Features

Traffic Capture & Inspection

All outbound network activity is captured as structured, queryable data. Every entry carries:

• Method, URL, status code, latency, response size
• Request and response headers (secret values redacted)
• Request and response bodies (response rendered as a navigable JSON tree)
• Scheme, host, query parameters, timestamp

The detail view has three tabs: Overview (method, status, timing), Request (headers + body), and Response (headers + body). Search across all entries, clear the list, share to Slack as formatted text or cURL, or replay the request.

Capture is automatic for OkHttp and Ktor. On iOS, you need to use the provided session configuration. For anything else, record manually.

OkHttp

val client = OkHttpClient.Builder()
    .addInterceptor(TrafficInterceptor())
    .build()

Ktor

val client = HttpClient {
    install(AlohomoraInspector)
}

iOS (URLSession)

let config = Alohomora.shared.alohomoraURLSessionConfiguration()
let session = URLSession(configuration: config)

Manual

Alohomora.recordTraffic(
    method = "GET",
    url = "https://api.example.com/users",
    statusCode = 200,
    requestHeaders = headers,
    responseBody = body
)

Traffic Replay

Open any captured request, edit the method, URL, headers, or body, then re-send it. The request goes through your HTTP client, so signatures are regenerated, bearer tokens are refreshed, and cert pinning works.

Register a handler once at startup:

// OkHttp (including Retrofit)
Alohomora.registerReplayHandler(okHttpReplayHandler(client))

// Ktor (Android + iOS)
Alohomora.registerReplayHandler(ktorReplayHandler(client))

// Custom lambda
Alohomora.registerReplayHandler { request ->
    // sign, send, return response
}

Signature headers

If your app signs requests, tell replay which headers to strip so your interceptors regenerate them:

ReplayHeaders.additionalStripList = setOf("X-Signature", "X-Timestamp")

Retrofit

Retrofit has no interceptors of its own — it delegates to the OkHttpClient passed to Retrofit.Builder().client(...). Register the replay handler on that same client.

val okHttpClient = OkHttpClient.Builder()
    .addInterceptor(SigningInterceptor())
    .addInterceptor(TrafficInterceptor())
    .build()

val retrofit = Retrofit.Builder()
    .baseUrl("https://api.example.com/")
    .client(okHttpClient)
    .build()

Alohomora.registerReplayHandler(okHttpReplayHandler(okHttpClient))

Mock Rules

The desktop app can intercept matching requests on the device and return canned responses before they hit the network. Each rule carries:

• URL pattern (substring or regex)
• Optional HTTP method filter
• Status code and content type
• Response body (with optional template generators)

Template generators

Use {{placeholder}} syntax in mock response bodies. Each placeholder resolves to a fresh value per request. Unknown placeholders pass through as-is.

Persistent sessions

Rules are grouped into named sessions, saved to ~/.alohomora/mock-sessions/ as JSON. Auto-save triggers after 500 ms of inactivity. The last active session is restored on launch.

Import & export

• Export as .alohomora-mocks.json and share with your team
• Import from .alohomora-mocks.json or HAR 1.2 files (only 2xx responses with a body are kept)
• One-click mock from any captured request — right-click a traffic entry to create a rule with the response pre-filled

Network Throttling

Simulate slow networks with five presets:

Latency is applied before the response. Throughput is capped on the body.

On Android, device-wide throttling is available via a local VPN service. This covers all device traffic including WebViews, not just your HTTP client.

Database Inspection

Browse Alohomora's internal capture database and any app databases you register. Pick a database, then a table, and page through rows.

• Run arbitrary SQL queries and see results with execution time
• View schema: columns, types, primary keys, indexes
• Read-only inspection (no row editing, no write history)

Registration

// Register a database for inspection
Alohomora.registerAppDatabase(name = "app.db")

// Exclude a database you don't want visible
Alohomora.excludeAppDatabase(name = "cache.db")

Events

Record named events with a timestamp and optional string properties. The Events panel lists entries newest-first, with search by name, expand to view properties, and clear.

Alohomora.recordEvent(
    name = "checkout_started",
    properties = mapOf("cart_size" to "3")
)

Cache

Read live key-value state from the device:

• Android: SharedPreferences (including EncryptedSharedPreferences, flagged as encrypted)
• iOS: NSUserDefaults

Keys load lazily. Click a key to fetch its current value. Read-only.

Errors

Uncaught exceptions are captured automatically. The crash handler is installed at init and chains to whatever handler was there before, so your Crashlytics/Sentry stays intact.

Manual recording

Alohomora.recordError(throwable, place = "SyncWorker")

Swift

Swift Error is not a KotlinThrowable, so use the dedicated overload:

Alohomora.shared.recordError(
    reason: "DecodingError: keyNotFound",
    stackTrace: Thread.callStackSymbols.joined(separator: "\n"),
    place: "ProfileLoader"
)

Features: search, full stack-trace detail view, copy to clipboard, clear.

Errors also appear in the Events timeline as App.Exception entries, rendered with an error accent bar.

Config & Git History

Config shows build metadata: project name, variant, version name/code, branch, commit SHA, dirty flag, and build timestamp.

Git History shows the last N commits (configurable, default 50): SHA, author, subject, and timestamp.

Both are injected at build time by the Gradle plugin (Android) or an Xcode run-script phase (iOS). No runtime cost.

alohomora {
    enabledVariants = setOf("debug")
    maxCommits = 50
    slackWebhookUrl = "https://hooks.slack.com/services/..."
    versionName = project.version.toString()
    versionCode = 1
}

Deep Link Builder

Desktop-only. Accessible from the Dashboard toolbar or the command palette.

Builder tab

Compose a URL from individual parts: scheme dropdown (https, http, deeplink, content, custom), host, port, path, query parameters (add/remove rows), and fragment. A live URL preview updates as you type. Click "Open on device" to fire via adb shell am start.

History tab

Every URL you fire is persisted to ~/.alohomora/deeplink-history.json (up to 50 entries, deduplicated). Click to populate the builder, play to fire directly, trash to remove individual entries, or "Clear all" at the top.

Command Palette

Cmd/Ctrl+K opens a searchable command palette on the desktop app. Actions are grouped into four categories:

• Navigation — one entry per sidebar section, with Cmd+1..9 shortcuts
• General — toggle theme, help, zoom in/out/reset
• Device — screenshot, force stop, launch, clear data, reboot, Wi-Fi/data toggle, clear logcat, deep link builder (gated on device connected)
• Data — clear traffic, clear traces, clear events (gated on connected session)

Arrow keys to navigate, Enter to select. Each action shows its keyboard shortcut as a chip.

Desktop-Only Panels

• Dashboard — live device metrics, deep link builder button, build info at a glance
• Logcat — streamed device log with level filtering
• ADB — embedded terminal (pty4j) for running arbitrary ADB commands

These panels are gated on device capability and hidden when connected to an iOS device.

Keyboard Shortcuts