Caido - Lightweight Web Security Auditing Toolkit

TL;DR

TL;DR: Caido is a lightweight, headless web security proxy with AI-powered analysis, HTTPQL query language for precision filtering, and a plugin ecosystem built on open formats — designed for solo hackers and teams who find Burp Suite too heavy.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: caido.io ← MUST visit and verify
• Documentation: docs.caido.io ← MUST read for feature verification
• GitHub (releases, wiki, roadmap): github.com/caido/caido ← releases and roadmap only; core product is proprietary
• HN launch thread: news.ycombinator.com/item?id=44041955 ← Show HN, 17 points
• License: Core product is proprietary (Free tier available); supporting libraries on GitHub use Apache-2.0 and MIT
• Source last checked: 2026-08-04 (v0.57.1)

What Is Caido?

Caido is a web security auditing toolkit that positions itself as a faster, lighter alternative to traditional proxies like Burp Suite. It is built around a headless, API-first proxy architecture, meaning you can script and automate it in ways that GUI-based tools make difficult.

The core use case is manual and semi-automated web application security testing — intercepting HTTP traffic, identifying vulnerabilities, and triaging findings. Where Caido differentiates is in three areas:

1. HTTPQL — a query language for filtering requests and responses with boolean logic, regex, and structural selectors
2. AI-powered analysis — context-aware autonomous agents that draft payloads and execute tasks while you focus on logic
3. Team collaboration — shared projects, sync, and a dashboard designed for security teams

“Caido aims to help security professionals and enthusiasts audit web applications with efficiency and ease.” — caido.io

What Caido Is Not

Caido’s own FAQ is honest: “Caido is not currently open source.” The core binary is proprietary, and there is no public roadmap for open-sourcing it. However, the project maintains a vibrant open source plugin ecosystem and uses open formats (HAR exports, OpenAPI schemas) as first-class citizens.

If you need a fully open-source proxy, see mitmproxy or OWASP ZAP. Caido competes on UX and automation ergonomics, not on licensing philosophy.

Setup Workflow

Step 1: Download and Install

Caido provides native binaries for macOS, Linux, and Windows. No package manager or build step required for the GUI.

# Download from https://caido.io/download
# Or use the dashboard to manage installations

# CLI download (Linux example)
curl -L -o caido https://cdn.caido.io/caido/latest/linux-x86_64
chmod +x caido
./caido

After first launch, you create a free Basic account at dashboard.caido.io to activate the free tier.

Step 2: Configure Your Browser

Caido works as an HTTP(S) proxy. Configure your browser or system to route traffic through localhost:8080 (default):

# Caido proxy listens on localhost:8080 by default
# Set your browser/system proxy to: http://localhost:8080
# For HTTPS interception, install the Caido CA certificate
# Docs: https://docs.caido.io/proxy/certificates.html

For browser automation, Caido provides a Client SDK for programmatic control:

# Install the Caido client SDK
npm install @caido/sdk

import { Caido } from "@caido/sdk";

const caido = new Caido({
  host: "localhost:8080",
  apiKey: process.env.CAIDO_API_KEY,
});

// Start a scan
const scan = await caido.proxy.start();
console.log(`Scan started: ${scan.id}`);

Step 3: Explore HTTPQL Filtering

HTTPQL is Caido’s domain-specific query language for filtering intercepted traffic. It replaces the buried-under-tabs filter panels of traditional proxies:

# Find all POST requests to /api/ that returned 4xx status
method:POST AND path:/api/* AND status:4xx

# Requests containing "Authorization" header with JSON responses
header:Authorization AND response.json AND status:200

# Parameters named "id" with SQL injection patterns
param:id AND (value:"'" OR value:"1=1" OR value:"UNION")

Step 4: Install Plugins

The community plugin ecosystem extends Caido’s capabilities. From the app or the plugins directory:

# Via Caido UI: Settings → Plugins → Browse Community
# Search and install from the built-in marketplace

Community plugins cover passive reconnaissance, payload generation, notification integrations, and more.

Deeper Analysis

Performance Profile

Caido is built in Rust, which contributes to its fast startup and low memory footprint compared to JVM-based tools. The headless architecture means it can run on remote servers via SSH without a display, a significant workflow advantage for persistent monitoring setups.

The proxy itself is a lightweight Go binary. The heavy lifting (UI, plugins, cloud sync) runs in a separate process. This separation means the intercept engine is not blocked by UI rendering.

AI Integration

Caido supports connecting to Anthropic, Google, OpenAI, and any provider supported by OpenRouter. The AI features are scoped to:

• Context-aware testing agents — autonomous sub-agents that probe specific endpoints based on detected patterns
• Payload drafting — AI generates fuzzing payloads tailored to the detected parameter types
• Finding triage — AI summarizes and prioritizes logged findings

These are not autonomous scanners. You remain in the loop; AI assists but does not replace manual testing judgment.

Team Features

The paid tiers add:

• Shared projects — sync configuration, notes, and findings across a team
• Cloud dashboard — aggregate results from multiple scan instances
• Role-based access — Individual, Professional, and Enterprise tiers with different seat limits

The free Basic plan is capped at 2 projects, 7 workflows, 3 plugins, and 5 filter presets. It is intentionally generous for solo evaluation but insufficient for active bug bounty work.

Compared to Burp Suite

Caido’s explicit comparison page makes the competitive positioning clear:

| | Caido | Burp Suite Professional | |---|---|---| | Architecture | Headless, API-first | GUI desktop app | | AI integration | Native, multi-provider | Via extensions | | Workflow automation | Node-based graph editor | Macro/extension scripting | | Mobile testing | Via proxy config | Dedicated mobile assistant | | Pricing | Free tier + $29/mo Individual | $449.99/year |

Burp Suite has a deeper vulnerability detection engine (active scanner) and industry-standard fingerprinting. Caido wins on automation ergonomics, speed, and team features.

Practical Evaluation Checklist

• [ ] Proxy intercepts HTTP and HTTPS with cert installation
• [ ] HTTPQL filters work with complex boolean queries
• [ ] AI agents connect to your preferred LLM provider
• [ ] Community plugins install and run without crashes
• [ ] Project export to HAR format for external analysis
• [ ] API key authentication for programmatic access
• [ ] Discord community provides responsive support

Security Notes

• Data collection: Caido collects your email, name, and user agent on registration. During use, it logs API call timestamps and instance IPs — but not the content of your traffic or in-app interactions. (Source: pricing page FAQ)
• Self-hosting: All processing can be local. Cloud sync is opt-in on paid tiers.
• CA certificate: HTTPS interception requires installing Caido’s root CA on your device. Treat this with the same care as any other man-in-the-middle certificate.
• Plugin sandboxing: Community plugins run in the same process space as Caido. Audit plugin source code before installation, just as you would any browser extension.

FAQ

Q: Is Caido open source? A: The core Caido product is proprietary. The GitHub organization (github.com/caido) publishes supporting libraries (e.g., a SQL query builder,SeaQuery) under Apache-2.0, but the main binary is not open source.

Q: How does the free Basic tier compare to Burp Suite Community? A: Basic gives you 2 projects and 7 workflows with unlimited installations across devices. Burp Community is also free but limited to a single project and lacks workflow automation. Caido Basic is more generous for multi-project researchers but lacks Burp’s active scanner.

Q: Can I use Caido for mobile app testing? A: Yes. Configure your mobile device to route traffic through the Caido proxy at your machine’s IP address on port 8080. Install the Caido CA certificate on the mobile device for HTTPS interception.

Q: Does Caido have an API? A: Yes. The REST API and Client SDK allow programmatic proxy control, project management, and finding retrieval. API keys are managed via the dashboard.

Q: What is the pricing for the Individual plan? A: Pricing is displayed on the pricing page (skeleton loading was observed during verification). Check caido.io/pricing for current Individual plan pricing.

Conclusion

Caido is a well-positioned alternative to Burp Suite for security testers who want speed, automation, and modern UX. The headless architecture and AI integration are genuinely differentiated. The free tier is worth installing purely to evaluate whether the HTTPQL workflow and team features justify the paid plans.

The proprietary licensing is a legitimate concern for auditors who require open-source toolchains, but it does not diminish the product’s practical value for independent researchers and teams.

Try it: Download Caido — no credit card required for the free Basic tier.