WebSocket

Probe handles WebSocket traffic two ways: it captures the frames of any WebSocket that flows through the proxy (so you can inspect a real app's realtime traffic), and it gives you a client tab to open your own connection and send messages by hand.

Frame capture (Messages tab)

When a captured request is a WebSocket upgrade — a GET with Upgrade: websocket — its detail panel grows an extra Messages tab alongside Request / Response. The tab shows every frame Probe observed on that connection, in order:

• a direction arrow — out (client → server) or in (server → client),
• the opcode — TEXT, BINARY, PING, PONG, or CLOSE,
• the payload preview (text frames verbatim; binary frames as base64),
• the size and time, plus a truncated badge when the payload was clipped.

Capture is observe-only — Probe never rewrites WebSocket frames. Frames are held in a bounded in-memory buffer (500 frames or 2 MB per connection, 100 connections, 64 KB per frame preview), so a long-lived or chatty socket keeps only its most recent frames, and old connections are eventually evicted. If you open the Messages tab for a WebSocket that was never actually intercepted (for example, the connection predates the proxy start), the tab says so rather than showing an empty list.

Note

Frame capture needs the WebSocket to go through Probe as normal MITM traffic — the device must trust Probe's CA and route through the proxy, exactly like HTTPS interception. See HTTPS Interception.

WebSocket client tab

The + button in the tab bar has a New WebSocket entry. It opens a client tab where you drive a connection yourself:

1. Type a ws:// or wss:// URL and add any custom request headers (for example an Authorization header).
2. Press Connect. The status dot turns green when the socket is open.
3. Type a message and press Send (or Enter). Sent and received messages stream into the log, newest at the bottom.
4. Press Disconnect to close the socket; closing the tab tears it down.

Capture through proxy

The client tab has a Capture through proxy toggle (on by default). When it's on and the proxy is running, the client's socket is routed through Probe itself — so the connection also shows up as captured traffic, with its own Messages tab. Turn it off to connect directly, bypassing capture. Each tab is an independent session, so you can keep several connections open at once.

Automation

WebSocket capture is also exposed to AI tooling over the REST API and MCP:

• GET /api/v1/websocket/connections / probe_ws_list_connections — list captured connections.
• GET /api/v1/websocket/connections/{id}/frames / probe_ws_get_frames — the frame log for one connection.

There is no connect endpoint — the client tab lives only in the app; the automation surface is read-only capture.

See also

• HTTPS Interception — the trust + routing setup capture depends on.
• REST API · MCP Tools