• Using single frontend for electron and binary.
• Apple Developer Signed Binaries
• ZoomSlider, App loading improvements and other misc fixes

Thanks to @Behi_Sec and @Sharo_k_h for suggesting UX improvements and reporting bug.

Includes v0.28.0 and v0.27.1

v0.28.0 - Frontend Updates

• Frontend: Convert to POST / GET — Convert requests between POST and GET, moving params between body and query string. @Behi_Sec
• Frontend: Duplicate tab — Duplicate the active data tab including all persisted filters. @Behi_Sec
• Frontend: Decoder panel stay minimized — Decoder panel stays minimized after user manually minimize it. @Behi_Sec
• Frontend: Toggle sidebar — Show/hide the sidebar. @Behi_Sec
• Frontend: Custom tab names — Ability to name tabs. @Behi_Sec
• Frontend: Open in new tab — Open a request in a new tab from proxy or data tabs. @Behi_Sec
• Frontend: Auto-remove headers — Filter to auto-hide unnecessary headers. @Behi_Sec
• Frontend: Search bar — Unified search icon for general search in Data tab. @Behi_Sec
• Frontend: New request popup — A button to create a new request.
• Frontend: Send request shortcut — Shortcut to send the request
• Intercepted landing page — Browser now opens a custom intercepted.html page (served via file://) instead of grroxy.com. So we don't capture unwanted traffic.
• /api/request/parse endpoint — Parse raw HTTP request/response into structured breakdown (method, path, query, headers, body). Uses existing rawhttp.ParseRequest and rawhttp.ParseResponse.
• Frontend: Filter AddNew and Edit Popup — Add, edit filters from UI.
• Frontend: Proxy page — Improved UI
• Frontend: Cmd+Enter to send — Keyboard shortcut to send requests.

Fixed

• Proxy Timeout — There waas a 60sec timeout for intercepting the request. @Sharo_k_h
• Proxy Pastebin — Proxy pastebin was not working. @Sharo_k_h
• Frontend: Repeater sort — Fixed repeater index sorting bug. @Sharo_k_h
• Frontend: Proxy pastebin — Fixed proxy pastebin not working. @Sharo_k_h
• Frontend: Long filter view — Fixed broken view when filter is long. @Behi_Sec
• Frontend: Title bar tooltips — Tooltips in title bar were positioned at top-left corner.
• Intercept counter not updating on toggle off — Per-proxy intercept counter now resets to 0 immediately when intercept is disabled.

[2026-MAR] - v0.27.1 - MCP Fixes, Proxy Endpoints & HTTP/2 Parsing

Added

• Proxy HTTP endpoints — /api/proxy/typetext, /api/proxy/waitforselector, /api/proxy/evaluate for browser automation via API.
• MCP tools — listHosts, getHostInfo, getNoteForHost, setNoteForHost, modifyHostLabels, modifyHostNotes, interceptToggle, interceptPrintRowsInDetails, interceptGetRawRequestAndResponse, interceptAction, proxyList, proxyStart, proxyStop, proxyScreenshot, proxyClick, proxyElements, proxyType, proxyEval, proxyWaitForSelector, proxyListTabs, proxyOpenTab, proxyNavigateTab, proxyActivateTab, proxyCloseTab, proxyReloadTab, proxyGoBack, proxyGoForward.
• Frontend: AI tools — proxyTypeText, proxyWaitForSelector, proxyEvaluate tool definitions and handlers in AI tools panel.
• Frontend: backend API methods — proxyTypeText, proxyWaitForSelector, proxyEvaluate in backend_app.ts.
• Frontend: MCP tools sorted alphabetically in HudTerminal.
• Frontend: CWD File Explorer — VSCode-style file/folder explorer for browsing, opening, and previewing files from the current working directory.
• File watcher — fsnotify-based file watcher for CWD explorer live updates.
• Chrome GetElements improved — Added input/textarea/select to interactive element selectors; unique CSS selector paths using nth-of-type.

Changed

• proxyStart MCP tool — Removed browser and http options; hardcoded to Chrome with auto-assigned HTTP port.

Fixed

• MCP interceptToggle not intercepting — dao.SaveRecord() doesn't trigger OnRecordAfterUpdateRequest hooks; now sets inst.Proxy.Intercept directly in memory.
• Edited request parsing: HTTP/2 rejected — http.ReadRequest requires major.minor format; normalizes HTTP/2 → HTTP/2.0.
• Edited request parsing: unexpected EOF — Detects linebreak style (\r\n vs \n) and ensures request ends with double linebreak.

⚠️ Important Fix - Action Required

[BUG][FIXED] Electron left orphan processes on quit — Closing the app now kills the entire process group (grroxy, grroxy-app, grroxy-tool) instead of only the parent. Uses detached: true spawn + process.kill(-pid) for group termination.

Required Actions: Quit grroxy and run below command to kill the orphan processes

# mac/linux
pkill -f 'grroxy-(app|tool)'

# windows
taskkill /F /IM grroxy-app.exe & taskkill /F /IM grroxy-tool.exe

Added

MCP Server

• Built-in MCP server using mcp-go with SSE transport for AI tool integration
• Tools: version, getRequestResponseFromID, hostPrintSitemap, hostPrintRowsInDetails, sendRequest
• Endpoints: /mcp/start, /mcp/stop, /mcp/health, /mcp/listtools, /mcp/sse, /mcp/message, /mcp/setup/claude
• Claude Code integration — /mcp/setup/claude writes .mcp.json + CLAUDE.md automatically

Terminal

• Xterm scrollback replay — reconnecting clients receive up to 256KB of buffered output on reload
• Multi-client sessions — up to 10 concurrent WebSocket viewers per terminal session
• Persistent PTY reader — single goroutine per session broadcasts to all clients

Other

• Dev UI — SvelteKit app (grx/dev) for interactive API testing #36
• Updated Electron build script (cmd/electron/build.sh, package.json)

Fixed

• Proxy timeouts → 10 min — prevents connection failures when requests are held for manual review
• Stale WebSocket cleanup — all clients closed when a terminal session ends, no more hanging goroutines
• Scrollback buffer compaction — in-place copy() prevents unbounded array growth
• Client cap per session — max 10 concurrent WebSocket connections to prevent resource exhaustion

fixed fuzzer and embeded cook in the electron binary

Desktop App

A cybersecurity toolkit blending manual testing with AI agents.

Check out!! https://grroxy.com/

Repository Rename: grroxy-db → grroxy

Changed

• Repository renamed from github.com/glitchedgitz/grroxy-db to github.com/glitchedgitz/grroxy
• Go module path updated — All imports changed from github.com/glitchedgitz/grroxy-db/... to github.com/glitchedgitz/grroxy/...
• Self-update URL updated — GitHub releases API URL now points to the new repo
• Version bumped to v0.26.0

Migration (for users)

• The old GitHub URL (github.com/glitchedgitz/grroxy-db) will redirect to the new one
• Update your git remote: git remote set-url origin git@github.com:glitchedgitz/grroxy.git
• If using go get: go get github.com/glitchedgitz/grroxy@latest

WebSocket Proxying & Capture

• Full WebSocket proxying support through /rawproxy with MITM capabilities
• _websockets collection for storing captured WebSocket messages
• WebSocket frame parsing and capture (text, binary, close, ping, pong frames)
• Bidirectional message tracking with direction indicators (send/recv)
• Message indexing and correlation with HTTP upgrade requests via proxy_id
• Support for both ws:// (plain) and wss:// (TLS) WebSocket connections
• WebSocket message handler callback (OnWebSocketMessageHandler)
• File-based WebSocket message logging with metadata
• Automatic HTTP/1.1 enforcement for WebSocket upgrades (prevents HTTP/2 conflicts)

[2026-JAN] - v0.21.0 - Browser Automation & Data Extraction

Added

• Browser Automation via Chrome DevTools Protocol (605f41d)

  • /api/proxy/screenshot - Capture screenshots (full-page or viewport, optional file save)
  • /api/proxy/click - Click elements using CSS selectors
  • /api/proxy/elements - Get clickable elements from current page

• Data Extraction (5c87dbb)

  • /api/extract - Extract fields from database records by host (supports req.*, resp.*, req_edited.*, resp_edited.*)

• Request Modification (386148b, fc66654)

  • /api/request/modify - Modify HTTP requests (set, delete, replace operations)
  • Wildcard header deletion support (fc66654)

• System Info (5c87dbb)

  • /api/info - Get version, directories, and project info

Changed

• Enhanced proxy instances with Chrome browser integration (605f41d)
• Improved request parsing and rebuilding (386148b)

Fixed

• Content-Length header handling (843820b)
• HTTP/1.1 protocol improvements (797e28b)
• TLS browser connection issues (504d8c7)
• InsecureSkipVerify for testing (7b43171)
• Zstd decoder support (2a691f0)