Cloudflare has released the debugging tool its own Privacy team leans on when privacy-preserving protocols misbehave. The company open-sourced pvcli — short for “privacy-client” — on July 27 under the Apache-2.0 license, turning what used to be an internal collection of one-off scripts into a single curl-style command-line tool anyone can install and extend.
The pitch is simple: a full Oblivious HTTP request, complete with a relay, a gateway, and a target, executed from one command line. That matters because Oblivious HTTP — OHTTP, standardized in RFC 9458 — is deliberately hard to see into. The protocol’s privacy guarantee is that no single party can know both who made a request and what that request contains, and it achieves that by splitting the work between a relay and a gateway operated by two non-colluding parties. Eight distinct steps sit between a client encrypting a request and reading back a plaintext response, and Cloudflare’s engineers note that every one of them is a potential point of failure when something breaks.
The debugging pain pvcli was built to kill
Cloudflare runs OHTTP infrastructure at serious scale — the company says its Privacy Proxy and Privacy Gateway products handle millions of requests per second and power Apple’s Private Relay, Microsoft’s Edge Secure Network VPN, and Flo Health’s Anonymous Mode. With that customer base came recurring, tedious failure investigations.
The announcement walks through what a single end-to-end OHTTP test looked like before the tool existed. Engineers fetched a gateway’s key configuration with curl and got back a wall of hex, which they then decoded by hand against RFC 9458 — 41-byte key entries, KEM identifiers, symmetric algorithm IDs. Then they hand-built a binary HTTP request per RFC 9292, encrypted it with bespoke scripts, and mailed the bytes off to a relay. In the worked example, the response was a bare “malformed request” — eventually traced to a single stray 0x20 space character that broke the length-prefixed body encoding.
With pvcli, that whole exercise collapses into one invocation:
pvcli --ohttp \
--first-hop https://relay-cloudflare.ohttp.info \
--proxy https://gateway.ohttp.info \
-X POST \
--header "content-type: application/json" \
--data '{"test":1}' \
https://target.ohttp.info/anything
The tool handles key-config parsing, binary HTTP encoding, and encryption itself, and a -vvv flag dumps every intermediate artifact — decoded client configs, the BHTTP bytes, the encrypted payload — so an engineer can pinpoint which of the protocol’s steps actually failed instead of eyeballing raw hex.
Deliberately curl-shaped
Cloudflare says pvcli was designed around the “principle of least surprise,” and many of its arguments are intentionally identical to curl’s: -X for methods, --header, --data, and verbosity stacking with -v through -vvv. It also speaks HTTP/3 directly via an --http3 flag for plain requests.
Beyond the basics, the flags reflect problems Cloudflare hit in real customer deployments. --first-hop-header sends a header to the relay rather than the target — useful for relay-side bearer-token authentication. --first-hop-client and --first-hop-key add mutual TLS toward the relay, for deployments that need to prove exactly which client is connecting. The team notes it repeatedly wrote custom one-off clients for individual customers’ configurations before consolidating everything here.
Installation goes through Rust’s package tooling: cargo install --git pointed at the cloudflareresearch/pvcli repository, which is public now and accepting pull requests.
One tool, several protocols
Cloudflare is candid that OHTTP debuggers already exist — the post credits Martin Thomson’s Rust implementation and Chris Wood’s Go implementation as foundational to its own early work. The differentiator it claims is breadth: pvcli combines OHTTP, CONNECT proxying, and MASQUE in one place, with Privacy Pass support described as coming soon. No other open-source tool bundles that set, the company argues.
The public to-do list doubles as a roadmap. For MASQUE, the team plans TCP proxying over HTTP/3 plus UDP and IP proxying over both HTTP/2 and HTTP/3. On the OHTTP side, it wants post-quantum cryptography support, request timing and latency reporting, Chunked OHTTP, and better logging.
The practical takeaway depends on who you are. If you operate or consume an OHTTP deployment — as a relay operator, an app developer using a privacy gateway, or someone building a client implementation against the RFCs — pvcli gives you a reference client that shows its work at every step, maintained by the team that runs one of the largest OHTTP fleets in production. And if you have simply wondered how “no one sees both who and what” actually functions on the wire, running the tool’s echo-server example with full verbosity is now the fastest guided tour available: every key fetch, encoding pass, and encryption step printed in order, no hex arithmetic required.
