Scripting

Scripting runs your own JavaScript against matching requests/responses — for logic that filter rules and breakpoints can’t express (computing a signature, conditionally rewriting a body, injecting a header based on other headers).

How it works

Each script rule matches on URL/method/phase (request or response), same as filter and breakpoint rules. When traffic matches, TonyProxy runs your script against it via JavaScriptCore (the same engine behind Safari) — no network access, no filesystem access from inside the script; it only sees and can modify the request/response passed to it.

What you can do

• Read and modify headers, body, and URL before a request goes out
• Read and modify a response before it reaches the client
• Compute values (hashes, signatures, timestamps) and inject them into headers or body

Limits

• Scripts run synchronously and are expected to return quickly — this isn’t a place for long loops or heavy computation.
• No fetch/XMLHttpRequest — scripts transform traffic already flowing through the proxy, they don’t make their own network calls.