We’re releasing Prism, a native macOS HTTP proxy that observes your network traffic and surfaces privacy concerns — trackers, fingerprinting, unencrypted data, and suspicious connection patterns — without decrypting your HTTPS traffic.

The gap it fills

Tapped shows you where your Mac is talking at the packet level. But it doesn’t interpret what it sees — it’s a visibility tool for people who already know what to look for. On the other end, browser extensions like uBlock Origin block ads in one browser but can’t see traffic from the dozens of other apps on your Mac.

Prism sits in the middle. It’s an application-layer proxy that watches HTTP and HTTPS traffic from every app on your system, analyzes it against known tracker databases, and tells you in plain language what it found and what you can do about it. No packet capture expertise required. No browser lock-in.

How it works

Prism runs as a local HTTP proxy on port 9080. When you enable the system proxy toggle, all HTTP traffic on your Mac routes through it. For each request, Prism records the method, host, path, headers, status code, and byte volume. For HTTPS CONNECT tunnels, it records the hostname and byte count — the content stays encrypted.

Every two seconds, a privacy analyzer scans the traffic window for:

  • Known trackers — domains matching established tracker databases (Google Analytics, Facebook Pixel, DoubleClick, and dozens more)
  • Unencrypted traffic — HTTP requests that should probably be HTTPS
  • Fingerprinting headers — browser fingerprinting signals like Canvas, WebGL, and AudioContext headers
  • Tracking beacons — small, frequent requests with beacon-shaped URL patterns
  • Excessive connections — domains receiving suspiciously many requests per hour

Each concern includes an explanation and a recommendation. Hourly summaries accumulate automatically, and you can export the raw traffic table to CSV at any time.

Built for stability

An always-on proxy that breaks your network is worse than no proxy at all. This was the hardest engineering problem in Prism, and we took it seriously:

  • CONNECT tunnels have a 120-second idle timeout (adaptive under load) so long-lived HTTP/2 and WebSocket connections don’t leak file descriptors indefinitely
  • A health watchdog probes the proxy every 10 seconds and automatically disables the system proxy if it stops responding
  • Quitting the app always cleans up the system proxy — and stale configurations from crashes are repaired on next launch
  • Connection count is capped at 2,000 with graduated pressure relief to survive traffic spikes

Completed requests drain to a local SQLite database every 30 seconds with a domain catalog that tracks first-seen timestamps — the foundation for future “new domain” alerts.

Why application-layer observation

Packet capture (what Tapped does) sees everything but requires expertise to interpret. DNS monitoring catches lookups but misses the actual traffic. Browser extensions see one app’s requests but are blind to the rest. A proxy sees the application layer — the actual HTTP requests your apps are making — and can analyze them with full context: headers, paths, methods, response codes.

The tradeoff is that Prism only sees traffic that respects the system proxy setting. Some CLI tools and apps with hardcoded DNS bypass it. We’re honest about this in the UI — Prism shows you what fraction of your traffic it likely sees, and the PAC file serving planned for a future release will improve coverage.

Prism doesn’t block anything. Like Tapped, Vigil, and Harden, it’s an observation tool first. You see what’s happening, understand the implications, and decide what to do. Domain blocking is on the roadmap as an opt-in feature, but Prism’s identity is awareness, not ad-blocking.