ValetFS vs HTTPGlass

Agents that read a repository issue, a web page or a tool description have been talked into reading credentials out loud. The key was never the target — the file it sat in was. A key written into a dotfile, an environment variable or a CI runner is readable by everything on that machine, forever, long after the job is done. ValetFS is the other way round. Your secrets live on your iPhone, in the Keychain, behind Face ID. When a tool on your computer needs one, ValetFS lends it — into memory, never to disk — and takes it back when you are finished. HOW IT WORKS • Install the ValetFS daemon on your computer and start it. It prints a QR code. • Scan the code with the app. The two are now paired. • Push a secret from your phone. It appears on the computer as an ordinary file that any tool can read — but it exists only in memory. • Close the app, and a grace timer starts. When it expires the daemon unmounts and wipes itself. Nothing is left behind on disk. END-TO-END ENCRYPTED Secrets are encrypted on your phone for one specific daemon, using X25519 key agreement and ChaCha20-Poly1305. The relay that carries them sees only ciphertext. We cannot read your secrets, and neither can anyone operating the infrastructure in between. BUILT FOR AGENTS Provision a session from the app and hand an AI agent a single connection key. The agent installs the daemon and joins — and you keep the authority to revoke it. One tap forgets the session, and a still-running daemon locks itself, unmounts, and wipes its memory. WHY NOT A CLOUD SECRETS MANAGER Federated identity solves this for workloads that run inside a cloud — they already have an identity to exchange for a short-lived token. Your laptop, your home server and the container your agent runs in have none, so they fall back to a file on disk. ValetFS gives that machine the thing it was missing: an authority that can say no, and that lives somewhere the machine cannot reach. NO ACCOUNT, NO TRACKING There is no sign-up and no login. No analytics SDK, no advertising, no behavioural tracking. The app is a client for infrastructure you can inspect — the daemon and the relay are both open source. REQUIRES A COMPUTER ValetFS is a companion to the ValetFS daemon, which runs on macOS or Linux and is a free open-source download. The app on its own has nothing to pair with. Daemon and source: https://github.com/WinM2M/valet-fs

See every request your apps make — from your iPhone, with no Mac and no cable. HTTPGlass is a full HTTP(S) debugging proxy that runs entirely on-device. It installs a local VPN profile and its own root certificate, then captures and decrypts traffic from the apps on your phone the way a desktop proxy would. Nothing is relayed through a server and there is no account to create. CAPTURE • Every request and response, with status, method, host, timing and size • HTTPS decryption through an on-device root CA you install and trust yourself • HTTP/1.1 and HTTP/2, gzip, deflate, Brotli and chunked bodies decoded for you • Full-text search across URLs, headers and bodies • Sessions: browse, scope, rename, share and delete each capture run READ • Body viewers: pretty JSON, tree, field list, raw and hex • GraphQL inspector — operations and variables, not a wall of escaped text • WebSocket frame viewer • Image and form-body previews • Export to HAR, or generate a cURL / Swift / Python / JavaScript / Kotlin snippet CHANGE • Breakpoints — pause a request or a response, edit any header or the body, then send it • Map Local — answer a request with a mocked response, no backend needed • Map Remote — send a request to a different host or path • Rewrite — rules that add, replace or remove headers, query items and body text • Scripting — onRequest and onResponse hooks in JavaScript, run on-device against live traffic • Compose and replay any request • Network Condition — throttle bandwidth and add latency to test on a bad connection CONTROL • Block, Allow and SSL Proxying lists so you only capture what you care about • No-Cache rules • Face ID / Touch ID app lock over captured traffic • iPad split view: the traffic list and the detail side by side PRIVACY Captured traffic never leaves your device. No cloud relay, no account, no advertising identifier. Optional, opt-in usage analytics and crash reports can be turned on or off at any time in Settings, and they never include captured traffic — no hostnames, URLs, headers, bodies or certificates. FREE AND PRO Free includes capture, decryption, every body viewer, search, sessions, export, code generation, one Block pattern, one Allow pattern, one SSL Proxying pattern and one request + one response breakpoint pattern. HTTPGlass Pro unlocks unlimited Block / Allow / SSL Proxying patterns, Decrypt all, No-Cache, Map Local and unlimited breakpoints. $8.99/month or $39.99/year with a 3-day free trial. Payment is charged to your Apple ID, subscriptions auto-renew unless canceled at least 24 hours before the end of the period, and you can manage or cancel anytime in Settings ▸ Apple ID ▸ Subscriptions. Terms of Use (EULA): https://www.apple.com/legal/internet-services/itunes/dev/stdeula/ Privacy Policy: https://httpglass.com/privacy/ Requires iOS 18. HTTPGlass debugs traffic from apps on this device only — it is a developer tool, not a network monitor for other people's devices.