Scope 1.0.0 — Your traffic. Your rules.

Scope 1.0.0 · The first stable release.

Download: macOS (Apple Silicon) · Windows x64 · Linux x64

Getting started · MCP tools · Full gallery

Save the traffic, reproduce the failure, change the response. Scope 1.0.0 adds persistent traffic rules, an editable replay composer and richer saved sessions to the local Rust/Tauri HTTP(S) debugger. Capture history, editing, exports and MCP access are available without an account or a paid feature tier.

What changed

• Rewrite, mock and block. Save ordered rules for request/response edits, synthetic responses and blocking. Each request uses a consistent rule snapshot. Exchanges retain original messages, applied-rule evidence and explicit upstream/mock/blocked provenance.
• Compose a replay. Change the method, URL, repeated headers and body, then save the result as a new exchange. Current automatic rules apply; replay skips manual breakpoints. Replaying can change remote state and reuses stored credentials unless you change them.
• Keep useful sessions. Rename captures, add notes and normalized tags, pin sessions and delete finished work. Active captures and replays have deletion guards. Session metadata survives Scope archive export/import.
• See what completed. In-flight requests have an explicit state; analysis separates unfinished transfers from failures. Interrupted records are marked when an archive is reopened. A local activity journal keeps up to 10,000 metadata-only operation records.
• Diagnose Android setup. Read-only preflight reports authorization, root, ABI, Frida versions, mappings and retained recovery state before interception. Frida compatibility and network-stack coverage still depend on the device/app.
• Give an agent bounded access. Twelve stdio MCP tools cover shared-session inspection, analysis, comparison, observed OpenAPI 3.1 inference, edited replay, global rules and device diagnostics. Sessions, writes, global rules and diagnostics have separate controls, off by default and reset on restart.
• Choose a sharing format. Ordinary HAR/Scope exports retain raw traffic. A separate sanitized Scope export is explicitly lossy; inspect it before sharing. Redaction is best-effort and does not detect every application secret.

The gallery shows actual native traffic, rules, replay and analysis views. See the changelog and rule semantics for the details.

Persistent traffic rules	Editable request replay

Download and install

Use the assets attached to this release and check the downloaded file against SHA256SUMS.txt. The platform build manifests record the source commit and packaged assets; the source archive comes from the exact v1.0.0 tag.

Host	Asset	Verification boundary
macOS Apple Silicon	Download ZIP	Native UI and packaged-engine/MCP checks performed locally
Windows x64	Download installer	CI build and headless smoke; interactive installer, desktop and device behavior unverified
Linux x64	AppImage · Debian package	Experimental; CI build and headless smoke; interactive desktop/device behavior unverified; dependency advisory below

Source archive · SHA-256 checksums

On macOS, extract the ZIP and move Scope.app to Applications. This build has an ad-hoc signature, without Apple Developer signing or notarization. macOS may require explicit approval before opening it. No Intel macOS binary is supplied.

Click the lightning bolt beside New session for a local synthetic capture, or follow the getting-started guide. For HTTPS, trust Scope's public CA only in the intended test environment and keep its private signing key local.

Optional Android / Frida runtime

JavaScript hook profiles and setup helpers are included. Native Frida/Python workers and Android Frida servers are not bundled: their complete artifact-specific redistribution notice inventory has not been established. The optional helper installs pinned Frida 17.9.1 into a private user runtime from upstream and verifies the Android server's pinned archive checksum.

For an app installed in /Applications and an Android arm64 device:

python3 "/Applications/Scope.app/Contents/Resources/resources/device/install-runtime.py" --abi arm64-v8a

This requires Python 3.9+ with venv. For other ABIs, platforms and the exact installation paths, use the command shown in Scope or the Android guide. Installing the host runtime does not start interception or modify a device.

Upgrading from the alpha

1. Stop capture and replay. If Android interception is active, keep the device connected and use Stop; resolve any retained cleanup/recovery error.
2. Note the actual application data directory shown in Scope, then quit Scope.
3. Make a private backup of that whole directory, including any SQLite WAL files, CA files and device state. It contains raw traffic and private keys; keep it out of issues and public repositories. A sanitized export is lossy and is not a full backup.
4. Install 1.0.0 and reopen it. The database adds session metadata, traffic-rule storage and the activity journal automatically. Previous captures remain in the same archive; interrupted transfers receive an explicit error state.

In-place downgrade compatibility is not guaranteed. To return to an earlier version, quit Scope and use the corresponding pre-upgrade data-directory backup. MCP access must be enabled again after each restart.

Verification and limits

Release preparation passed 52 Rust workspace tests, 10 frontend interaction tests, three Node release/resource tests and three Python installer tests. Three-platform CI builds the packages and runs a real-process MCP/capture/persistence smoke. Local macOS checks exercised actual HTTP mocking, edited replay, session persistence and the packaged app's MCP bridge. Full records and the narrower historical Android coverage are in VERIFICATION.md.

• Bodies are buffered up to 16 MiB each. WebSocket frames, HTTP trailers, QUIC/HTTP3 and arbitrary TCP/UDP are not captured.
• Analysis and import/export load session records into memory. Long-running or very large sessions have not been validated.
• Observed OpenAPI output describes the captured sample, with bounded inferred schemas and no payload examples; it is not a complete API contract.
• Linux includes transitive glib 0.18.5 with RUSTSEC-2024-0429, an unsound VariantStrIter advisory tracked in #11. Its affected code has not been established as unreachable. Two unmaintained Rust dependencies also remain documented in DEPENDENCIES.md.

Report reproducible bugs with synthetic traffic using the issue templates. For sensitive findings, follow the security policy.

Scope 0.1.0 Alpha 1

Scope's first public alpha: a local desktop HTTP(S) debugger built with Rust, Tauri and React.

Included

• HTTP(S) capture with a generated local CA, saved SQLite sessions, HAR and Scope archive import/export.
• Request/response breakpoints, live editing, originals and replay as a new outbound request.
• Android app discovery with ADB, device-wide proxy mode, and selected-process Frida profiles.
• Local traffic analysis, session comparison and seven MCP tools with explicit session sharing and opt-in replay.

Install

Download Scope-v0.1.0-alpha.1-macOS-arm64.zip, verify it against SHA256SUMS.txt, extract it and move Scope.app to Applications. Apple Silicon is the tested release target. The app has an ad-hoc signature and is not Apple-notarized; follow the installation instructions if macOS blocks the first launch.

Proxy capture, sessions and MCP are included. Optional native Frida binaries are installed directly from upstream with the shipped helper; Python 3.9+ with venv is required for this step:

python3 "/Applications/Scope.app/Contents/Resources/resources/device/install-runtime.py" --abi arm64-v8a

Use the actual Android ABI and the command shown by Scope. This creates a private runtime; it does not modify system Python or an Android device. Android setup and compatibility.

Validation and limits

The release preparation includes 16 Rust tests, two packaging tests, three optional-installer tests, strict Clippy, native response editing/original inspection, rooted Android emulator capture/cleanup and an actual packaged MCP/capture/persistence smoke check. Recorded evidence.

This alpha buffers up to 16 MiB per request/response body. WebSocket frames, HTTP/3 and streaming capture are not implemented. Replay sends directly and does not trigger proxy breakpoints. Windows/Linux builds have CI coverage; their native UI/device workflows are not yet verified, so this release publishes the tested macOS artifact. Physical-device and long-session compatibility remain open work. An in-flight replay can temporarily appear as ERR before its actual response arrives (tracked display issue #16). Known dependency findings.

Source and community

The source ZIP is generated from this exact tag; checksums and a build manifest accompany the artifacts. Scope is AGPL-3.0-or-later and preserves HTTP Toolkit/Frida attribution and all included dependency/font notices.

Documentation · Four actual screenshots · Contributing · Roadmap