SYSTEM Cited by 1 source

pvcli

pvcli (privacy-client) is Cloudflare's open-source Rust CLI tool for debugging privacy-preserving protocols. Released under the Apache 2.0 License at github.com/cloudflareresearch/pvcli.

What it does

pvcli consolidates debugging of Oblivious HTTP (OHTTP), CONNECT proxying, and HTTP/3 into a single curl-inspired interface. For OHTTP, a single command handles:

1. Fetching the gateway's public key configuration
2. Parsing the binary key config (RFC 9458 §3)
3. Encoding the inner HTTP request as Binary HTTP (RFC 9292)
4. Encrypting the request with the gateway's public key (HPKE)
5. Sending through the relay
6. Receiving and decrypting the response

With -vvv, every intermediate step is logged — decoded key configs, binary HTTP hex dumps, encrypted payloads — replacing the fragile manual process of hand-encoding bytes and cross-referencing RFCs.

Design principles

• curl-compatible arguments — -X POST, --header, --data, -v work as expected (principle of least surprise)
• Multi-party topology flags — --first-hop (relay), --proxy (gateway), --first-hop-header (relay-only headers), --first-hop-client/--first-hop-key (mTLS to relay)
• Multi-protocol — not OHTTP-specific; designed to accumulate privacy protocols in one place

Roadmap

• MASQUE: TCP over HTTP/3, UDP/IP over HTTP/2 and HTTP/3
• Privacy Pass support
• Post-quantum cryptography
• Chunked OHTTP
• Timing/latency instrumentation

Operational context

Born from Cloudflare's Privacy team operating protocols at millions of requests per second across products including Apple's iCloud Private Relay, Microsoft's Edge Secure Network VPN, and Flo Health's Anonymous Mode. Before pvcli, each customer deployment required bespoke debugging scripts.

Seen in

• sources/2026-07-27-cloudflare-open-sourcing-privacy-proxy-cli — launch announcement and architectural motivation