NetPeek User Manual

NetPeek is a local network capture & debugging tool. All traffic analysis happens on-device — nothing is uploaded. This manual is organized by core feature; tap a chip to jump, and the blue buttons open the matching feature directly.

1Capture

Capture is where everything starts: once on, the app takes over traffic through a local VPN tunnel and records every request/response for you to inspect.

1. On the home screen tap the big Start Capture button; the first time, allow the VPN configuration.
2. Use your other apps normally — requests appear live in the Recent Requests list.
3. Tap any row for Request Detail: URL, request/response headers, body, status code, timing and TLS info.
4. Tap the big button again to Stop Capture.

Swipe a row for shortcuts: copy as cURL, add filter, add MITM, New rewrite from this request, export HAR, favorite, delete.

2Decrypt HTTPS (install the certificate)

To read HTTPS content you must install and trust the CA certificate NetPeek generates on-device. You do this manually — iOS forces the step through Settings.

1. After starting capture, open the certificate page at http://127.0.0.1:8080 in a browser and download the profile.
2. Go to Settings → General → VPN & Device Management and install the profile.
3. Then Settings → General → About → Certificate Trust Settings and enable full trust for the NetPeek certificate.
4. Add the domains you want to decrypt to the MITM host list (section 9).

3Rewrite rules (Simple mode)

Rewriting changes traffic without changing code: add headers, replace response fields, mock APIs, block ads, redirect. A rule = a condition (when it applies) + an action (what to do). Beginners use Simple mode — a few taps.

1. Swipe a row in Recent Requests → "New rewrite" (host/path prefilled), or tap + in the rewrite list.
2. When it applies: pick "All requests" or add conditions (host contains / path begins with …).
3. What to do: pick one of six intent cards.
4. Set the details: fill fields per intent. A plain-language summary updates live; confirm and tap Save & Enable.

4Rewrite rules · Expert syntax (DSL)

Expert mode lets you write the rule statement directly for full power. The first symbol of an action (^ replace, ~ delete, or an @ whole-request verb) decides what; the following @req.*/@rsp.* decides where; quotes hold the value.

Condition objects

Comparison & logic

Compare: == != > < >= <= CONTAINS BEGINSWITH ENDSWITH LIKE (wildcards */?) MATCHES (regex, whole match) IN ANY/ALL/NONE. Logic: && (AND) || (OR) ! (NOT), group with ().

Actions

Cond:  @req.host CONTAINS "api.example.com" && @req.api BEGINSWITH "/feature"
Act 1: ^@req.header["X-Debug"] "1"
Act 2: ^@rsp.bodyText "\"enabled\":false" "\"enabled\":true"

5Scripts

When rules aren't enough, use JavaScript to handle matched requests more flexibly: read/rewrite request & response, gunzip bodies, compute values conditionally. Scripts are scoped by host and run in the tunnel, like rules.

1. Tap + in the script list, set a name and scope (host).
2. Write your logic in the editor (helpers like $utils provide gzip/gunzip etc.).
3. Save & enable, then re-send the request to see the effect.

6Replay

Save a captured request, tweak parameters and send it again — handy for API iteration and reproducing issues. One-tap create from Request Detail.

1. Choose "Add to Replay" from the detail/swipe menu, or tap + in the replay list.
2. Edit method, URL, headers, body; optionally schedule or loop.
3. Send and inspect the response; past results are kept.

7Constants

Store frequently-used values (a mock JSON, a token, a test URL) as constants and reference them in rules with ${constantId} — change one place, update everywhere.

8Filters (see only what matters)

The capture list gets long. Filters cut the noise:

• Record only certain hosts: everything else stays out of the list.
• Ignore certain hosts: exclude them from the list.
• Swipe a row → "Add filter / Record this host" to add quickly.

9MITM host list

For performance and stability, NetPeek only decrypts (MITM) the domains you specify; the rest pass through transparently. The list supports wildcards:

• +host / a bare host = decrypt that host; * = decrypt everything.
• -*host* = explicitly do not decrypt (blacklist, higher priority than wildcards).
• Swipe a row → "Add MITM / Add MITM blacklist" to maintain it quickly.

10Toolbox

Open Settings → Toolbox for encoding, hashing, encryption helpers, timestamps, UUIDs, JSON formatting, and more. Use the regex tool to validate match patterns before you write rewrite rules.

11MCP service

To let a desktop AI client help analyze captures on this phone, turn on NetPeek MCP. Find it under Settings → NetPeek MCP (off by default).

1. Enable the service and copy the access token.
2. On a computer on the same network (or over USB), enter the service address and token in your AI client.
3. Once connected, you can browse captures, inspect requests, and import rules when needed.

12Sharing & importing rules

Share rewrite rules with teammates, or import rules someone sent you. Sign in before sharing or importing.

Share rules

1. Open Rewrite Rules, select the rules, then choose Share.
2. Enter a title, set how many times it can be imported, and how many days it stays valid.
3. Confirm, then copy the share command (or use the system share sheet) and send it.

Import rules

1. Copy the share command or link you received.
2. Open NetPeek — if a share is detected on the clipboard, you’ll be prompted to review and import it.
3. Or open Rewrite Rules → Import Share Code, paste the code, review, then redeem.

Manage & update

• From Rewrite Rules → more menu, open Manage shares to copy the command, view it, or revoke a share.
• After revoke, new imports fail; rules already imported are not removed automatically.
• After you edit and save rules, you can Push update on an existing share. Recipients who see Update available can tap Get update.

13Privacy & safety

• Captured traffic stays on your device by default and isn’t uploaded for analysis.
• HTTPS decryption requires you to install and trust the certificate in iOS Settings.
• Private rules are shared for use only, limiting who can read or redistribute their contents.
• Only capture and modify traffic in environments you’re authorized to debug.