Cloudflare Open Sources pvcli

Debugging privacy-preserving protocols has always been painful, and that’s exactly the gap Cloudflare pvcli was built to close.

You can’t just log the request and look at it, because most of it is encrypted by design.

Cloudflare just made this easier.

It open-sourced Cloudflare pvcli, a command-line tool built to debug protocols like Oblivious HTTP (OHTTP).

The same privacy-first approach also powers WooCommerce Cloudflare Turnstile, which verifies real users without relying on traditional CAPTCHA challenges or invasive tracking.

Why This Is Hard in the First Place

Normal HTTP debugging is simple.

You send a request, read the response, and you’re done.

Privacy protocols don’t work that way.

A single OHTTP request passes through multiple parties before it reaches its destination.

How a Request Travels

Here’s what happens at each hop:

• The client encrypts the request and sends it to a relay.
• The relay sees the client’s IP, but can’t decrypt the request.
• The gateway decrypts the request, but never learns the client’s IP.

Each of these steps can fail on its own.

Key retrieval, encryption, binary encoding, relay forwarding, and response decryption all add their own points of failure.

Without the right tooling, debugging any of this means manually inspecting binary payloads and cryptographic handshakes.

That’s slow, and it’s easy to get wrong.

If you want the full technical background, the OHTTP specification (RFC 9458) Covers the protocol in detail.

How Cloudflare pvcli Simplifies OHTTP Debugging

Cloudflare pvcli handles the repetitive parts of working with OHTTP automatically.

It fetches the gateway’s public key, builds the Binary HTTP request, and encrypts the payload.

It then routes that payload through the relay and gateway, and decrypts the response.

All of this happens with a single command.

If something goes wrong, pvcli can print detailed logs.

You can see exactly what happened at each step, right in your terminal.

Before and After pvcli

The Old Way

Before pvcli, developers debugging OHTTP usually wrote custom scripts for each step.

That meant manually building Binary HTTP payloads and handling encryption by hand.

It also meant checking hex-encoded fields by eye to catch typos.

A single small mistake in that process could break the entire request.

Finding it often took hours of manual digging.

The Cloudflare pvcli Way

pvcli removes that fragility.

What used to take hours now takes seconds.

Using Cloudflare pvcli

Here’s what sending an OHTTP request with pvcli looks like:

pvcli -vvv --ohttp \
    --first-hop https://relay-cloudflare.ohttp.info \
    --proxy https://gateway.ohttp.info \
    -X POST \
    --header "content-type: application/json" \
    --data '{"test":1}' \
    https://target.ohttp.info/anything

This one command builds the request, encrypts it, routes it through the relay and gateway, and prints the decrypted result.

Getting Started with Cloudflare pvcli

Installation

pvcli is written in Rust and released under the Apache 2.0 license.

If you already have Rust installed, you can install it straight from the pvcli GitHub repository:

# install rust if not already installed
curl https://sh.rustup.rs -sSf | sh
# install pvcli
cargo install --git https://github.com/cloudflareresearch/pvcli

Documentation

The source code and full docs live on Cloudflare Research’s GitHub.

It covers advanced setups like custom relays, gateways, target servers, and mTLS authentication.

pvcli is also open to contributions — if you’d like to help build out support for MASQUE or Privacy Pass, you can open a pull request on the GitHub repo.

Why Open Source Matters

Cloudflare pvcli started as an internal tool.

Cloudflare built it to debug OHTTP while running privacy proxy infrastructure at scale.

Open-sourcing it was the natural next step.

It lets the wider community test, audit, and build on top of it.

pvcli is useful for OHTTP today.

Cloudflare expects it to extend to related privacy protocols like MASQUE over time.

Conclusion

pvcli fills a real gap in privacy protocol tooling.

It turns a slow, error-prone debugging process into a single command.

By open-sourcing it, Cloudflare is making privacy-preserving protocols a little more approachable for everyone building with them.