# Echolot

> Echolot is a native macOS API client for HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT and MCP, built with SwiftUI and AppKit. Workspaces are plain TOML files you keep in Git, secrets stay in the macOS Keychain, there is no account and no cloud, and AI agents (Claude Code, Codex, Cursor, or the built-in Assistant) can explore and test your APIs over MCP without ever seeing a secret. It's free while in beta.

- Website: https://echolot.dev
- Download (latest release): https://github.com/staticdreams/echolot-public/releases/latest
- Release notes: https://github.com/staticdreams/echolot-public/releases
- Contact: contact@echolot.dev
- Requirements: macOS 15 or later, on Apple silicon. Signed and notarized. On-device AI needs macOS 26 with Apple Intelligence; HTTP/3 needs macOS 27.
- Price: free while in beta. Beta builds expire 30 days after release, and Echolot updates itself before then.
- Made in Switzerland. "Echolot" is German for echo sounder.

## Who it's for

Developers on a Mac who want a fast, native alternative to Postman, Insomnia, Bruno or Paw (now discontinued): no sign-up, no cloud sync, collections that live in a Git repo, and an API client AI coding agents can use safely.

## Protocols

- HTTP: any method, even made-up ones; raw mode sends exactly what you typed. HTTP/1.1, HTTP/2 and HTTP/3.
- GraphQL: schema-aware completion, subscriptions, queries built by ticking fields.
- gRPC: unary and streaming, from .proto files or server reflection, messages as JSON.
- WebSocket: live sessions with a searchable message log.
- Socket.IO: events, acks, namespaces and binary attachments.
- MQTT: 3.1.1 and 5.0, QoS 0–2, retained messages, over TCP, TLS or WebSocket.
- MCP: call tools, read resources and prompts on any MCP server, over stdio or HTTP.

## Features

- Environments and variables at every level, from the workspace down to one request. Protected environments (such as Production) turn red and ask before every send.
- Auth set once on a folder and inherited: Basic, Bearer, API keys, OAuth 2.0 with PKCE, JWT, AWS Signature, Digest, Hawk, EdgeGrid, NTLM.
- Dynamic values ({{$uuid}}, {{$isoTimestamp}}…) and captures that carry a token from one response into the next request.
- Wire-level truth: header order and casing as sent, every redirect hop, a full timing breakdown (DNS, connect, TLS, waiting, transfer), and Body, Headers, Cookies, Raw, Hex and Wire views.
- Huge responses: bodies stream to disk and are never held in memory. Benchmarks on an Apple silicon Mac: first screen of a 500 MB JSON response in 0.3 ms, pretty-printed in 4.2 ms, first search match across all 500 MB in 84 ms, an array with 1,000,000 items expanded in 30 ms. Memory stays around 21 MB during a 2 GB download. Every number is an automated benchmark, and a build that misses one doesn't ship.
- Checks without code: status, headers, JSONPath, body, time, size, JSON Schema, OpenAPI responses, gRPC status and MCP results. Generate from Response writes the obvious checks in one click. Postman-style pm.* scripts (pm.sendRequest included) run in a sandbox.
- A collection runner: data files, iterations, retries, stop at first failure; JUnit, JSON or HTML reports.
- The `echolot` command-line tool ships inside the app (Settings › Install Command-Line Tool) and runs the same checks in CI, Postman collections included: `echolot run collection.json`, or `echolot run Alpenglow.echolot --env staging --reporter junit --out results.xml`.
- EchoFlows: chain requests, conditions, loops and polling on a canvas, with 26 kinds of block, including human steps (Ask, Show, Wait, Approve). Run a flow by hand, on a schedule, from a webhook, from the CLI (`echolot flow run`) or as an agent's tool.
- Specs: edit OpenAPI visually or as code with live lint; a visual edit changes only the lines it touches. Diffs for .proto files and GraphQL schemas, graded breaking, dangerous or safe.
- Mocks: a mock server of any spec on your Mac, with examples, delays and injected failures; requests that break the spec get a 400 that says why; JavaScript routes keep state between calls.
- Native Mac app: secrets in the Keychain, a ⌘K command palette, Quick Look on Space, Quick Send (⌃⌥Space), Shortcuts actions, light, dark or system appearance.
- Imports from Postman, Insomnia, Bruno, Paw, OpenAPI 3, Swagger 2, HAR and cURL: collections, environments and scripts, with an import report listing anything that didn't make the trip.

## AI agents and the Assistant

- Echolot is an MCP server: one command connects an agent to a workspace, for example `echolot mcp setup claude-code -w Alpenglow.echolot | sh`. Every call lands in History with the agent's name on it.
- Agents refer to secrets by name; values are redacted from everything they get back (raw, JSON, percent-encoded and Base64). Anything that writes or changes data asks for your approval first.
- The Assistant (⌘J) sits beside every page: it sends requests, writes checks, and builds flows, specs and mocks. Use Anthropic, OpenAI or Gemini with your own key, local models through Ollama or LM Studio, Apple Intelligence on-device, or bring Claude Code, Codex or Gemini CLI into the panel.
- Agents connect on the same Mac only; there is no remote MCP access.

## Files, privacy and teams

- A workspace is a folder of readable TOML, one file per request, so it diffs, merges and reviews well in Git. Teams share through Git; there is no real-time co-editing, by design.
- No account, no sign-up, no cloud: nothing is synced to or stored on Echolot's servers. Echolot talks only to the servers you send requests to, the AI provider you pick (or none), and GitHub when it checks for updates.
- Anonymous usage analytics are off by default and never include URLs, headers, bodies or secrets. Crash reports stay on your Mac.

## What Echolot doesn't do

- No account and no cloud sync (your Git remote is the sync).
- No Windows or Linux app: it's a Mac app.
- No load testing.
- No AI it sells you: bring your own key or run models on your Mac.

## FAQ

- How much does it cost? Free while in beta.
- Do I need an account? No. Download it and send a request.
- Which Macs does it run on? macOS 15 or later, on Apple silicon.
- Will my Postman scripts work? pm.* scripts run in a sandbox, pm.sendRequest included; on Newman's own test collections, most run unchanged.
- Can an agent see my secrets? No. Agents refer to secrets by name and values are redacted from everything they receive.
- How do teams work together? Through Git: a workspace is plain files, so you review requests like code.