Cloudflare open-sources privacy proxy debugging CLI

Cloudflare has released an open-source command-line interface (CLI) tool designed to simplify debugging for privacy-preserving protocols, particularly Oblivious HTTP (OHTTP). The tool, named pvcli, aims to reduce the complexity of testing and troubleshooting multi-party protocols by automating binary parsing and encryption steps that previously required manual intervention or custom scripts.

The company identified growing friction in development and incident response as its privacy product suite expanded. Operators faced challenges in isolating failures across relay, gateway, and origin servers, often resorting to one-off client scripts for customer-specific deployments. Binary HTTP encoding and cryptographic operations further complicated debugging, requiring painstaking manual inspection of hex strings and RFC references.

How pvcli works

The tool consolidates multiple privacy protocols into a single interface modeled after curl, with familiar argument structures. A basic OHTTP request that previously required manual key parsing, binary HTTP encoding, and wrapper construction can now be executed with a single command:

pvcli --ohttp \
  --first-hop https://relay.example.com \
  --proxy https://gateway.example.com \
  -X POST \
  --data '{"test":1}' \
  https://target.example.com

Verbose logging (-vvv) provides step-by-step protocol execution details, including decoded client configurations, request headers, and encrypted payloads. The tool also supports advanced scenarios like relay authentication via mTLS (--first-hop-client/--first-hop-key) and custom headers for specific hops (--first-hop-header).

Practical impact for operators

Cloudflare's internal debugging process previously involved:

• Manually parsing binary-encoded public keys from gateways
• Crafting bespoke scripts to convert HTTP requests to binary format
• Constructing wrapper requests with cryptographic headers
• Coordinating log reviews with customers to isolate failures

A typical debugging session could take hours to identify simple issues like malformed binary encoding. The company reports that pvcli reduces this to minutes by handling protocol steps automatically and surfacing errors in human-readable logs.

The tool currently supports OHTTP and plans to add CONNECT proxying, MASQUE, and Privacy Pass protocols. Future updates include post-quantum cryptography support, latency measurement, and chunked OHTTP capabilities. Installation requires Rust and is available via:

cargo install --git https://github.com/cloudflareresearch/pvcli

Industry context

While existing open-source implementations of OHTTP exist in Rust and Go, Cloudflare's tool distinguishes itself by combining multiple privacy protocols in one interface. The company positions pvcli as particularly valuable for operators implementing OHTTP at scale, citing its ability to test live systems end-to-end with minimal setup.

Cloudflare operates OHTTP relays and gateways used by major technology companies, though the tool itself is protocol-agnostic and can work with any compliant implementation. The Apache-2.0 licensed project is accepting external contributions through its GitHub repository.