RockxyApp/Tracexy

A native, session-first Wireshark alternative for macOS.

Native macOS network intelligence, organized around sessions—not packet noise.
Capture live traffic or open a saved capture, then investigate hosts, processes, protocols, timing, and raw packet evidence in one local-first workspace.

_{The AGPL-licensed public source edition of Tracexy for macOS.}

v0.9.1 — 2026-10-08

• When live capture has no sessions, show guidance for specialized Wi-Fi interfaces and active capture filters.

See CHANGELOG.md for the full release history.

Tracexy is an open-source network intelligence app built specifically for macOS. It captures traffic passively and turns frames into explainable sessions and correlated activities: which process contacted which host, which protocols appeared, how much data moved, and what evidence supports the grouping.

The main experience is session-first. Raw protocol fields and hex remain one click away when the bytes are the answer, but they do not dominate the workspace.

Tracexy is part of the Rockxy ecosystem, a family of native, local-first tools for understanding and controlling software and network behavior. The products have distinct jobs and separate repositories, while sharing a focus on transparent evidence, explicit data boundaries, and native platform experiences:

• Rockxy — intercept, inspect, and modify HTTP, HTTPS, WebSocket, GraphQL, and other application traffic.
• Tracexy — passively capture network traffic and organize it into explainable sessions, protocol observations, and evidence-linked investigation workflows.
• Shieldxy — application-aware network security, connection control, and policy-oriented visibility.

Tracexy complements the ecosystem rather than replacing any one tool: the application-level debugger focuses on traffic control, while Tracexy focuses on passive network intelligence across interfaces, processes, protocols, and session relationships.

From live capture to explainable sessions and packet-level evidence.

Choose the interface and start from the traffic surface that matters.

Control capture scope, filters, packet detail, and retention before traffic leaves the wire.

Inspect decoded protocol fields alongside the raw bytes that support them.

• Sessions before packets. Bidirectional traffic is grouped by canonical five-tuple so one conversation stays together.
• Explainable correlation. Related DNS, TCP, TLS, and HTTP observations can be grouped into an activity with visible confidence and contested-attribution states.
• Native investigation workflow. The app uses SwiftUI and AppKit for a real macOS sidebar, table, toolbar, split views, inspectors, menus, keyboard behavior, and SF Symbols.
• Isolated Projects. Keep separate investigations with their own workspaces, saved captures, History, filters, and capture and privacy settings.
• Evidence stays available. Summaries lead to decoded layers, field ranges, and raw hex without leaving the selected session.
• Honest unknowns. Missing process, hostname, protocol, or timing evidence is shown as unknown; Tracexy does not manufacture telemetry.
• Local-first by design. Captured frames and derived session data stay on the Mac unless the user explicitly exports a capture.

Tracexy is not a Wireshark clone or a TLS interception proxy. It is strongest when a Mac investigation needs app-aware sessions, local packet evidence, and a support-ready handoff without claiming decrypted HTTPS visibility. The full maintained matrix is in docs/comparison.md.

Application-layer decoding is intentionally metadata-focused in the current implementation. The always-on fold recovers only bounded initial TLS/HTTP/DNS metadata; an explicit Follow Stream action can rescan a stable saved or stopped source without turning the capture path into an unbounded stream store.

See the source-grounded protocol matrix for exact field coverage.

These are deliberate statements of present capability, not hidden roadmap promises:

• No TLS or QUIC decryption.
• No general always-on TCP reassembly or typed record-analyzer framework; connection evidence and explicit bounded Follow Stream are narrower mechanisms.
• No deep HTTP/2, HTTP/3, or WebSocket decoder.
• History persists terminal capture/session summaries, not a raw-packet capture database.
• Findings are selected evidence-linked local observations, not a comprehensive durable security engine.
• A free, read-only MCP stdio executable exposes four bounded History tools (captures, sessions, findings) for one explicitly granted Project; it opens no listener and exposes no capture control or raw frames.
• The in-app AI Assistant sends a reviewed, bounded selected-session brief only to a validated local model endpoint. Remote/BYOK providers are not implemented in this Community checkout.
• Protected .tracexysession export enforces payload/metadata protections; raw pcap/pcapng stays byte-preserving. History retention is boundary-triggered rather than a periodic background scheduler.

Network captures can contain credentials, private hostnames, personal messages, and application payloads. Tracexy treats them as sensitive by default.

• Captured traffic and derived sessions remain local; Tracexy does not upload capture payloads.
• Live capture starts when the user presses Start. If the user explicitly enables Auto-start capture on launch, that preference starts capture when the app opens.
• Opening .pcap or .pcapng files does not require the privileged helper or administrator access.
• Raw pcap/pcapng export preserves captured bytes and requires acknowledgement while protections are enabled. Protected .tracexysession export omits raw frames and sensitive decoded metadata according to the selected Privacy settings.
• Live capture crosses a narrow, typed XPC boundary with code-signing checks around the privileged helper.
• Signed update checks are separate from capture data and never include captured traffic.

Read Privacy & security for the full trust model. Report vulnerabilities privately through SECURITY.md, not a public issue.

• macOS 14 or later
• Xcode 16 or later
• An Apple Developer Team for code-signing the app and helper

SwiftLint and SwiftFormat are optional for building, but required for contribution checks.

git clone https://github.com/RockxyApp/Tracexy.git
cd Tracexy
cp Configuration/Developer.xcconfig.template Configuration/Developer.xcconfig
open Tracexy.xcodeproj

Set your own Team ID in Configuration/Developer.xcconfig:

TRACEXY_TEAM_ID = YOUR_TEAM_ID_HERE
CODE_SIGN_IDENTITY = Apple Development
DEVELOPMENT_TEAM = $(TRACEXY_TEAM_ID)

Developer.xcconfig is gitignored. Never commit your signing identity, certificates, provisioning profiles, packet captures, or exported sessions.

Opening a saved capture is the quickest zero-helper path through the decode and session pipeline. Live capture additionally requires one-time approval for the privileged helper in System Settings.

# Build
xcodebuild -project Tracexy.xcodeproj -scheme Tracexy -destination 'platform=macOS' build

# Full app and UI test suite
xcodebuild -project Tracexy.xcodeproj -scheme Tracexy -destination 'platform=macOS' test

# Non-mutating style checks
swiftformat --lint .
swiftlint lint --strict

Changes to TracexyCaptureHelper/ or the shared XPC protocol require uninstalling, rebuilding, and reinstalling the helper; rebuilding the app alone does not hot-reload the privileged service.

Detailed setup and troubleshooting live in Getting started.

Capture  →  Protocol  →  Session  →  Workspace

The privileged helper exposes typed capture operations rather than arbitrary shell or file access. Capture files and packet bytes are untrusted input: decoders return partial results or controlled errors instead of reading beyond available data.

See Architecture for the repository map, current seams, and known transitional debt.

Bug reports, tests, documentation fixes, protocol fixtures, and focused pull requests are welcome. Please read CONTRIBUTING.md before submitting a change.

For decoder work, include normal, truncated, and malformed-input coverage. Captures attached to an issue must be reviewed and redacted first.

The source in this repository is licensed under the GNU Affero General Public License, version 3 or later (AGPL-3.0-or-later). AGPL is a strong copyleft license: you may run, study, modify, and redistribute Tracexy, including commercially, as long as you follow its conditions.

In practical terms, redistributed modified versions must keep the license and required notices, identify meaningful changes, and provide the corresponding source under AGPL terms. If a modified version offers network interaction, AGPL section 13 also requires users who interact with it over the network to be offered access to the corresponding source. The full legal terms, including the no-warranty provisions, are in LICENSE.

A build made solely from this repository is therefore an AGPL build. AGPL does not grant rights to the Tracexy name, logo, or other trademarks.

Rockxy LLC may offer Tracexy, official binaries, support, enterprise rights, hosted services, private distribution rights, or downstream distributions under separate commercial terms. See the Commercial Licensing Policy and the draft Binary EULA.

A commercial license applies only when Rockxy LLC grants it in writing or when an official distribution presents the applicable agreement. Owning or using a commercially licensed copy does not cancel the AGPL rights you have for a separate copy of the public source edition.

External contributions are accepted under the Tracexy Individual Contributor License Agreement so accepted changes can remain available in the public AGPL edition and also be used in separately licensed Tracexy distributions. Organization-owned contributions require the Corporate Contributor License Agreement.

AGPL does not grant rights to use the Tracexy or Rockxy LLC names, logos, icons, domains, trade dress, or other trademarks to identify a modified or redistributed product, except for truthful nominative reference permitted by law.

Tracexy may link to third-party libraries and Apple system components, including the Sparkle update framework. Those components are not relicensed by this repository and remain subject to their own license terms and notices. Before distributing a build, review the licenses bundled by Xcode and the dependency metadata in Package.resolved.