Debug your phone's traffic, from your Mac.
One QR code sets up your iPhone or iPad. Open your local dev server on the phone, watch every request on your Mac, and get told why the broken ones broke. HTTPS, Secure cookies, in-app WebViews included. One-time purchase. Runs locally. Collects nothing.
Release notifications only, no marketing email. $29 early-bird — 40% off the $49 release price.
Three things it does
Set up your phone with one QR code
Heron generates a .mobileconfig — scan it and your phone's proxy is configured. PAC mode by default: only your dev domains go through the Mac, everything else connects directly, untouched. Removing the profile removes Heron's proxy settings; iOS may also clear the saved Wi-Fi password for that network, so reconnecting can require entering it again.
Point a domain at your laptop
Map a domain like app.test to your local dev server, then open it on a real phone over real HTTPS. Secure cookies, OAuth callbacks, WeChat H5 domain whitelists — the things that "only reproduce in production" — become debuggable on your machine. Heron signs a local certificate and the CA never leaves your Mac. Verified on iOS 26.5: Safari and the WeChat in-app WebView both work (Android not tested yet). The first time, iOS makes you flip one "Certificate Trust" switch by hand — the system won't let an app skip it, so Heron walks you through it.
See every request — and understand the broken ones
Requests from your phone are listed live: URL, headers, cookies, JSON. HTTPS decryption is opt-in, per domain you add. When a request fails or behaves strangely, Heron explains why and hands you a curl command to reproduce it. Logs stay on your machine.
A few things up front
- After installing the root certificate, iOS needs you to flip one "Certificate Trust" switch by hand (a system rule — Heron guides you step by step).
- Your phone and Mac have to reach each other on the network. Corporate Wi-Fi often gets in the way, and the setup flow plans for it: manual PAC when the phone sits on a different Wi-Fi name (AP isolation), or your Mac's Internet Sharing as a bridge when the network isolates clients — both field-verified.
- This is a developer debugging tool, not a VPN. It provides no nodes and no circumvention.
Privacy
No account, no analytics SDK, no uploading of your config or traffic logs. HTTPS decryption only applies to dev domains you explicitly add, and the certificate's private key never leaves your Mac. Domains you don't add are passed through untouched — Heron sees only encrypted bytes, never their contents. Logs stay on your Mac.
FAQ
Why not just use free tools like whistle?
whistle is great and we've used it. The difference: it needs a Node environment, manual proxy config and certificate install, and every step on the phone side is done by hand. Heron makes domain mapping, phone setup, certificates and the trust prompt one native flow — and when something fails, it tells you which step you're stuck on. If whistle already feels smooth to you, you may not need this.
How does it relate to Proxyman / Charles?
Those are full-featured capture proxies. Heron focuses on one loop — debugging your phone and WebViews against your Mac, and explaining requests — with the lowest-friction phone setup we could build. It does not (yet) do Map Local, Rewrite or Breakpoints; if you live in those, Heron isn't a replacement today.
Why a one-time purchase?
Debugging tools shouldn't be rented by the month. $29 early-bird; the price goes to $49 when 1.0 ships with Map Local and Breakpoints — early-bird buyers get every 1.x update free. Maintained throughout a major version, with big new features landing in the next paid major version. For reference: Charles is a $50 buyout, Proxyman Standard is $89, and Surge-class tools charge to keep updating (2026-07 prices).
My banking app says it detects a proxy — is my data exposed?
No. iOS exposes the Wi-Fi's proxy configuration to any app by design, so security-minded apps (banking, payments) check for it and warn — normal anti-tampering behavior. It only means "a proxy is configured," not that this app's traffic is being read. Heron's proxy rule is domain-scoped: only the dev domains you explicitly add for decryption pass through Heron; everything else (including your bank) goes direct, end-to-end encrypted, and Heron never sees the plaintext. To silence the warning, turn the proxy off on that Wi-Fi when you're done debugging, or run Heron against a separate test device.
Does it support Android?
Not tested yet, no promises. What's verified is iOS (Safari + WeChat in-app WebView).
When can I use it?
The core path is verified on real devices; v0.1 is in progress. Leave your email and you'll hear when the alpha is ready; early-bird buyers get priority.
Interested?
A refund-any-time guarantee comes with the paid release; for now we only collect email, no payment.