An update check | ReqRes's update feed on raw.githubusercontent.com | When you choose ReqRes ▸ Check for Updates... or click Check Now, and while Check for updates automatically is on. |
| Your license key and your Mac's serial number. Activation also sends your Mac's name. | reqresapp.com | When you activate a license, when you deactivate this Mac in Settings ▸ License, and when ReqRes checks it online. With no license, nothing is sent. |
| A replayed request, with its real headers | The server the request first went to | When you approve an agent's replay_request. Replay always asks you first. While capture runs, the request goes through ReqRes. With capture stopped, it goes straight to the server. |
| What a connected agent reads | The agent. Your agent's provider receives what the agent reads. | When an agent calls a tool. Credential-shaped values are redacted, except for hosts you list under Send unmasked. |
To turn off crash reports, see Settings. For what agents see, see Control what agents see.
Some things never leave your Mac:
- The country for each request comes from a table bundled with ReqRes. No address is looked up online.
- The Destinations map places your Mac from its time zone. ReqRes never asks Location Services.
- The capture proxy listens on
127.0.0.1only, on the port in Settings ▸ Capture ▸ Proxy port (8034 by default). Other devices on your network cannot connect to it. - The MCP server listens on this Mac only, and only while ReqRes runs and Enable the AI bridge is on.
The ReqRes certificate
To read HTTPS, ReqRes decrypts each connection and encrypts it again with a certificate signed by "ReqRes CA". Your Mac accepts those connections because you installed and trusted "ReqRes CA".
In the app's words: "“ReqRes CA” is a certificate authority ReqRes made on this Mac, for this installation."
- Install CA certificate adds "ReqRes CA" to your login keychain.
- Trust marks it as trusted for SSL and X.509 for your macOS user account only. It cannot create another certificate authority.
- Settings says where its private key is: "Its private key is kept in ReqRes's own container, in files only your user account can open, and is handed to ReqRes's capture extension in memory when capture starts. It is never sent anywhere else."
- For each site capture decrypts, the capture extension makes a certificate in memory, valid for 90 days, and never writes it to disk.
- While your Mac trusts "ReqRes CA", it accepts any certificate that "ReqRes CA" signs, for any site. Trust it only while you need to inspect HTTPS.
- ReqRes does not decrypt a connection opened before you trust the certificate. It relays it and records one row with the host, the port and the bytes each way.
- ReqRes does not decrypt apps that pin their certificate, or the Apple services macOS pins. It passes them through and records each connection as one row marked "SSL pinned", with no headers or bodies. See Keep SSL-pinned apps working.
- ReqRes does not decrypt or record a host you list under Excluded from interception, and no rule or breakpoint changes it. See Pass a host through untouched.
Remove the certificate
ReqRes has no button that removes its current certificate. The app says: "Trust stays in your keychain after ReqRes quits or is deleted."
When you stop using ReqRes, click the ? button at the bottom of Settings ▸ Certificate. About the ReqRes Certificate gives the steps for Keychain Access and for Terminal. In Terminal, find the certificate and its SHA-1 fingerprint:
security find-certificate -a -Z -c "ReqRes CA" ~/Library/Keychains/login.keychain-db | grep SHA-1Then remove it, and your trust in it, by that fingerprint:
security delete-certificate -t -Z YOUR_SHA1 ~/Library/Keychains/login.keychain-dbThe sheet prints this command with your Mac's SHA-1 filled in, with a Copy button. The command removes by fingerprint, not by name, so it removes exactly that certificate. macOS asks for your password.
If you exported the certificate as a file for command-line tools, delete that file and the lines that point to it too.
An older "ReqRes CA", such as the one ReqRes 1.0 installed, is different: Replace Old Certificate in Settings ▸ Certificate removes it and installs this Mac's.
Trust the ReqRes certificate has the install steps.