Hetty combines a proxy, replay client, and web interface
The README lists 6 core jobs for Hetty: proxying, logging, replay, interception, scope, and project storage. It captures HTTP traffic through a machine-in-the-middle proxy and lets a tester search the log. A captured request can move into Sender for editing and replay. Intercept mode pauses requests or responses for manual changes, while scope rules keep unrelated hosts out of view. The browser interface makes those jobs approachable without turning every action into a terminal command.
That scope is narrower than the README's comparison with Burp Suite Pro may suggest. Hetty covers those 6 manual jobs, but it does not claim the large scanner, extension, collaboration, and reporting surface found in a commercial suite. The project calls itself under active development. Treat it as a focused HTTP workbench for the manual core of a test, not as a drop-in copy of every Burp workflow.
A 15-second install still leaves certificate work
Our source build finished in 6 seconds, and package-manager routes exist for Homebrew, Snap, and Scoop. The release page provides binaries for other supported systems. Docker users can map port 8080 and mount ~/.hetty so the database and certificate material survive container replacement. The README still says a source-compilation link is coming later, an awkward omission for an open-source Go tool even though our own build completed.
Starting Hetty creates a root CA certificate, its private key, and a local database, all used by the service on port 8080. You then create a project and configure a browser to use the proxy. The documented shortcut launches Chrome with proxy settings applied and certificate errors ignored. Otherwise, HTTPS inspection requires trusting Hetty's CA on the test system. The private key and captured traffic deserve the same storage controls as other assessment evidence.
What happened when we ran it
Our sandbox install succeeded in 15 seconds and installed 82 packages. Building commit 8ca6b07 then succeeded in 6 seconds. The checkout contained 168 files, roughly 23,372 lines of source, and occupied 1 MB before dependencies. It also had a Dockerfile and 2 CI workflow files. There was no top-level tests directory, which is ordinary for Go because test files commonly sit beside the packages they cover.
The test command ended with exit code 1 after 30 seconds. Go test reported 8 passed and 5 failed out of 13. The supplied tail identifies cmd/hetty as a setup failure and shows TestResponseModifier failing under pkg/reqlog; the run ends in FAIL. It also shows passing results for packages including pkg/db/bolt, pkg/filter, pkg/proxy/intercept, and pkg/sender. The excerpt does not expose the underlying error for every failed target, so claiming one shared cause would be guesswork.
The default :8080 listener needs a trusted network
Hetty's help text defaults to :8080, and the getting-started guide describes that as 0.0.0.0:8080. Open issue 141 reports that a remotely reachable listener exposes the admin UI and GraphQL API without authentication. Issue 106 separately reports a DNS rebinding path against the API. Both reports remain open. They should inform deployment even if you plan to use the application alone: bind narrowly, filter the port, and do not publish it as a convenience dashboard.
Open issue 153 goes further, reporting that a deeply nested GraphQL search expression can exhaust the Go stack and stop the process. A proposed fix exists in pull request 154, but the issue and pull request were still open when fetched. Issue 143 reports unbounded request and response body reads in logging and interception code, with possible memory and disk exhaustion. These are reports in the project's tracker rather than findings from our sandbox, yet each concerns an exposed core path rather than an optional plug-in.
Interception works, while edge cases remain open
The v0.7.0 release added the Intercept module in March 2022. It lets a tester review, edit, forward, or cancel a paused request or response from the web interface. That is the feature that turns a passive traffic log into a practical testing tool. Scope filters and search expressions also help when a browser session includes analytics, fonts, and unrelated background requests.
Current tracker activity shows unfinished edges in that same flow. Issue 145 says cancelling an intercepted request can dereference a nil pointer and panic. Pull request 161 addresses a request-table crash when stored sender URLs are invalid. Issue 158 asks for mTLS support because target-specific client certificates cannot be supplied. Anyone assessing enterprise systems that require a .p12 client identity should check that requirement before installing Hetty.
July 2026 code activity has not reached a newer release
The repository's last push was July 21, 2026, and issue or pull-request activity continued into August. GitHub listed 12,348 stars plus 48 open issues and pull requests, split into 27 issues and 21 pull requests in the open API result. Those figures show continuing interest and incoming work. They also show a queue that asks a buyer to inspect which fixes have merged instead of treating popularity as maintenance proof.
The latest tagged release remains v0.7.0 from March 29, 2022. The website's getting-started page still prints a v0.5.1 startup example and describes BadgerDB under ~/.hetty/db/, while the current README documents a ~/.hetty/hetty.db file and our test log names the Bolt package. The 2026 push date argues against calling the project abandoned. The gap between current code, old release material, and conflicting setup text is enough to keep Hetty in the evaluate-carefully category.