Caido

Caido is a web security testing proxy that combines request interception, HTTPQL filtering, node-based automation and bring-your-own-model AI agents. It targets bug bounty hunters, pentesters and security engineers who want a faster, API-first alternative for manual testing.

Caido is an interception proxy and web security testing toolkit built for people who spend their days probing applications by hand. The pitch is narrow and deliberate: manual testing does not have to be slow. Requests are captured, inspected and replayed through an interface that stays responsive under heavy traffic, and the repetitive parts of an assessment are pushed onto automation and AI agents rather than the tester. The core workflow will feel familiar to anyone who has lived in a proxy. Traffic flows through Caido, gets logged, and can be searched with HTTPQL, the tool's own query syntax for sifting requests and responses without clicking through endless filters. On top of that sits a node-based automation builder for chaining ad-hoc workflows together, plus AI powered plugins that launch autonomous agents to draft payloads and run tasks while the tester concentrates on business logic flaws. Models are not locked in: Caido connects to the provider already in use, including Anthropic, Google, OpenAI and others through OpenRouter. The audience is clearly segmented. Bug bounty hunters use it to move faster across large scopes, pentesters use it to keep pace with short development cycles, and security engineers treat it as a headless, API-first proxy they can build automation on top of, with a client SDK for giving agents programmatic access. Community plugins extend it further, and an organisations page exists for teams that need shared tooling. The honest comparison is Burp Suite. Caido positions itself as the faster, more minimal alternative, and its user base of several thousand active hackers suggests the argument lands for a slice of the market. Burp still owns the deepest extension ecosystem and the longest track record. Caido's differentiators are performance, clean UI, first-class AI and automation, and an API-first design that suits engineers who want to script rather than click. Above all it is a tool for professionals: expect a learning curve around HTTPQL and the automation graph before the speed advantage shows up.