Wireflip Add to Chrome

Patch the request.
Keep your flow.

Inspect, rewrite, mock, and debug traffic in the tab you are already using—no native client, no proxy setup.

Add to Chrome Explore the SDK
Traffic inspector
Advanced
Search requests
GET  /api/profile200
POST  /api/orders201
GET  /api/projects/123200

Fetch · 342 ms

GET  /api/metricsBlocked
GET  /api/search200
GEThttps://api.example.com/api/projects/123200 OK
Initiatorapp.example.comTypeFetchMatched ruleRepair staging API

Request headers

Authorization••••••••••••
Content-Typeapplication/json
Originhttps://app.example.com
✓CORS repaired

Preflight synthesized locally. Response headers were patched before browser enforcement.

Fast when rules are enough.
Deep when they are not.

One extension, with two deliberately different execution paths.

≡

Rules mode

Chrome declarativeNetRequest

  • ✓ CORS, headers, redirects, and blocking
  • ✓ High performance and low overhead
  • ✓ No debugging banner
  • ✓ Always-on rules when you need them
</>

Advanced mode

Tab-scoped Chrome DevTools Protocol

  • ✓ Inspect requests and responses
  • ✓ Repair failed preflights and CORS responses
  • ✓ Static mocks, delay, and network failure
  • ✓ Chrome shows its standard debugging disclosure

Let your app ask for the capability it needs.

The open-source SDK connects a web app to the locally installed extension. Every request is bound to the real top-level page origin, and CORS changes require user consent.

  1. 1Connect locallyNo account, API key, or cloud relay.
  2. 2Ask for one capabilityCORS access is scoped to the current origin.
  3. 3Create safe draftsApps can prepare disabled rules; users review before enabling.
Read the SDK guide →
app.ts
import { intercept } from 'wireflip';

const session = await intercept.connect();

await session.requestCors({
  reason: 'Preview staging data'
});

// Drafts are disabled until the user reviews them.
await session.createRuleDraft(rule);

Local by design.

Traffic stays on your machine, and powerful access ends with the tab.

No traffic uploadRequests, responses, rules, and logs are not sent to our servers.
No native clientEverything runs inside Chrome or Firefox.
Sensitive headers redactedAuthorization and cookie values are masked in the inspector.
Tab-scoped attachAdvanced mode detaches on disable, tab close, or cross-origin navigation.

Your CORS Unlocker setup comes with you.

The name and product changed. Your existing setup does not disappear.

  1. 1
    One-time migration to v2

    Existing CORS rules and settings are converted automatically.

  2. 2
    Recovery snapshot retained

    A local copy of the v1 data remains available for recovery.

  3. 3
    v2 becomes the only source of truth

    Old settings are not read or dual-written after migration.

Make the browser your request lab.

Add to ChromeRead the docs