astradevlabsastradevlabs
← All posts
Tools4 min

Head-to-Head: `curl` vs Cloudflare `pvcli` for Privacy Proxy and OHTTP Debugging

Tools

Cloudflare quietly shipped one of the more interesting niche tools of the last two weeks on July 27, 2026: `pvcli`, an open-source, curl-like client for HTTP/2, HTTP/3, OHTTP, and privacy-proxy debugging.

This is not a replacement for curl in day-to-day API work. It is a tool for the moment your traffic path stops being a simple client-to-origin request and starts involving MASQUE, CONNECT, OHTTP, relay headers, or mTLS between multiple hops.

So the useful question is not "is pvcli better than curl?" It is: which one should you reach for first?

Quick answer

  1. Use `curl` when you are testing a straightforward proxy hop, verifying auth headers, or checking what IP and protocol the remote side sees.
  2. Use `pvcli` when you need to exercise OHTTP end to end, inspect protocol steps, or debug relay-versus-gateway behavior without stitching together custom scripts.
  3. Keep both installed if your team touches privacy infrastructure. They solve different parts of the same problem.

Round 1: Setup friction

curl wins the first round because every team already has it.

Cloudflare’s Privacy Proxy docs still show curl as the fastest path for local verification. If all you need is a quick proof that a proxy endpoint accepts your auth header and egresses traffic correctly, this is enough:

bash
curl -v \
  --proxy https://your-proxy.example.com \
  --proxy-header "Proxy-Authorization: Preshared <YOUR_PSK>" \
  https://cloudflare.com/cdn-cgi/trace

That works because Privacy Proxy accepts standard HTTP CONNECT flows over HTTP/2 and HTTP/3, and for proof-of-concept work a pre-shared key is acceptable.

pvcli asks a little more up front. Today the repository documents installation through Rust’s toolchain:

bash
cargo install --git https://github.com/cloudflareresearch/pvcli

That is still lightweight, but it is not zero-friction. If your whole job is "verify the proxy is alive," installing a specialized Rust CLI is unnecessary.

Round 2: Observability during failures

This is where pvcli starts to justify its existence.

Cloudflare built the tool because debugging privacy-preserving protocols with ad hoc scripts had become slow and error-prone. OHTTP alone involves a client, a relay, a gateway, and a target, plus binary HTTP encoding and encryption steps. With raw curl, you can test pieces of the path, but you do not get a single command that explains the whole exchange.

The repo and launch post show the difference clearly. A full OHTTP request can be run with one command:

bash
pvcli -vvv --ohttp \
  --first-hop https://relay-cloudflare.ohttp.info \
  --proxy https://gateway.ohttp.info \
  -X POST \
  --header "content-type: application/json" \
  --data '{"test":1}' \
  https://target.ohttp.info/anything

The practical advantage is not just that the command is shorter than a pile of helper scripts. It is that verbose output shows the protocol stages, decoded configuration, request construction, and transport details in one place. When a failure could live in the relay, gateway, target, key configuration, or binary encoding, that matters.

If you have ever lost an afternoon asking "is this our bug or the partner’s bug?", this is the round pvcli wins.

Round 3: Real production-like cases

Cloudflare’s docs and launch notes line up on an important point: privacy infrastructure usually needs more than one kind of authentication and header handling.

The docs cover basic PSK testing for Privacy Proxy, optional geolocation testing with sec-ch-geohash, and stronger production-oriented auth models like Privacy Pass tokens and mTLS. The launch post adds a concrete wrinkle many teams hit in practice: some headers belong to the first hop, not the target.

pvcli gives that distinction first-class flags such as --first-hop-header, plus client cert and key options for mTLS to the relay. That is the kind of ergonomics curl does not natively give you once an OHTTP flow spans multiple actors with different responsibilities.

So if your debugging checklist includes any of these, pvcli is the better tool:

  • Relay-specific authentication
  • Gateway-specific OHTTP behavior
  • End-to-end encrypted request validation
  • HTTP/3 outer transport testing for the proxy path
  • Reproducible traces you can hand to another engineer

If your checklist is simpler, curl remains the better default.

The decision rule

Use this rule and move on:

  • Start with `curl` for reachability, auth, egress IP, and basic CONNECT verification.
  • Switch to `pvcli` the moment you need to debug protocol boundaries, not just HTTP responses.

That is the real significance of this release. Cloudflare did not ship a better general-purpose HTTP client. It shipped a sharper specialist tool for a class of systems that usually force teams into bespoke scripts, raw binary inspection, and Slack threads full of half-decoded traces.

For most teams, pvcli will be irrelevant right up until the day it becomes the fastest tool in the room.

References