Map Remote

Map Remote rewrites the destination of a matching request. Unlike Map Local, the request is still sent over the network — just to a different origin. The response comes back from the rewritten target and is delivered to the client over the MITM-terminated TLS session, so nothing changes from the client's point of view except where the bytes really came from.

Typical uses:

Point a mobile build that has api.production.com hardcoded at api.staging.com.
Swap a CDN for its real origin to bypass caching during development.
Send phone traffic to a server running on your laptop (localhost:3000).
Try a v2 endpoint without rebuilding the app: redirect /api/v1/foo/* to /api/v2/foo/*.

Map Remote manager showing one rule with source URL → destination URL

How a rule matches

A Map Remote rule has a source (what to match) and a destination (where to send it instead). A request matches when:

the method matches (or Match all methods is on),
the scheme + host + port match, and
the path matches the source path pattern, where each * captures any substring (including /), anchored at both ends.

Probe strips the MITM-injected default port (:443 for HTTPS, :80 for HTTP) before matching, so you can write source patterns without thinking about it: https://api.example.com and https://api.example.com:443 are equivalent. To match a non-default port, put it in the source Port field — the Host field takes the bare host, so api.example.com:8443 typed there never matches. Leave Port empty for the scheme's default; the editor won't save a port outside 1–65535 and says so.

Rules are evaluated in the order they appear in the manager. The first enabled rule that matches wins, so put more specific rules above broader ones.

Wildcard substitution

Wildcards in source path are captured in order. Each * in destination path is filled with the next capture, also in order:

Source:      /users/*
Destination: /v2/users/*
Request:     /users/42        →  /v2/users/42

Source:      /api/*/*
Destination: /*/*
Request:     /api/v2/users    →  /v2/users

Source:      /health
Destination: /status
Request:     /health          →  /status   (no wildcards — verbatim)

Query strings and fragments on the original request are preserved unchanged.

Worked example: production → staging

Your iOS build is wired to api.production.com and you want to test it against staging without rebuilding.

Source: https://api.production.com/v1/*
Destination: https://staging.example.com/v1/*
Method: Match all methods

Save and enable. Every call the app makes under /v1/ now hits staging; the response gets returned to the device as if it came from production. Flip the rule off to go back.

The Host header

Probe rewrites the Host header to match the destination — that's what most servers expect. Earlier versions showed a Preserve original Host header option for reverse proxies and API gateways that route by the client's original hostname, but it never took effect: the forwarded request always carried the destination host. The option is hidden until it works. Rules saved with it keep the setting, and the REST API and MCP tools still accept preserve_original_host_header, but it currently changes nothing.

How to tell a rule fired

When a request is redirected, the detail panel shows a banner at the top:

Request redirected: <original URL> → <rewritten URL>

The log row keeps the original URL the client asked for — the rewrite is a property of the rule, not of the request. Click the banner to jump back to the rule that fired so you can edit or disable it.

Map Remote vs Map Local

	Map Remote	Map Local
Hits the origin?	Yes — a different one	No
Body comes from?	The rewritten upstream	Inline editor or local file
Status / headers	The rewritten upstream sets them	You set them
Use case	Point at staging, swap CDN for origin, send to localhost	Mocks, error injection, offline dev

If you want a real response from a different server, use Map Remote. If you want to fake a response entirely, use Map Local.

Map Local — serve a canned response instead of rewriting the URL.
Breakpoints — pause one request and edit its URL by hand.
Scripting — rewrite URLs conditionally with code.
HTTPS Interception — why the rewritten request still works under TLS.