Profile anatomy↗
How a JSON profile becomes a stable, shared target for the running process.
STATIC overview
STATIC is the local Rust proxy used by someguy and the self-hosted CLI. A browser sends supported traffic to its listener; STATIC reads one selected profile, opens a separate connection to the destination, and returns the response. It can shape parts of the outbound connection and eligible page content. It is not an exit network: the website still sees the public IP of your chosen route.
The two sides of the proxy
How a request moves→ request ← response
ClientBrowserStarts the request
Local middlewareSTATICShapes supported signals
DestinationWebsiteReceives the request
On your deviceOutside your device
For HTTPS, the browser negotiates TLS with STATIC on your device. STATIC makes a separate, profile-shaped connection to the origin and returns its response. The website sees the public IP of your chosen network route.
There are two TLS relationships for HTTPS. The browser authenticates a certificate issued by STATIC’s local CA; STATIC separately authenticates the website on its upstream connection. The browser’s own TLS handshake is therefore not the handshake the website sees. Follow a request for the connection routing and response path.
One profile, several surfaces
| Surface | What STATIC uses the profile for | Where to read more |
|---|---|---|
| HTTP requests | Header rules and navigation/cache handling | Request headers |
| Upstream TLS | A candidate ClientHello plan passed to the transport backend | TLS and certificates |
| Upstream HTTP/2 | Settings, pseudo-header order, and other supported options | HTTP/2 |
| Browser JavaScript | Selected profile observations on genuine interfaces in eligible documents and fetched worker contexts | JavaScript runtime |
| Linux packets, if configured | The selected profile can be synced into an external pinned eBPF map | Packet boundary |
These are related targets, not proof that every observable detail matches a native browser. Covered browser-policy contradictions reject at preflight; transport coherence can also produce warnings. Those checks do not enforce matching every physical browser capability for a manual operator. Read Profile anatomy before editing a profile.
The pieces inside STATIC
- Listener and connection router. Classifies direct TLS, HTTP
CONNECT, and plain HTTP proxy traffic. Negotiated ALPN selects a client-facing HTTP/2 or HTTP/1.1 path. - Shared profile store. Loads JSON profiles, resolves inheritance, validates startup candidates and effective policy, and shares explicit active selection between the data plane and local control plane.
- Request and response pipeline. Applies header rules, behavioral metadata, CSP handling, document/worker bootstrap, and
Alt-Svchandling in a defined order. - Upstream fetcher. Builds a separate origin request through
wreq, with TLS and HTTP/2 options where supported. - Certificate provider. Owns a local CA and issues site certificates for browser-facing TLS. The separate API documents control endpoints.
The request path ties these pieces together. HTTP/1.1 and HTTP/2 document the different execution paths.
Explore the components
Request headers↗
The exact order of header rules and the request context they use.
TLS↗
The local certificate relationship and the separate outbound ClientHello plan.
HTTP/1.1↗
CONNECT, direct TLS, plain HTTP, buffered responses, and WebSockets.
HTTP/2↗
Per-stream Flows, upstream settings, retries, and selective buffering.
JavaScript↗
The injected browser runtime, its API modules, and context boundaries.
Continue into HTML injection and CSP, CA and trust, and the packet boundary for the supporting systems.
What STATIC can and cannot cover
The bundled script changes selected JavaScript-visible properties after it loads into an eligible page. Eligible fetched module/shared/fresh service workers have response-bootstrap paths. Already-running code, cached/blob/data workers, worklet processors, restricted frames and actual browser operations remain distinct coverage limits. Private realm initialization does not make all code or rendering behavior invisible. TLS fidelity is limited by what the wreq backend can express. WebSocket upgrades take a separate tunnel path. STATIC does not change your account identity, IP address, or every packet field. See HTML injection and CSP, JavaScript runtime, and Packet boundary for the exact boundaries.
To install and run the CLI, start at Self-hosted / CLI. This section explains how the current implementation works; the STATIC source tree is the source of truth for a specific release.
For developers, Configuration and launch records CLI modes, default ports, TOML inputs, the keystore split, and a source-tree map.