Your existing Web DevToolkit
inside a browser extension
Modify live browser requests. Manage API Collections. Team Collaboration.
No account · Free. No catches. · Everything Local. No Cloud. · Self Host
Modify live browser requests. Manage API Collections. Team Collaboration.
Reshape what your live site sends and receives, straight from the browser. No staging queue, no release train, no rounds of deployment approvals — point a rule at production and see the result on the very next request.
Build, send, and organize requests without leaving the browser — everything a desktop API client does. Then chain it: any response value lands in a live variable, and any rule can inject it into real traffic. A fresh auth token on every prod request becomes one saved request.
Wire saved requests into a workflow: explicit dependencies, AND/OR run conditions, priorities — and independent steps run in parallel. Every step captures values from its response into live variables, and a refresh policy re-runs the chain so the values your rules inject never go stale.
Your workspace needs a home — and you pick where: in-browser, one desktop app shared by every browser on your machine, a box on your LAN for all your devices and the people next to you, or a self-hosted server for the whole team. Same workspaces, same rules, on every tier.
Open Headers ships its own panel inside the browser's DevTools: pin requests side by side, inspect waterfalls and timing phases — and turn any captured request into a rule (redirect, replace host, delay, add a header) right there. Workspace and environment switching included; the workbench never has to open.
Cross-device sync is where local-first products usually fold and ask you to trust their cloud. Open Headers merges at the per-field level instead: you edit a header in DevTools while a teammate rewrites the same rule in the workbench — both land, in any order, with no stale-draft banner and no overwrite.
"Local-first" is a posture, not a feature. The extension never needs a network to do its job — rules keep firing, requests keep running, edits keep landing. Go offline on a plane, keep working; come back online and every change merges into place. Your data, your back-end, your choice — at every step.
Open Headers speaks Model Context Protocol, so Claude Desktop, Claude Code, Cursor, VS Code, Cline — any MCP client — can drive your workspace. Ask in plain English; the agent makes the tool calls; your workbench reflects the result. Local-only by default over stdio, HTTP/SSE when you self-host — no vendor relay in between.
Every other tool in this space keeps its back-end outside the browser — a desktop app you install next to it, or a cloud you sign into.
Open Headers ships the entire product, back-end included, inside the browser extension. No one else on the market does this.
Rewrite headers, block, redirect, mock, inject, delay — every rule speaks the same condition language, and the engine picks the right path to run it. Static rules compile straight into the browser's network layer and catch every request. The intercept path handles the rest — as page scripts in Standard mode, or natively over CDP in Debug mode.
Request shaping used to mean a desktop proxy with a CA certificate. API collections meant a cloud platform with an account. And that one header? A third tool. Open Headers ships all three categories inside a single browser extension — with one workspace store under everything.
Open Headers — workbench 1 tab · 0 installs left over The quick popup, the side panel, the DevTools panel, and the full workbench tab are four views over the same workspace store. Flip a rule in the popup and watch it flip everywhere else — instantly, with no refresh and no save button.
The workbench and the DevTools panel share one shell: top header, status footer, and two activity bars — left and right — each with its own sidebar of tools. Drag any tool tab into any of six docking zones, arrange them how you think, pick an activity-bar layout — and every new tab inherits it.
The workbench is a regular browser tab — so open several. Each one can host a different workspace: your personal workspace in this tab, the team's shared one in the next. Work in both at once, side by side; every edit lands in its own workspace, and nothing bleeds across.
Workbench — Personal Workbench — Team + Install it and watch the wire: the extension contacts no account server and no cloud relay — the only OpenHeaders-bound call is anonymous feature counting, documented byte-for-byte, inspectable in-app, and off with one switch. Your rules live in browser storage on your machine — or in the back-end you choose: desktop app, a local server, or a VM you host.
Every change — a toggle in the popup, an MCP tool call, a teammate's edit arriving over sync — flows through one pipeline: lock the entity, put the change in order, apply, broadcast. That pipeline is the Oracle, and it never changes — only the packaging around it does.
Yes — front-end and back-end.
The rule engine, the API client, the sync engine, and storage all live in one place: your browser.
The principle: we do everything the browser technically allows — and the few things it doesn’t, like raw-socket protocols, defer to the desktop app, where the operating system allows more.
Unplug the internet and everything still works. Ideal for usage on an airplane, no-internet locations.
Static rules compile into the browser's own network layer and catch every request — pages, frames, fetch, XHR, images, fonts, scripts. The intercept path covers what that can't reach: bodies, mocks, delays. And there's no CA certificate, because we never man-in-the-middle your traffic — rules run with the page's own permissions.
Static rules are evaluated by the browser itself, not by extension code, so the hot path costs nothing extra. Intercept rules only touch the pages they match.
The software is identical on every tier — no feature gates, and security features come standard, not as upsells. What you pay for is team seats:
Free — the full product, all surfaces, up to 6 active users per server. No trial clock, no credit card, no account.
Team — from the 7th active user, every active user is a paid seat at $5 per user per month, or $50 a year (2 months free), self-serve up to 50 seats. License checks run on your machine, not our servers — and if you stop paying, nobody is locked out.
Enterprise — $10 per user per month, billed annually by invoice, 50-seat minimum: invoice/PO billing with procurement and vendor onboarding, SLA-backed priority support with a direct line to engineering, vendor security review support — questionnaires, risk assessments, compliance documentation — deployments beyond the 50-seat self-serve cap, and custom contract terms — MSA, source escrow, audit rights.
No — Open Headers is proprietary, and we label it honestly. It’s the intellectual property that makes working on this product full-time sustainable as a long-term vision, not a side project.
What we publish instead is verifiability: every network call the software can make is documented byte-for-byte in our wire-transparency spec, so the privacy claims are checkable from the outside — no source access, no trust required.
And the full product is free to use and free to self-host — up to 6 active users per deployment.
Anonymous feature counting only — which features get used, never what you use them on. The event vocabulary is a fixed allowlist compiled into the app: every field comes from a closed value set, no free-form text, so URLs, headers, and traffic are impossible to send. There’s no account and no fingerprinting — just a random in-memory session id plus a random install identifier that identifies the install, not you: never derived from your device, resettable anytime, and deleted when you switch counting off. You can watch every event byte-for-byte in Settings (“View telemetry events”), one switch turns it off — and the self-hosted server, self-hosted web app, and MCP server never send anything.
Three ways. Open DevTools and watch the extension's network traffic — every request must match the published spec. Capture at the system level with a packet tool like Wireshark — same answer, below the browser this time. Or read the wire-transparency spec: every call the software can make, telemetry events included, is documented byte-for-byte, so anything undocumented on your capture is a bug we treat as a vulnerability.
In browser storage, inside your browser profile, on your machine. Nowhere else — unless you later point it at a back-end you own.
Today, every surface in your browser — popup, side panel, DevTools, workbench — shares one store, merged per field. Cross-device sync ships through back-ends you control: desktop app, local server, your own VM. Never a vendor relay.
They live in the vault scope, encrypted. Rules and requests reference them as {{vault.…}} without ever exposing values — and even AI tool calls can’t read them; sensitive operations stay opt-in.
It won't — Open Headers is full-time work, has been for over a year, and will be for years to come. But suppose it did: nothing breaks. The extension doesn't depend on any server existing, your data stays local, and your install keeps working as-is.
Collections with folders, environments, OAuth 2.0 with PKCE and refresh, GraphQL with schema introspection, pre- and post-response scripts, multipart file uploads — HTTP, WebSocket, and GraphQL all run right in the browser.
Bring your collections over via cURL, HAR, Postman, Insomnia, or OpenAPI import.
Browsers don't expose raw sockets, and we won't pretend otherwise.
The rule is simple: everything the browser technically allows us, we present it to you in the extension.
What the browser doesn't expose to us — gRPC, MQTT, socket-level protocols — the desktop app picks up, same workspace, same engine, because the operating system allows more.
Chrome, Firefox, and Edge today. Safari soon. Chromium variants (Brave, Opera, Vivaldi)
P.S.: Chrome, Edge, etc. are built on top of the open source browser Chromium
Fully. Rules keep firing, requests keep running, edits keep landing. Reconnect, and every change merges into place — no stale drafts, no lost work.
No. The popup is one toggle — and every rule type ships with a pre-filled template: swap in your target URL and you’re done. The IDE-grade workbench is there when you want depth, not a prerequisite.
Because honesty converts better than buzz-words.
If a tag says roadmap, it isn't in the build yet — when it ships, the badge comes off. Nothing on this page pretends to exist before it does.
Yes — the engine underneath, the Oracle, is built for concurrent multi-user editing.
Team tiers run through infrastructure you control: a box on your LAN, or a self-hosted server with SSO, RBAC user management, and audit logs.
Git isn’t what powers collaboration; it’s an optional durable back-end, so a new device doesn’t sync from zero — it bootstraps from the Git state and auto-syncs from there.
If a team deployment is at its seat limit and you need in, you don’t have to wait on procurement — an individual seat is a license you buy yourself, at the same $5/month or $50/year, that admits you and only you to that deployment. It’s bound to your email address, so it can’t be shared or pooled, and it’s valid on one deployment at a time. And if it ever lapses, you’re never kicked out — it simply stops covering renewals.
No. The MCP server runs locally; your AI client — Claude Code, Cursor, VS Code, Cline — connects directly to your installation.
No relay in between, and tool calls run with your permissions: secrets stay behind the vault.
The request-shaping power of a desktop proxy, the rule library of a cloud API platform, and the always-on surface of a header extension.
No other product ships all of this inside a browser extension.
OpenHeaders
Free | Cloud API platforms Postman · Insomnia · Hoppscotch | Desktop proxies Charles · Proxyman · HTTP Toolkit | Header-only extensions ModHeader · Requestly | |
|---|---|---|---|---|
| Architecture & Reach | ||||
| Runs entirely in your browser | back-end included | Their cloud + app | Separate binary | No real back-end |
| No proxy port or CA certificate | CA cert required | |||
| Works fully offline | Internet required | |||
| Privacy & Ownership | ||||
| No account or sign-in | Login wall | License key | ||
| Your data stays on your machine | Their servers | |||
| Telemetry inspectable & one-switch off | Anonymous feature counts only | Collected | Varies | Varies |
| Network behavior documented byte-for-byte | Published wire-transparency spec | Varies | ||
| Capability | ||||
| Live traffic — modify request & response headers | Eleven rule types | Limited | One rule type | |
| Live traffic — mock, body & query edits, WebSocket/SSE messages | Paid tiers | |||
| Live traffic — block, redirect, delay; inject CSS/JS | Varies | |||
| API client — REST, GraphQL, OAuth 2.0, scripts, assertions | ||||
| HTTP version pinning — 1.1, 2, prior knowledge, 3 (QUIC) | Per request, HTTP/3 included | HTTP/2 at most | ||
| Workflows — chained, scheduled HTTP requests | Local or your server | Paid cloud runners | ||
| Socket & stream protocols — WebSocket, Socket.IO, gRPC, SSE, MQTT | Desktop / server native; browser delegates | Their desktop app | ||
| Local AI agent integration | Local MCP server | Their cloud AI | ||
| Sync & Resilience | ||||
| Conflict-free concurrent edits | Field-level merge | Object-level Last-write-wins | No sync | No sync |
| Team sync without a vendor server | Via infra you control | Cloud only |
Everything below is the same engine — the Oracle — in different packaging. The local-first shape never breaks: sync ships through infrastructure you control, never a vendor cloud.
Let any MCP-capable AI client drive your workspace: add a rule, run a saved request, switch environments, diff workspaces — in plain English. Local-only by default; your agent talks directly to your installation.
Live collaboration runs on the sync engine itself — Git serves as a durable back-end, so new devices bootstrap from the repo state instead of syncing from zero. Enterprise-ready tiers on your LAN or self-hosted: SSO, RBAC user management, audit logs.
A native binary running the same workspace store — picking up where the browser stops: socket-level protocols like gRPC and MQTT, system-level traffic shaping, deeper filesystem reach.
One server on your machine or LAN; extension, desktop, and CLI become clients of the same workspaces across every device you use.
Headless scripting and CI — list rules, toggle environments, send a saved request from the shell.
The same UI as a web bundle on your own origin — for locked-down browsers or branded deployments under your domain.
Insomnia collections, OpenAPI specs, and full HAR request imports — bring your work across in one step.
The software is the same on every tier — you pay for seats only. SSO and security features come standard, not as upsells.
Self-serve up to 50 seats — larger deployments, see Enterprise
Custom implementation, an integration we don’t have yet, or something else entirely — reach out and let’s talk.
No account, no setup. The extension is the whole toolkit; the desktop app and CLI extend it beyond the browser.
The whole toolkit — oracle, rule engine, sync engine, API client + scheduler, and live request modification
— inside the browser you already use.
Published on every major extension store.
macOS
Windows
Linux
oh binary — no Node.js required, checksums verified by the installer.curl -fsSL https://updates.openheaders.io/install.sh | sh irm https://updates.openheaders.io/install.ps1 | iex ohd for servers and VMs — your team’s backend, self-hosted.curl -fsSL https://updates.openheaders.io/install.sh | \
sh -s -- --with-daemon docker run -d -p 8137:8137 \
-v oh-data:/data ghcr.io/openheaders/ohd oh binary; no extra install.oh tui