CallFlow — capture & replay HTTP in VS Code, Cursor and VSCodium, plus a local REST client

See the HTTP your code actually sends, then replay it. Start capture and every terminal and debug session in your workspace runs through a local proxy: your Node, Python, Go, .NET, Java and curl calls show up in CallFlow with headers, bodies and timings, no code changes. Save any captured call as a request, edit it, replay it, and diff the new response against the old one.

Underneath is a complete REST client that is free forever: requests kept as plain .http files in your repo, environments, history, imports from Postman, Thunder Client, cURL and HAR, and a collection runner.

Try every Pro feature free for 14 days. The trial starts the first time you use capture, scripts and tests, or response diff. No account, no email, no card, nothing to cancel: it lives on your machine, and the status bar shows the days left. After that, Pro is $20 once, and there is a company licence for teams. When a trial ends, the free REST client keeps working exactly as before.

No account, and your requests, responses and captures never leave your machine. Apart from the traffic you send on purpose, CallFlow makes one network request of its own: an anonymous once-a-day ping that counts active installs (see Telemetry), which you can turn off. The licence check and the trial are offline.

Publisher: Small Hours, which also makes the Backstop and Shown browser extensions. The smallhours namespace is verified on Open VSX. The Visual Studio Marketplace only grants its verified badge after a publisher and its domain are six months old; ours will be in March 2027. Until then VS Code may ask whether you trust the publisher. Questions go to hello@smallhours.works, and a person answers.

Editors: VS Code 1.90 or newer, Cursor and VSCodium. CallFlow's full integration suite (sending, HTTPS, terminal capture through the local CA, saving captures as requests) passes inside Cursor 3.23 and VSCodium 1.135, tested on 2026-10-05. Cursor and VSCodium install it from Open VSX: search "CallFlow" in the Extensions view. Other Open VSX editors such as Windsurf should work the same way but are untested. One Pro licence covers every editor you use.

Free, forever

• Requests: method, URL, params, headers, body (raw, form, multipart, file), auth helpers (basic, bearer, API key, OAuth 2.0), timeouts, redirects.
• Collections as files: every request is a block in an .http file under .callflow/ in your workspace. No folder open? Requests are kept in CallFlow's own folder on this machine until you open one. Compatible with the REST Client format, so your collection diffs in git and opens anywhere.
• Environments: .callflow/environments.json with {{variables}}, dynamic values ({{$uuid}}, {{$timestamp}}, {{$processEnv NAME}}), and chaining from earlier responses.
• Secrets stay out of your files: CallFlow: Set Secret… stores a value in VS Code's secret storage for an environment; the file keeps {{name}} and environments.json keeps "". The Auth tab flags a password, token or key typed as plain text and offers Store as secret, and saving a request with a plain-text credential in an auth header, API-key header or key-like query parameter offers to move it to a secret first (turn that check off with callflow.secrets.warnOnSave).
• OAuth 2.0: authorization code with PKCE (signs in through your browser) and client credentials, with refresh tokens. Define a profile once in environments.json, pick it in the Auth tab, and requests carry Authorization: Bearer {{$oauth profile}}. Tokens are kept in VS Code's secret storage, refresh on their own, and never appear in your .http files. See OAuth 2.0 below.
• History: the last 200 sends with full bodies, exportable as HAR.
• Import and export: cURL, Thunder Client collections, Postman v2.1 collections, HAR in; cURL and HAR out.
• MCP inspector: test MCP servers. CallFlow: Open MCP Inspector lists the servers in .callflow/mcp.json, .vscode/mcp.json, .mcp.json and .cursor/mcp.json. Connect over stdio (a local command) or Streamable HTTP to see the server's info, tools, resources and prompts. Call a tool from a form built from its input schema (or as raw JSON), read resources, try prompts, and see each call's result with its JSON-RPC request and response. Server headers and env values can use {{variables}}, secrets and {{$oauth profile}}. CallFlow asks before starting a server's command for the first time, and only in trusted workspaces. See MCP servers.
• Collection runner: right-click a folder or .http file and choose Run (or press ▶). Requests run top to bottom with the selected environment, values chain from one response to the next, and you get a pass/fail list with every response. Any 2xx/3xx passes; declare other expectations with a comment line such as # @expect-status 404. Stop at the first failure or carry on, re-run only what failed, and export the run as JSON.

CallFlow Pro, $20 once (free for 14 days first)

The first time you use a Pro feature, a 14-day trial of everything below starts on its own, with a one-line notice. The status bar shows CallFlow Pro · trial 12d; click it for licence options. When the trial ends, Pro features go back to how they behave in the free version (capture shows its preview, scripts are skipped with a note, Compare offers Pro) and CallFlow tells you once. One trial per install, no account. A licence key always takes over from the trial.

• Capture: start capture and every new terminal and debug session in the workspace is routed through a local proxy on 127.0.0.1 with a locally generated CA. Your Node, Python, Go, .NET, curl and Java programs are captured without code changes; a browser can be launched through the proxy too.
• Inspect: list, filter, and open any exchange with headers, bodies, timings and TLS details. Sensitive headers are masked until you reveal them.
• Save as request and replay: turn a captured call into a saved request, edit it, send it again.
• HAR export of captures, and history up to 20,000 entries.
• Scripts and tests: < {% %} pre-request and > {% %} response blocks in your .http files, in JetBrains HTTP Client syntax (also read by httpyac). Use client.test() / client.assert() to check responses, client.global.set() to carry values between requests as {{name}}, and request.variables.set() to build this request. Results show in a Tests tab and decide pass/fail in the runner.
  • Safety: scripts run in a QuickJS sandbox with no file, network or system access, within time and memory limits. They only run in trusted workspaces, and CallFlow asks once per workspace before running them.
  • Portability: files with scripts don't open cleanly in REST Client, which doesn't know these blocks. Files without scripts are unaffected.
• Data-driven runs: run a folder once per row of a CSV or JSON file, with the columns available as {{column}}.
• JUnit XML export of runs, for CI dashboards.
• Response diff: see what changed between two responses. Use Compare in the response header (vs the previous response to the same request), Compare with last run in the Run panel, or select two History entries and choose Compare Selected. JSON is compared by path, so key order doesn't count, and changes are listed as $.user.role: "viewer" → "admin". Other bodies get a line diff. Hide fields that change on every call, such as ids and timestamps, with ignore paths ($..updatedAt), which are remembered per request. Volatile headers such as Date and request ids are hidden by default.

Buy at https://smallhours.works/callflow/. The key is shown after payment and works offline on any machine you use. For teams: a company licence, so your employer can buy seats for everyone, is at https://smallhours.works/callflow/#teams (or CallFlow: Company Licence for Teams in the Command Palette).

OAuth 2.0

Add profiles under oauth in .callflow/environments.json. Every value can use {{variables}} from the active environment, so one profile works for dev and prod, and the client secret can be a secret:

{
  "active": "dev",
  "environments": { "dev": { "authBase": "https://dev-123.example.com", "clientSecret": "" } },
  "secrets": ["clientSecret"],
  "oauth": {
    "myApi": {
      "grant": "authorization_code",
      "authUrl": "{{authBase}}/authorize",
      "tokenUrl": "{{authBase}}/oauth/token",
      "clientId": "abc123",
      "scope": "openid profile read:orders",
      "audience": "https://api.example.com"
    },
    "service": {
      "grant": "client_credentials",
      "tokenUrl": "{{authBase}}/oauth/token",
      "clientId": "svc-1",
      "clientSecret": "{{clientSecret}}"
    }
  }
}

• In a request: choose OAuth 2.0 in the Auth tab and pick the profile, or write Authorization: Bearer {{$oauth myApi}} yourself.
• Authorization code: the first send asks to sign in and opens your browser. CallFlow listens on http://127.0.0.1:51515/callback for the reply (register that redirect URI with your provider, or set redirectPort). PKCE (S256) and state are always used.
• Client credentials: the token is fetched on the first send, with no prompt.
• Tokens are stored per profile and environment in VS Code's secret storage and refreshed a minute before they expire. The Auth tab shows when the token expires and has Get new token and Clear token. CallFlow: Clear OAuth Tokens forgets them all.
• The collection runner uses the same tokens. If a sign-in is needed, it asks once.
• Optional fields: clientAuth (basic or body; default basic when there is a secret), redirectPort, and extraParams (added to the authorize and token requests).
• Not supported yet: the device code grant. Implicit and password grants are left out on purpose, since OAuth 2.1 drops them. The browser sign-in needs VS Code and the browser on the same machine, so it doesn't work in Codespaces or Remote SSH yet. Client credentials does.

MCP servers

CallFlow reads the server lists other tools already use, so an existing .vscode/mcp.json just works. To keep your own, run CallFlow: Edit MCP Servers (mcp.json), which creates .callflow/mcp.json:

{
  "servers": {
    "everything": { "type": "stdio", "command": "npx", "args": ["-y", "@modelcontextprotocol/server-everything"] },
    "myApi": { "type": "http", "url": "{{mcpBase}}/mcp", "headers": { "Authorization": "Bearer {{$oauth myApi}}" } }
  }
}

• Formats: both VS Code's "servers" and the "mcpServers" format used by Claude Desktop and Cursor are read. Comments and trailing commas are fine.
• Placeholders: ${workspaceFolder} and ${env:NAME} work as in VS Code. CallFlow's {{variables}} come from the active environment, including secrets. VS Code's ${input:...} prompts are not supported; use a secret (CallFlow: Set Secret…) instead.
• Transports: stdio and Streamable HTTP (JSON or SSE replies, with Mcp-Session-Id). The older HTTP+SSE transport is listed with a note but can't be used.
• Free: connect, list tools, resources (and templates) and prompts, call and read them, and see each call's JSON-RPC request and response.
• CallFlow Pro: the Traffic tab is the full JSON-RPC log, live, with notifications, progress and the server's stderr.
• Safety: a stdio server is a program on your machine. CallFlow starts one only in a trusted workspace, after showing you the exact command once. Tools the server marks as destructive are flagged before you call them.

What CallFlow will never do

• Move export of your own data behind the paywall.
• Ask you to sign in.
• Send your requests, responses, captures, files or anything that identifies you anywhere.

Capture, honestly

Capture works by pointing programs at a local proxy through environment variables (HTTP_PROXY, HTTPS_PROXY, NODE_EXTRA_CA_CERTS, SSL_CERT_FILE and friends) that CallFlow injects into VS Code terminals and debug sessions while capture is on. Programs that ignore those variables, pin certificates, or use HTTP/3 are not captured; CallFlow records them as pass-through when it can. Browsers and GUI apps need the CallFlow CA trusted in the OS store; CallFlow shows the exact command and only runs it when you press the button.

Telemetry

Once a day, CallFlow sends one anonymous HTTPS request to https://smallhours.works/api/ping with exactly four fields:

• p: the product, always callflow
• v: the CallFlow version, e.g. 0.2.5
• e: the editor's name (vscode.env.appName), e.g. Visual Studio Code, Cursor, Windsurf or VSCodium
• d: a random install id that CallFlow generates once and keeps in its own storage. It is not VS Code's machine id and is not derived from anything about you or your machine.

Nothing else is sent: no machine id, user name, workspace or file names, paths, requests, responses, captures, settings, licence details or trial status. The server keeps one record per install per day (the version and editor name) for 60 days and does not store IP addresses or user agents.

Why: the stores only report downloads, which include updates and installs that are never opened. This count tells us how many installs are actually used, and in which editors, so we know where to test and what to fix.

How to turn it off: CallFlow sends nothing when VS Code's telemetry is off (telemetry.telemetryLevel set to off), or when you set callflow.telemetry.enabled to false. Either one is enough. A failed ping is never retried until the next day, and it never shows a message.

Settings

callflow.telemetry.enabled, callflow.collectionsRoot, callflow.maxStoredBodyBytes, callflow.redactHeaders, callflow.request.timeoutMs, callflow.request.followRedirects, callflow.secrets.warnOnSave, callflow.oauth.verifyTls, callflow.capture.includeLocalhost, callflow.capture.passthroughHosts, callflow.capture.injectDebugSessions.

Support

hello@smallhours.works · https://smallhours.works/callflow/ · Privacy: https://smallhours.works/callflow/privacy · Terms and refunds: https://smallhours.works/callflow/terms