Quick Tour

This is the speed-run. Open Probe alongside this page — the goal is to know where everything lives in about a minute.

The three-column layout

The whole app is one window divided into three resizable columns:

Drag the column dividers to resize. Your widths last until you quit: each launch starts with a 260 px sidebar and an 820 px log table (narrower in a small window, but never under 750 px).

Sidebar (left)

The sidebar is a vertical stack of sections you can collapse and expand:

• Navigation — top of the sidebar.
  • All with a domain tree underneath. Subdomains group under their root domain (api.example.com lives under example.com). Right-click any node to watch or ignore it.
  • Apps — one row per local app that sent traffic through Probe (Chrome, Safari, curl, node…), with its icon and request count. Click a row to narrow the log table to that app; expand it to see that app's domains. Right-click a row for Filter by this app (hidden while that app is already the filter), Show only this app, Hide this app (adds it to the ignored clients), Copy app name and Show in Finder (only when Probe knows where the app lives).
  • Devices — phones, tablets, and other LAN clients, shown by IP address. Traffic from an app in the iOS Simulator also gets a device row, labelled with the simulator's name (for example iPhone 17 Pro), rather than an entry under Apps. The first time it happens Probe shows a one-time banner pointing at DEVICES.
  • Favorites — requests you've starred. Click it to open them all in a tab.
  • Ignored — domains you've hidden, with an Ignore Domain button to add a new one by name.
• Saved — folders you copy captured requests into (right-click a row and choose Save to Folder, or select several rows and choose Save N to Saved Folder). Click a folder to browse what's in it.

Filtered Lists aren't in the sidebar; you toggle them from the filter bar above the log table.

Log table (center)

The middle column is the live list of captured requests. It has three controls above the table:

• Search box — substring match against URLs in real time.
• View mode toggle — switches between Sequence (flat chronological list) and Structure (tree grouped by domain and path).
• Session tabs — browser-style tabs at the top. One tab is always the recording tab; saved tabs are read-only and don't accept new traffic. A * indicator means unsaved changes.

Right-click any row for quick actions: add or remove the request from Favorites, ignore its domain, copy as cURL, replay in Composer, create a Map Local rule, or attach a breakpoint or throttle rule.

Detail panel (right)

When you click a row, the right column fills in. It has:

• A method badge (GET, POST, etc.) and the full URL — selectable text so you can copy fragments.
• A star toggle to save the request to Favorites.
• Three tabs: Request, Response, and Summary.

The Summary tab is worth a second look — it has collapsible sections for overview, timing (request start and end, response start and end, latency, download time, response speed, total duration), size (request and response headers, request and response bodies, total), and connection (scheme, host, port, resolved remote address, and the client). Probe doesn't break a request into DNS, connect and TLS phases. A caching section appears too when the response carries caching headers.

The detail panel has its own search bar that highlights matches across headers, params, and body, with next/prev navigation between hits.

The toolbar

The toolbar runs along the top of the window. It's split into a left cluster and a right cluster.

macOS

Left side (window title area):

• App name and version
• Start / Stop — toggles the proxy. Stopping also turns off the system proxy Probe turned on.
• Clear — empties the log table for the current session.
• Status card — shows IP:port and CA URL.
• Certificate shield — quick access to the CA download landing page.

Right side:

• Throttle (icon-only) — bandwidth and latency simulation.
• Watched Domains (eye icon) — manage Domain Watch list.
• Scripting — open the script rules window.
• Breakpoints — open the breakpoint rules window.
• Import — load a session, Postman collection, or HAR file.
• Settings (gear) — preferences, theme, locale, default view.

Windows

Left side:

• App name and version
• Start / Stop — toggles the proxy. Stopping also turns off the WinINET proxy Probe turned on.
• Clear — empties the log table for the current session.
• Status card — shows IP:port and CA URL.
• Certificate shield — quick access to the CA download landing page.

Right side:

• Throttle (icon-only) — bandwidth and latency simulation.
• Watched Domains (eye icon) — manage Domain Watch list.
• Scripting — open the script rules window.
• Breakpoints — open the breakpoint rules window.
• Import — load a session, Postman collection, or HAR file.
• Settings (gear) — preferences, theme, locale, default view.

The Windows toolbar lives below the standard Windows title bar; on macOS it merges with the traffic-light controls.

Sequence vs Structure

The view-mode toggle in the log table changes how requests are grouped:

• Sequence is a flat chronological list, newest first. New rows appear at the top. This is the right view when you're watching live traffic and want to see exactly what fired and in what order.
• Structure groups requests into a tree by domain, then path. https://api.example.com/v1/users and https://api.example.com/v1/orders both nest under api.example.com → v1. Counts next to each node show how many requests matched.

Switch any time without losing data — both modes show the same underlying log.

The Compose tab

The three icons at the top of the sidebar (hover for Traffic, API Client and Files) switch the window between modes:

• Traffic is what you've been looking at — the live log and detail panel.
• API Client is the Composer, the request builder. Each open request is a tab along the top, and the collections are in the sidebar; each request has method, URL, params, headers, body, auth, and a script. Hit Send and the response appears next to the request, just like a normal HTTP client.

While the proxy is running, Composer requests go through the same proxy core as captured traffic, so anything you set up for inspection (Domain Watch, breakpoints, throttle rules) applies to them too.

Probe Console

A command-line panel docked to the bottom of the window (macOS only for now) — type commands instead of clicking through the UI. Toggle it from the Probe Console control at the bottom-right of the status bar, or Cmd+Shift+C on macOS; Super Search's Open Console action does the same thing.

Type help to see what's available. Commands cover firing ad-hoc HTTP requests (get, post, put, …), inspecting the last captured entry (last, headers, body, timing, curl), filtering the log table (status, domain, method, find), domain management (watch, ignore, fav, domains), environment variables (env, set, unset), sessions (save, load, sessions), and proxy control (start, stop, stats, clear). Output supports shell-style piping, e.g. domain api.example.com | grep users | count, for chaining filters without leaving the keyboard.

Keyboard shortcuts

The handful you'll use daily on macOS:

Action	macOS
Save current session	Cmd+S
Open Settings	Cmd+,
Watched Domains manager	Cmd+Shift+D
Manage Environments	Cmd+Shift+E
Toggle Probe Console	Cmd+Shift+C
Toggle fullscreen	Ctrl+Cmd+F
Super Search palette	Cmd+F

On Windows the menu bar uses the same shortcuts with Ctrl in place of Cmd (Super Search and full screen aside); tabs switch with Ctrl+Tab and Ctrl+Shift+Tab.

A complete list lives under Keyboard Shortcuts.

What to learn next

You now know where every section of the app lives. The pages below dive into individual features in order of how often you'll reach for them.

First CaptureWalk through capturing a real request end to end.

Certificate SetupTrust the CA so HTTPS bodies are readable.

Sequence vs StructureWhen each view mode helps and how the tree groups.

ComposerBuild, save, and replay requests from scratch.