HTTP Engine & Rewrites
[http-engine]
This section configures the internal HTTP engine.
| Key | Type | Description |
|---|---|---|
enabled | Boolean | Enables the HTTP engine. Default false. |
capture-all | Boolean | Process every IPv4 destination on configured TCP ports; default false. Saved domain/CIDR lists remain intact. |
cidr-list | List of IPv4 CIDRs | Additional destination-IP capture scope. |
port-list | List of integers | TCP ports from 1–65535; default 80,443. |
http3-policy | allow or block | Default allow. Blocking HTTP/3 can encourage compatible clients to retry over TCP; it is not HTTP/3 decryption. |
mitm-bypass-apple-services | Boolean | Default true; avoid decrypting known Apple service domains. |
mitm-bypass-domain-list | List of domain suffixes | Additional domains that must not be decrypted. |
upstream-tcp-receive-window | Integer | Advanced upstream receive-window size in bytes: 4096–1048576, default 262144. |
domain-list | List of domain suffixes | Domains to apply HTTP processing on; supports * for all domains. |
ca-p12 | String | A base64 encoded PKCS#12 certificate authority. Note: Only RSA keys are currently supported. |
ca-passphrase | String | The passphrase for the ca-p12 certificate. |
Example:
[http-engine]
enabled=true
domain-list=example.com
ca-p12=...
ca-passphrase=...
[http-url-rewrite]
This section defines URL rewrite rules for the HTTP engine. The key is a user-defined name for the rule.
| Key | Type | Description | Required |
|---|---|---|---|
match | Regexp | A regular expression to match the URL. | Yes |
action | String | The action to take. Supported: reject, redirect-302. | Yes |
target | String | The target URL for redirection. | No |
enabled | Boolean | Default true. | No |
Example:
[http-url-rewrite]
block-ads=match:^https?://ads\..*,action:reject
redirect-google=match:^https?://google\.com,action:redirect-302,target:https://duckduckgo.com
[http-body-rewrite]
Named request or response body rules reference managed local scripts. The app's editor and MFHRB importer manage the script resource and its profile reference. Do not paste a remote script URL here and expect automatic fetching or updates.
| Field | Meaning |
|---|---|
match | Required regex over the normalized full URL; at most 4096 UTF-8 bytes. |
direction | request or response; default response. |
type | Required: jq or javascript. |
body-mode | json or text; jq requires JSON (default json for jq, text for JavaScript). |
script | Required managed local resource reference, produced by the editor/importer. |
priority | 0–1000000; default 100. Lower values run first; ties sort by rule name. |
enabled | Default true in profile syntax. MFHRB imports always save it disabled. |
api-version | 1. |
timeout-ms | JavaScript only: 50–2000 ms, default 500. |
The portable JSON bundle uses camel-case keys such as bodyMode and timeoutMS; profile text uses body-mode and timeout-ms. They are different formats. Use the MFHRB guide for a complete shareable example, API contract, and review workflow.
For example, if the managed resource ./feed-cleanup/remove-banner.jq already exists in this profile's script storage:
[http-body-rewrite]
remove-banner=match:^https://api\.example\.com/feed$,direction:response,type:jq,body-mode:json,priority:100,enabled:false,api-version:1,script:./feed-cleanup/remove-banner.jq
The referenced jq source could be .items |= map(select(.kind != "banner")) for a JSON object with an items array. The profile line does not create that file. Import an MFHRB bundle or use the app's script editor to manage the resource, and review it before enabling the rule.