Open-Source OHTTP Tooling Makes Privacy Proxy Testing Easier to Audit

Privacy-proxy infrastructure is becoming easier to test as a complete system rather than as a collection of opaque components. On 27 July 2026, Cloudflare announced that it had open-sourced pvcli, a command-line tool designed to exercise and debug privacy-preserving protocols including Oblivious HTTP, commonly called OHTTP.

The announcement matters beyond one tool. It reflects a broader operational shift: teams deploying privacy proxies increasingly need reproducible evidence of what the relay, gateway, encryption layer and target each observed. A final success response alone does not prove that the intended privacy separation worked.

What was released

Cloudflare described pvcli as a curl-like interface for testing privacy protocols. The project was released under the Apache-2.0 license and opened to contributions. Its initial capabilities include ordinary HTTP requests, HTTP/3 diagnostics and OHTTP flows, with detailed logging that exposes protocol stages without requiring operators to decode raw binary messages by hand.

The company said its motivation came from operating privacy systems at large scale and repeatedly encountering difficult multi-party debugging. Previously, teams often assembled one-off clients, manually inspected binary HTTP data and compared logs from different organizations. A unified client makes the same test easier to reproduce during development and incident response.

Why OHTTP needs a different test model

OHTTP is designed so that no single participating service knows both who sent a request and the plaintext content of that request. The client encrypts the request for a gateway, but first sends it through a relay. The relay can see the client connection but cannot read the encrypted request. The gateway can decrypt the request and forward it to the target, but should not receive the client's original network identity.

This property depends on architectural separation. The relay and gateway are intended to be operated as non-colluding parties. If they share identifying data or coordinate observations, the privacy guarantee is weakened. Encryption alone is therefore insufficient; deployment boundaries, logging practices and request metadata must also be tested.

The four checkpoints operators should verify

• Client to relay: confirm the client uses the expected relay, obtains valid gateway configuration and sends only the metadata the relay requires.
• Relay to gateway: confirm the relay forwards the encrypted message without adding an identifier that reveals the client.
• Gateway to target: confirm the gateway can decrypt and reconstruct the intended request while the target sees no original client address.
• Response path: confirm the response is encrypted for the client and that errors identify the failed stage without exposing secrets.

Useful evidence includes stage-level latency, key configuration identifiers, protocol negotiation, request size, response status and redacted error categories. Logs should never contain private keys, authentication tokens or unnecessary client identifiers.

Privacy proxy and residential proxy are not interchangeable

The word “proxy” covers several architectures with different jobs. OHTTP is primarily designed to reduce linkability between a requester and discrete privacy-sensitive requests. It works best for transactional use cases that do not require a persistent user session.

A residential proxy, by contrast, gives an authorized workflow a residential network exit in a chosen geography. It is commonly evaluated for localization testing, ad verification, market research and public-web data collection. These tasks may require stable cookies, a consistent regional identity or a controlled rotation policy. OHTTP's deliberate separation and statelessness do not replace those requirements.

Buyers should begin with the outcome: protect unlinkable telemetry, validate regional content, preserve a session, or rotate network identity. Selecting a product because both categories contain the word “proxy” can create the wrong privacy, performance and operational assumptions.

What procurement teams should ask now

• Which party can observe the client address, plaintext request and final destination?
• Are relay and gateway operations organizationally separate?
• What metadata is retained, for how long, and for what purpose?
• Can a test reproduce each protocol stage and export redacted diagnostics?
• How are keys rotated and configuration failures reported?
• Which HTTP versions and proxy transports are supported?
• What happens when the relay, gateway or target times out?
• Does the intended workflow require a persistent identity that OHTTP is not designed to provide?

Implications for regional proxy testing

The new tooling does not remove the need for ordinary proxy benchmarks. For localization or ad-verification work, teams still need to measure usable-result rate, expected country and city, session continuity, latency percentiles, challenge rate and cost per valid result.

98IP's rotating residential proxies can be evaluated where authorized testing benefits from controlled identity changes. Workflows that require a longer-lived regional identity can compare static residential proxies. Neither product should be described as OHTTP unless it implements the relevant protocol and deployment model.

Limits and compliance

Open-source diagnostics improve transparency, but they do not prove that two production operators never collude, that retention policies are followed or that every implementation is secure. Independent architecture review, access controls, minimized logging and documented incident procedures remain necessary.

98IP provides the residential proxy services referenced above, and this article is published by the 98IP team. Use proxy infrastructure only for systems and data you are authorized to access. Respect destination terms, privacy obligations and rate limits; privacy technology is not permission to conceal abuse or bypass access controls.

Source note

News basis: Cloudflare, “We’re open-sourcing our privacy proxy CLI,” published 27 July 2026; OHTTP architecture checked against RFC 9458. Source names, titles and dates are recorded as plain text under 98IP's zero-external-link policy.

Bottom line: the important change is not simply that another proxy tool is open source. It is that privacy-proxy operators now have a clearer path to test who can see what, identify the stage that failed and document whether the intended separation survived a real request.