macOS native · local dev domain proxy with an MCP server
Local HTTPS dev domains,
configured by your AI agent
Lixeam runs dnsmasq, Nginx and a local certificate authority on your Mac and publishes them over MCP. Ask Claude or Cursor to proxy a dev server as app.test: the rule is written, validated against Nginx and reloaded, and the browser gets a hostname it trusts instead of localhost:5173.
Requests, private keys and certificates stay on your Mac. The app contacts the payment provider at license activation and on periodic checks, with an offline grace period.
you
proxy my dev server as app.test
tool Lixeam · proxy_adddomain "app.test"target "127.0.0.1", 5173https trueresult ✓ live, nginx reloadedFor agents
Five MCP tools for proxy rules
The app embeds an MCP server: an HTTP endpoint on the loopback address behind a token, and a stdio binary an agent can spawn directly. Both expose the same five tools.
proxy_addmap a domain to host:portproxy_listlist rules with upstream port statusproxy_enableenable a ruleproxy_disabledisable a ruleproxy_removeremove a ruleEvery change passes nginx -t before reload, and a failed check rolls the config back. A bad rule written by an agent cannot leave the proxy unusable.
The domain works as soon as the tool call returns; there is no window to operate.
Features
A hostname the browser trusts, without a hosts file
localhost:5173 is enough until something involves cookies: OAuth redirect URIs, the Secure and SameSite flags, a shared parent domain, a service worker scope. Those need a real hostname.
Certificates from a local root CA
mkcert creates a local root and a *.test wildcard certificate, so the connection is genuinely HTTPS. Secure cookies, SameSite handling and service workers behave the way they do against a production domain.
One suffix, not your hosts file
/etc/resolver/test directs only the .test suffix to a local dnsmasq. Adding a site adds a rule, and the hosts file keeps whatever you already wrote in it.
Ports 80 and 443, authorized once
A small privileged helper lets Nginx bind the standard ports. Skip it and the proxy runs on 8080 / 8443, with the same behaviour and the port in the URL.
WebSocket passes through
Hot reload and log streaming need no extra configuration; the Upgrade headers are forwarded unchanged.
Upstream status in the list
Each site shows whether the port it points at is open. The connect timeout is 3 seconds, so a stopped server returns 502 quickly instead of leaving the tab hanging.
Pass-through proxying
A rule matches the domain and forwards to the upstream: no rewriting, no compression, no added headers. Your framework receives the request the browser sent.
How it works
From hostname to your dev server
Resolve
The browser looks up app.test; macOS sends that suffix to the local dnsmasq through /etc/resolver/test, and it answers 127.0.0.1. Other domains resolve as they did before.
Match
nginx listens on 80 / 443 and selects your rule by server_name. For HTTPS it terminates TLS with the local certificate, then forwards to the host and port written in the rule.
Forward
Upstream defaults to 127.0.0.1. localhost resolves on both stacks and Nginx may pick one at random, which 502s against a single-stack server; IPv6-only services take ::1, and a LAN address works too.
- app.test127.0.0.1:5173Running
- api.test127.0.0.1:8080Running
- web.test127.0.0.1:3100Down
browser https://app.test | lookup .test -> /etc/resolver/test v dnsmasq 127.0.0.1 | v nginx :80 / :443 -- TLS terminated with the local mkcert pair | server_name app.test -> proxy_pass v your app 127.0.0.1:5173
Compared with
Against the alternatives
These are the workarounds developers reach for. None of them gives an agent a way to manage the proxy, and none reports whether an upstream port is actually open.
Scroll the table sideways to see every column
| Compared on | Lixeam | Laravel Valet | Editing hosts | lvh.me / sslip.io |
|---|---|---|---|---|
| Setup | One installer | CLI + Homebrew stack | Manual, per site | Nothing to install |
| Trusted HTTPS | Automatic | valet secure, PHP-oriented | You build it yourself | None |
| Driven by an AI agent | MCP, 5 tools | Agent must shell out | Root edits by hand | Not applicable |
| Upstream port status | Green / grey in the GUI | valet status, per site | curl for each one | curl for each one |
| Works with any stack | Yes, by port | PHP / Laravel first | Yes | Yes |
| Platform | macOS | macOS / Linux | Everywhere | Everywhere |
Valet is for your terminal. Lixeam is for your agent.
Pricing
Buy once, or pay monthly
A personal license covers two Macs, and one-time licenses include future major versions. There is no account to create: the license key is verified against the payment provider at activation.
Early Bird
Early Bird$29one-time
Available during the launch window only
- 2 Macs
- Lifetime use
- All future major versions
- 14-day full trial first
Standard
Recommended$49one-time
The regular license after launch
- 2 Macs
- Lifetime use
- All future major versions
- Email support
Monthly
$4.90per month
Stop paying when the project ends
- 2 Macs
- Cancel any time
- Same feature set
- Auto-renewal
Team
$199one-time
12 devices for a two or three person studio
- 12 devices
- Lifetime use
- All future major versions
- Team licensing channel
Free trial
14 days with every feature, no card required. Students with a school email use it free.
Open source and paid
The core stays on GitHub if you would rather assemble dnsmasq, Nginx and mkcert yourself. The paid app is the signed and notarised build: onboarding, the GUI, certificate handling, port monitoring, the MCP endpoint and updates.
Getting started
One install and one administrator password
Step 1
Install and run onboarding
Move Lixeam to Applications and launch it. Onboarding installs the privileged helper, trusts the local root certificate and writes /etc/resolver/test. It asks for an administrator password once.
Step 2
Point a domain at a port
Enter the hostname and the port your dev server listens on, or say it to your agent and let it call proxy_add.
Step 3
Open the domain
The rule is written into the Nginx config, validated, then reloaded. In practice it is ready before you switch back to the browser.
Requires macOS 11 or later. Desktop only; the signed download appears here once notarisation is done.
Early access
Join the early access list
One email when the signed build is downloadable, one before the Early Bird window closes.
FAQ
Before you install
Why .test instead of .local or the hosts file?+
.test is reserved by ICANN and never appears in public DNS, so a local domain cannot collide with a real site later. .local belongs to Bonjour/mDNS and is often intercepted by the system. hosts works too, but it means editing a system file per site and writing every subdomain by hand.
Why does it need a privileged helper?+
Only root can bind ports below 1024, and 80 / 443 are what make the address bar clean. The helper is a small LaunchDaemon that talks to the app over a Unix socket on the loopback address and opens no network port. You authorize it once at install. Skip it and the proxy runs on 8080 / 8443, with the same behaviour and the port in the URL.
Does activation need the internet?+
It needs it occasionally. The license key is verified against the payment provider at activation and on a periodic check, with a local grace period so an offline machine keeps working. Your requests, certificates and private keys never leave the Mac, and no analytics are collected.
It is open source — why pay?+
The free path assumes you are comfortable installing and maintaining Nginx, dnsmasq and mkcert, and writing the server blocks yourself. The paid app is the notarised build where all of that is already done, plus the GUI, port monitoring, the MCP endpoint, updates and support.
How many machines, and are updates included?+
Two Macs on a personal license, 12 devices on Team. One-time licenses include every future major version. To move a license to another machine, unbind the old one from the License Manager (/license) — no need to email support, even if the old Mac is broken or lost.
Will it touch my corporate network or other sites?+
Only the .test suffix is intercepted; resolution for every other domain is untouched. Nginx listens on the loopback address, so nothing is exposed to your LAN or the internet.
What happens when the upstream is not running?+
The domain still resolves and Nginx returns 502 within three seconds, while the site shows a grey dot in the list.
Windows or Linux?+
Not yet. The implementation depends on macOS specifically: a LaunchDaemon for privilege, /etc/resolver for suffix-level DNS, and the login keychain for certificate trust. Porting means reimplementing all three.