What's new in 1.1

ReqRes 1.1 adds an MCP server for AI agents, captures more protocols, and shows requests that fail or never finish.

AI agents#

• An MCP server that AI agents such as Claude Code connect to, with 33 tools: 18 that read and 15 that change ReqRes. See Connect an AI agent and MCP tools.
• An approval panel that asks you before an agent's change takes effect. replay_request and exclude_host always ask, even with asking turned off. See Approve agent changes.
• Redaction of credential-shaped values before an agent reads traffic. It covers the URL of a held request and the query in a rule's path too. See Control what agents see.
• An activity log in Settings ▸ MCP ▸ Activity, with undo for rule and host filter changes. See Review and undo agent changes.
• Requests an agent makes carry a small sparkles badge on their app icon in the App column. See See which app sent a request.

Capture and setup#

• A setup screen that shows the next step in approving the network extension. See Set up capture.
• A certificate authority made for your installation. In the app's words: "“ReqRes CA” is a certificate authority ReqRes made on this Mac, for this installation." See Trust the ReqRes certificate.
• If an older "ReqRes CA" is in your keychain, ReqRes offers to replace it: the Replace the Old ReqRes Certificate sheet at launch, and a Replace Old Certificate button in Settings ▸ Certificate.
• The ? button in Settings ▸ Certificate opens About the ReqRes Certificate, with the certificate's details and the steps to remove it by hand.
• Trusting the certificate takes effect for new connections without restarting capture.
• A proxy port setting in Settings ▸ Capture ▸ Proxy port, 8034 by default. If another program holds the port, ReqRes asks before it uses another one. See Change the proxy port.
• The Capture menu, with Start Capturing and Stop Capturing on ⌘⇧C. See Start and stop capture.
• Capture ▸ Diagnose Setup…, which names the first thing that stops capture. See Run Diagnose Setup.
• A menu bar icon that shows whether capture is running, with a menu to stop it. See Menus and the menu bar item.
• Capture of command-line tools, with Export CA Certificate… and environment lines in Settings ▸ Capture. The lines use the port you set and carry no comments, so they paste into zsh as they are. Each proxy variable is set in both spellings, such as HTTP_PROXY and http_proxy, because curl and git take the proxy for plain http:// only from the lowercase http_proxy. See Capture command-line tools and agents.
• In-app Help, in Help ▸ ReqRes Help (⌘?), with 11 topics. Supported Protocols lists what ReqRes captures for each protocol. See Supported protocols.
• Updates install without asking for an administrator password.
• Quitting while capture runs asks once, then stops capture and quits.
• If ReqRes quits unexpectedly while capture runs, capture keeps running. Open ReqRes again: it reconnects within a few seconds, lists the requests captured while it was closed, and says how many. A capture it cannot reconnect to, such as one started from System Settings, is restarted once by itself. See Fix missing traffic.
• The proxy no longer listens on your local network. It accepts connections from this Mac only.

Protocols#

• HTTP/2 capture, a beta that is off by default: Settings ▸ Capture ▸ Capture HTTP/2 (beta). See Capture HTTP/2 and gRPC.
• gRPC-Web and Connect calls, and native gRPC as a beta that needs HTTP/2 capture. Each call has an RPC tab, and the row shows the call's status beside the HTTP code. See Capture HTTP/2 and gRPC.
• Trailers, in the Headers tab under Request Trailers and Response Trailers.
• WebSocket messages in both directions, in a Messages tab. Plain ws:// works through ReqRes. See Read WebSocket messages.
• Server-sent events and NDJSON streams, in an Events tab. An answer from Anthropic or OpenAI is put back together. See Read streaming responses.
• Plain http:// on any port, not only port 80.
• zstd bodies are decoded, as well as gzip, deflate and brotli.
• Long downloads and streams are no longer cut after 30 s. A connection closes only after it goes quiet in both directions. See Supported protocols.
• Each of a response's Set-Cookie headers reaches the app intact.
• Each request on a reused connection is its own row. Its Metrics tab says "Reused connection · request 3 on it" instead of drawing DNS, TCP and TLS phases.

Inspect#

• Live rows: a slow or streaming request appears when it starts and grows while it runs. See Read streaming responses.
• Rows for requests that failed, were aborted or timed out, each with the reason in one sentence. When a server cannot be reached, ReqRes answers the app with 502 Bad Gateway and that reason. Requests an app cancels itself are hidden unless Settings ▸ Capture ▸ Show cancelled requests is on. See See why a request failed.
• Relayed rows: HTTPS opened before the certificate is trusted, and other protocols through the proxy, appear as one row per connection. See Supported protocols.
• Apps that pin their certificate keep working while you capture. After the first refusal, ReqRes passes that app's connections through and marks them "SSL pinned by" the app. Apple services macOS pins are passed through the same way. See Keep SSL-pinned apps working.
• Search tokens: host:, method:, status:, path:, app:, pid:, country:, outcome:, grpc: and proto:. See Search and filter traffic.
• The App column, which names the app or process that opened each connection. See See which app sent a request.
• The Destinations window (⌘⇧D) and the Destination column. See See where requests go.
• Columns you can resize by dragging a header divider. Right-click the header and choose Reset Column Widths to put them back. See Read the traffic list.
• Esc and Delete act on the traffic list only while it has the keyboard. So Esc cancels sheets and alerts and works in the search field, and Delete in the Saved Sessions window deletes a saved session there, after asking. See Keyboard shortcuts.
• Down Arrow and Up Arrow move the selection in the traffic list, and with ⇧ they grow or shrink it. The inspector waits until you stop, so holding an arrow key to skim the list uses at most 1 free HTTPS inspection. See Read the traffic list.
• The row menu's Delete session removes the request you right-clicked. When you right-click one of several selected requests, the item reads Delete 3 sessions, for example, and removes them all.
• The cURL tab's command puts the URL, each header and the body in single quotes, or in the $'…' form, so a $(…) or a backquote in a captured value is pasted as text and never runs. It adds a body only for a request with a text body. See Inspect a request.
• Saved sessions, the Saved Sessions window (⌘⇧S) and Settings ▸ Storage. See Save a session.
• A limit on memory use: All traffic and each host filter keep their 5,000 most recent requests. See Read the traffic list.

Change traffic#

• Breakpoints, which hold a matching HTTPS or plain http:// request until you send it on, edit it or fail it. A held request's body is not shown: its Body tab says what the request declares, Resume sends the body unchanged, and Replace Body… sends one you type in its place, with none of the original. While ReqRes is not receiving capture, breakpoints hold nothing. See Hold a request with a breakpoint.
• Rules apply whatever the sidebar has selected, not only while their host filter is selected. See Change requests and responses with rules.
• A Map Local rule, or an Override rule with a body, answers without contacting the server, so the mock works with the server down. If a Map Local rule's file cannot be read, the request goes to the server, and its response comes back unchanged.
• An Extend rule keeps the server's status unless its Status names one, and a new Extend or Map Local rule sets no Content-Type, so the server's or the file's own type stays. A new Override still starts with Content-Type: application/json; charset=utf-8. On its first launch, ReqRes 1.1 resets Extend rules from 1.0 that only add request headers, so they keep the server's status and headers. It also takes that Content-Type off Map Local rules that have no other response header. See A rule changes more than you set.
• A rule's Method limits which requests it matches. New rules use Any, and rules from 1.0 become Any.
• On plain http://, a rule's pattern matches the query as well as the path. See Write a URL pattern that matches.
• Excluded from interception in Settings ▸ Capture, which passes a host through without decrypting or recording it, over HTTPS and plain http://. timestamp.apple.com and *.ls.apple.com are excluded by default, so codesign and the map in the Destinations window keep working while you capture. A Failed row from an app that refuses the certificate has a button, Exclude followed by the host name, that adds it. See Pass a host through untouched.
• Warnings in the New Override sheet when a regex pattern can never match. See Write a URL pattern that matches.

Settings and privacy#

• New Settings tabs: Capture, MCP, Storage and Breakpoints. See Settings.
• On the General tab: Show Destination column, Show ReqRes in the menu bar, Open ReqRes at login and Reset All Warnings. See Settings.
• Update settings. ReqRes checks in the background and tells you when an update is ready. It no longer opens an update window once a day.
• Share crash and performance reports on the General tab. Crash reporting is on by default, and this switch turns it off. See Data and privacy.