Heron 1.3 for Mac · iPhone console + network, side by side
Scan once to open app.test on your iPhone with real HTTPS. See the page's JavaScript console beside each request, understand what broke, and change the traffic — entirely on your machine.
14-day full-featured trial · No account or card · macOS 15+ · Apple Silicon
Heron generates a .mobileconfig — scan it and your phone's proxy is configured. PAC mode by default: only your dev domains go through the Mac, everything else connects directly, untouched. Removing the profile removes Heron's proxy settings; iOS may also clear the saved Wi-Fi password for that network, so reconnecting can require entering it again.
Map a domain like app.test to your local dev server, then open it on a real phone over real HTTPS. Secure cookies, OAuth callbacks, WeChat H5 domain whitelists — the things that "only reproduce in production" — become debuggable on your machine. Heron signs a local certificate and the CA never leaves your Mac. Verified on iOS 26.5: Safari and the WeChat in-app WebView both work (Android not tested yet). The first time, iOS makes you flip one "Certificate Trust" switch by hand — the system won't let an app skip it, so Heron walks you through it.
Requests from your phone are listed live: URL, headers, cookies, JSON. HTTPS decryption is opt-in, per domain you add. When a request fails or behaves strangely, Heron explains why and hands you a curl command to reproduce it. Logs stay on your machine.
New in 1.2: connect your iPhone over USB and stream the live JavaScript console from Safari or an inspectable WKWebView. See log levels, source locations and navigation markers; search or filter the stream; and run JavaScript in the page from a built-in REPL. Each entry keeps the page URL it came from, so you can line up what the page said with the requests around the same moment.
Map Local answers a request with a file from your Mac, Rewrite rules edit headers, status codes and response bodies on the fly, and Breakpoints hold a request or response mid-flight so you can edit it before letting it through. Any captured request can also be edited and resent. Rules match the domains you choose; everything else passes through untouched.
Heron's built-in MCP server lets Claude Code, Cursor and other compatible agents query captured flows, find inspectable pages, read console messages and — only when you allow it — run JavaScript in a page. It is off by default: page inspection, console reads and JavaScript evaluation each have explicit controls, and credential headers and URL tokens are masked by default. Whatever the agent reads is sent to its own LLM provider, so access never turns on silently.
Console on a real iPhone
Connect over USB and watch Safari or an inspectable WKWebView live from your Mac. Levels, source locations, page URLs and JavaScript evaluation stay together, so the error and the request that caused it are no longer two separate investigations.
isInspectable. Verified on iOS 26; iOS 16.4–18 are best-effort.Local by design
No account, no analytics SDK, no uploading of your config, traffic logs or page console. HTTPS decryption only applies to dev domains you explicitly add, page inspection is an explicit opt-in, and the certificate's private key never leaves your Mac. Domains you don't add are passed through untouched — Heron sees only encrypted bytes, never their contents.
whistle is great and we've used it. The difference: it needs a Node environment, manual proxy config and certificate install, and every step on the phone side is done by hand. Heron makes domain mapping, phone setup, certificates and the trust prompt one native flow — and when something fails, it tells you which step you're stuck on. If whistle already feels smooth to you, you may not need this.
Those are broad capture proxies. Heron covers the everyday modify loop too — Map Local, Rewrite, Breakpoints and edit-and-resend — on top of capture, HTTPS decryption and explanations. Its focus is narrower: getting an iPhone or WebView onto your local HTTPS app with minimal setup, then putting the page console and network timeline into one workflow. The built-in MCP server can query both, with separate consent controls for console reads and JavaScript evaluation. If you rely on a niche feature beyond that workflow, check before switching.
No one-click switch yet — 1.0 is built around the phone loop. The engine doesn't care where traffic comes from, though: point any Mac app at http://127.0.0.1:<proxy port> (the port is shown in Heron's settings) and its requests appear in Capture. For terminal tools that's curl -x; for a browser, set the proxy manually in System Settings — handy if you already run Surge or Clash and don't want anything fighting over the system proxy. HTTPS decryption additionally requires trusting Heron's CA in your macOS keychain and adding the domain to the decrypt list. A proper "capture this Mac" switch is on the roadmap as part of the traffic-routing work.
Debugging tools shouldn't be rented by the month. Heron is a $49 one-time purchase and includes every 1.x update. Maintained throughout a major version, with big new features landing in the next paid major version. For reference: Charles is a $50 buyout, Proxyman Standard is $89, and Surge-class tools charge to keep updating (2026-07 prices).
No. iOS exposes the Wi-Fi's proxy configuration to any app by design, so security-minded apps (banking, payments) check for it and warn — normal anti-tampering behavior. It only means "a proxy is configured," not that this app's traffic is being read. Heron's proxy rule is domain-scoped: only the dev domains you explicitly add for decryption pass through Heron; everything else (including your bank) goes direct, end-to-end encrypted, and Heron never sees the plaintext. To silence the warning, turn the proxy off on that Wi-Fi when you're done debugging, or run Heron against a separate test device.
Not tested yet, no promises. What's verified is iOS (Safari + WeChat in-app WebView).
Download, launch, done — every feature is unlocked for 14 days, no account or card. When it ends, buy a license ($49, one-time) to keep going; your settings and logs stay on your Mac.
Native Mac app
14-day full-featured trial · macOS 15+ · Apple Silicon · Questions? [email protected] · Report an issue on GitHub