Cloudflare open-sources a debugger for privacy protocols used by Apple and Microsoft, with AI agents in mind
Jul 27th 2026 9:00am
The command-line tool, called pvcli, is designed to make testing and debugging privacy-preserving infrastructure more accessible.
Every time you use a privacy service like Apple’s iCloud Private Relay, you’re trusting a system designed so that no single company can see both who you are and what you’re doing online. Systems built using protocols such as Oblivious HTTP (OHTTP) and MASQUE can do this by splitting trust across independently operated infrastructure.
However, that privacy promise comes at a cost: When something goes awry, it’s hard to tell where. A request might touch several separate systems on its way to its destination, each run by a different operator, with no single party able to see the whole picture.
Cloudflare operates Privacy Proxy and Privacy Gateway infrastructure behind privacy tools such as Apple’s internet privacy service, Microsoft’s Edge Secure Network VPN, and many others. Apple runs one half of the relay; Cloudflare’s Privacy Proxy runs the other — each side only ever gets half the picture.
Cloudflare has now released “privacy-client” (pvcli), a command-line debugger for OHTTP and, eventually, MASQUE traffic, under an Apache 2.0 license.
Fisher Darling, systems engineer at Cloudflare: “Debugging privacy protocols where different operators need to operate different pieces of the protocol infrastructure is extremely difficult. It’s a lot of manual work, custom scripts, and trying to troubleshoot without much information.”
pvcli is aimed at companies “not even close to Apple or Microsoft-sized” so they can test and debug privacy-proxied traffic without becoming protocol experts. Developers can run it against their own infrastructure or against open sandboxes such as ohttp.info.
Darling says pvcli was built with AI agents in mind as well as humans: “A huge issue in the AI ecosystem at the moment is: how can we run inference on a user’s personal data, in a privacy preserving manner, without leaking that information to the inference provider?”
OHTTP is one piece of that puzzle. pvcli’s command syntax is modeled closely on curl, making it easy for an agent to construct and debug requests. “Pvcli was explicitly designed for agent-based debugging. It just so happens that humans also appreciate an interface that feels familiar to curl’s.”
The tool started as an internal Cloudflare project, was beta-tested with unnamed customers, and is released under Apache 2.0. Darling highlights health, finance, and other heavily regulated verticals as natural homes for the technology.