DevCatz needs a few system-level changes to give your sites real names and HTTPS. None happens at first launch. Each one is a button in Settings, behind a dialog that says what it is about to do, and each one has its own way back. DBCatz needs no admin rights at all.
When a change needs administrator rights, DevCatz asks through the standard macOS password dialog (and macOS’s own Keychain prompt for the certificate). Cancelling leaves everything as it was.
Trusting the local certificate authority
| Button | Settings → Project → Trust certificate authority… |
| What it does | Adds DevCatz Local CA to your login keychain as trusted for SSL, so https://*.localhost opens without warnings. |
| Where it lives | ~/Library/Application Support/DevCatz/certs/ca.crt and ca.key (readable only by you). Each site gets its own certificate signed by it. |
| Scope | Your user only (login keychain), not the whole Mac. |
| Undo | Settings → Project → Remove from keychain. |
The CA’s private key never leaves your Mac. Anyone who could read it could make certificates your browser trusts — which is why it is stored only readable by your user, like an SSH key.
URLs without a port (“clean URLs”)
| Button | Settings → Project → Enable clean URLs… |
| What it does | Installs two LaunchDaemons, com.mrcatz.herd.forward-https and com.mrcatz.herd.forward-http, in /Library/LaunchDaemons. launchd listens on ports 443 and 80 and hands each connection to /usr/bin/nc, running as the unprivileged user nobody, which forwards it to DevCatz’s proxy on 8443 / 8180. |
| What it does not do | No firewall (pf) rules, no changes to /etc/hosts, no kernel extensions. It leaves 127.0.0.1 alone while another tool (such as Laravel Herd) uses it. |
| Undo | Settings → Project → Disable: unloads both daemons and deletes the files. |
A resolver for a custom domain
| Button | Settings → General → Install resolver for .yourtld… — only when you choose a domain other than .localhost |
| What it does | Writes /etc/resolver/<tld> (marked “Managed by DevCatz”) pointing that domain at DevCatz’s DNS on 127.0.0.1:53531. |
| Safety | Refuses real top-level domains and .local, and never overwrites a resolver file another tool wrote. |
| Undo | Settings → General → Remove resolver (only removes files DevCatz wrote). If you switch domains, remove the old resolver before switching. |
Things DevCatz does only when you ask
- Launch at login — a toggle in Settings; off until you turn it on.
- Command-line shims —
node,npm,php,composer,bunlive in~/Library/Application Support/DevCatz/bin. DevCatz never edits your shell files: it shows the line to add to~/.zshrcif you want them on yourPATH. - Homebrew installs — older PHP versions, some PHP extensions and some database engines come from Homebrew
(
brew install …) when you install them. - Installing DBCatz — downloads the latest release from GitHub, checks its checksum and copies it into
/Applications.
Secrets
- AI keys: the macOS Keychain, item Catzoid AI, shared by the Catzoid apps; never in a settings file.
- Git host tokens, tunnel tokens and DBCatz’s saved passwords: encrypted with macOS’s secure storage before they are written to the app’s settings.
Removing everything
The uninstall guide undoes all of the above, button by button or by hand.
Found a security problem? Please report it privately (see the repository’s SECURITY.md) rather than in a public
issue.
Last updated 2026-10-25