Get
Hugin.
One binary: proxy, scanner, GUI. No dependencies, no JVM, no account. Community is free.
Every account gets a 7-day Pro trial — no card, no email. Create one →
curl -fsSL https://hugin.nu/install | shbrew install --cask HuginCyber/tap/hugin-cyberbrew install HuginCyber/tap/hugin-cliThe cask installs the desktop app; the formula installs the CLI. Both pull the Ed25519-signed release.
all builds + checksums on the releases page
Three
steps.
From download to intercepting traffic in under a minute.
start the proxy
Run hugin — the MITM proxy comes up on 127.0.0.1:8080 and the desktop GUI opens.
trust the CA
Point your browser at 127.0.0.1:8080 and install the CA cert from http://hugin.local/cert (generated on first run).
browse & test
All traffic flows through Hugin. Drive the scanner, repeater and intruder.
MCP
setup.
Drive Hugin from any MCP client — opencode, Cursor, Codex — one JSON block.
{
"mcpServers": {
"hugin": { "command": "hugin", "args": ["mcp"] }
}
}add it to opencode.json or .mcp.json.
Want it warm from the first message? Point your agent at https://hugin.nu/llms.txt or read the skill →. Your local MCP server also serves it as hugin://skill.
Machine-readable listing: mcp.json for registries and directories, .well-known/mcp.json for auto-discovery.
Verify,
don't trust.
Hugin installs a CA and sees your traffic. You should not have to take our word for what the binary does. Every release is Ed25519-signed at build time — verify any download yourself, offline, before you run it.
hugin verify hugin-cli-linux-x86_64.tar.gzDownload the .sig next to each binary and verify it. The binary checks the signature against its embedded public key; no network, no account, nothing to trust.
Prefer checksums? A .sha256 sidecar ships next to every asset too.