7 ms·

Show HN: A MitM proxy to see what your LLM tools are sending

218 points by jmuncor 8mo ago

I built this out of curiosity about what Claude Code was actually sending to the API. Turns out, watching your tokens tick up in real-time is oddly satisfying. Sherlock sits between your LLM tools and the API, showing you every request with a live dashboard, and auto-saved copies of every prompt as markdown and json.

deleted 8mo ago
[deleted]
david_shaw 8mo ago
Nice work! I'm sure the data gleaned here is illuminating for many users. I'm surprised that there isn't a stronger demand for enterprise-wide tools like this. Yes, there are a few solutions, but when you contrast the new standard of "give everyone at the company agentic AI capabilities" with the prior paradigm of strong data governance (at least at larger orgs), it's a stark difference. I think we're not far from the pendulum swinging back a bit. Not just because AI can't be used for everything, but because the governance on widespread AI use (without severely limiting what tools can actually do) is a difficult and ongoing problem.
- LudwigNagasena 8mo ago
  I had to vibe code a proxy to hide tokens from agents (https://github.com/vladimirkras/prxlocal https://github.com/vladimirkras/prxlocal) because I haven’t found any good solution either. I planned to add genai otel stuff that could be piped into some tool to view dialogues and tool calls and so on, but I haven’t found any good setup that doesn’t require lots of manual coding yet. It’s really weird that there are no solutions in that space.
  - dtkav 8mo ago
    nice, I'm working on something similar with macroons so the tokens can be arbitrarily scopes in time and capability too. Mine uses an Envoy sidecar on a sandbox container. https://github.com/dtkav/agent-creds https://github.com/dtkav/agent-creds
- daxfohl 8mo ago
  Yes, I was just thinking about how, as engineers, we're trained to document every thought that has ever crossed our minds, for liability and future reference. Yet once an LLM is done with its task, the "hit by a bus" scenario takes place immediately.
  - jmuncor 8mo ago
    Yes, I think you can actually later store this in a database and start querying and optimizing what is happening there. Even you can start using these files or a destilation of these as long term memory.
EMM_386 8mo ago
This is great. When I work with AI on large, tricky code bases I try to do a collaboration where it hands off things to me that may result in large number of tokens (excess tool calls, unprecise searches, verbose output, reading large files without a range specified, etc.). This will help narrow down exactly which to still handle manually to best keep within token budgets. Note: "yourusername" in install git clone instructions should be replaced.
- kej 8mo ago
  Would you mind sharing more details about how you do this? What do you add to your AI prompts to make it hand those tasks off to you?
- jmuncor 8mo ago
  Hahahah just fixed it, thank you so much!!!! Think of extending this to a prompt admin, Im sure there is a lot of trash that the system sends on every query, I think we can improve this.
- cedws 8mo ago
  I've been trying to get token usage down by instructing Claude to stop being so verbose (saying what it's going to do beforehand, saying what it just did, spitting out pointless file trees) but it ignores my instructions. It could be that the model is just hard to steer away from doing that... or Anthropic want it to waste tokens so you burn through your usage quickly.
  - egberts1 8mo ago
    Simply assert that : you are a professional (insert concise occupation). Be terse. Skip the summary. Give me the nitty-gritty details. You can send all that using your AI client settings.
- winchester6788 8mo ago
  I had a similar problem, and when claude code (or codex) is running in sandbox, i wanted to put a cap or get notified on large contexts. especially, because once x0K words crossed, the output becomes worser. https://github.com/quilrai/LLMWatcher https://github.com/quilrai/LLMWatcher made this mac app for the same purpose. any thoughts would be appreciated
mrbluecoat 8mo ago
So is it just a wrapper around MitM Proxy?
- guessmyname 8mo ago
  > So is it just a wrapper around MitM Proxy? Yes. I created something similar months ago [*] but using Envoy Proxy [1], mkcert [2], my own Go (golang) server, and Little Snitch [3]. It works quite well. I was the first person to notice that Codex CLI now sends telemetry to ab.chatgpt.com and other curiosities like that, but I never bothered to open-source my implementation because I know that anyone genuinely interested could easily replicate it in an afternoon with their favourite Agent CLI. [1] https://www.envoyproxy.io/ https://www.envoyproxy.io/ [2] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert [3] https://www.obdev.at/products/littlesnitch/ https://www.obdev.at/products/littlesnitch/ [*] In reality, I created this something like 6 years ago, before LLMs were popular, originally as a way to inspect all outgoing HTTP(s) traffic from all the apps installed in my macOS system. Then, a few months ago, when I started using Codex CLI, I made some modifications to inspect Agent CLI calls too.
  - tkp-415 8mo ago
    Curious to see how you can get Gemini fully intercepted. I've been intercepting its HTTP requests by running it inside a docker container with: -e HTTP_PROXY=http://127.0.0.1:8080 http://127.0.0.1:8080 -e HTTPS_PROXY=http://host.docker.internal:8080 http://host.docker.internal:8080 -e NO_PROXY=localhost,127.0.0.1 It was working with mitmproxy for a very brief period, then the TLS handshake started failing and it kept requesting for re-authentication when proxied. You can get the whole auth flow and initial conversation starters using Burp Suite and its certificate, but the Gemini chat responses fail in the CLI, which I understand is due to how Burp handles HTTP2 (you can see the valid responses inside Burp Suite).
    - jmuncor 8mo ago
      Tried with gemini and gave more headaches than anything else, would love if you can help me adding it to sherlock... I use claude and gemini, claude mainly for coding, so wanted to set it up first. With gemini, ran into the same problem that you did...
deleted 8mo ago
[deleted]
alickkk 8mo ago
Nice work! Do i need to update Claude Code config after start this proxy service?
- jmuncor 8mo ago
  Nope... You just run "sherlock claude" and that sets up the proxy for you. So you dont have to think about it... And just use claude normally, every prompt you send in that session will be stored in the files.
FEELmyAGI 8mo ago
Dang how will Tailscale make any money on its latest vibe coded feature [0] when others can vibe code it themselves? I guess your SaaS really is someones weekend vibe prompt. [0]https://news.ycombinator.com/item?id=46782091 https://news.ycombinator.com/item?id=46782091
- 3abiton 8mo ago
  That's what LLMs enabled. Faster prototyping. Also lots of exposed servers and apps. It's never been more fun to be a cyber security researcher.
  - jmuncor 8mo ago
    I think it just has been more fun being into computers overall!
    - pixl97 8mo ago
      It's interesting because if you're into computers it's more accessible than ever and there are more things you can mess with more cheaply than ever. I mean we have some real science fiction stuff going on. At the same time it's probably different for the newer generations. Computers were magical to me and a lot of that was because they were rare. Now they are everywhere, they are just a backdrop to everything else going on.
      - jmuncor 8mo ago
        I agree, I remember when the feed forward NN were the shit! And now the LLMs are owning, I think this adoption pattern will start pulling a lot of innovations on other computer science fields. Networking, for example. But the ability to have that peer programer next to you makes it so much more fun to build, when before you had to spend a whole day debugging something, Claude now just helps you out and gives you time to build. Feels like long roadtrips with cruise control and lane keeping assist!
andrewstuart 8mo ago
What about SSL/certificates ?
- jmuncor 8mo ago
  I didn't understand the quesion I am sorry.
  - actionfromafar 8mo ago
    I also assumed Claude Code would need some kind of cert nudging to accept a proxy. But it's in the README: Prompt you to install it in your system trust store
Havoc 8mo ago
You don't need to mess with certificates - you can point CC at a HTTP endpoint and it'll happily play along. If you build a DIY proxy you can also mess with the prompt on the wire. Cut out portions of the system prompt etc. Or redirect it to a different endpoint based on specific conditions etc.
- jmuncor 8mo ago
  Have you tried this with Gemini? or Codex?
  - thehamkercat 8mo ago
    Have tried with gemini-cli and claude-code both, it works, honestly, it should work with most if not all cli clients
    - jmuncor 8mo ago
      Working on this feature right now!! Thank you for the suggestion, will start the branch for it... Whent think of improving the context window usage, now that with an http relay we can start thinking of intercepting the context window, anything that you think could be cool to implement?
      - jmuncor 8mo ago
        Got it on the feature branch http-relay, let me know what you think!
  - Havoc 8mo ago
    I personally switched to opencode. The prompt I wanted to mess with - search - I don’t need to intercept there so less need for a proxy
zahlman 8mo ago
Or we could just demand agents that offer this level of introspection?
- bandrami 8mo ago
  I certainly wouldn't trust self-reporting on this
  - jmuncor 8mo ago
    Not only trust, but how you later optimize what is in the context to cater how you use llms... There is a whole world to be explored inside that context window.
elphard 8mo ago
This is fantastic. Claude doesn't make it easy to inspect what it's sending - which would actually be really useful for refining the project-specific prompts.
- jmuncor 8mo ago
  Love you like it!! Let me know any ideas to improve it... I was thining in the direction of a file system and protocol for the md files, or dynamic context building. But would love to hear what you think.
ctippett 8mo ago
As someone who just set up mitmproxy to do something very similar, I wish this would've been a plugin/add-on instead of a standalone thing. I know and trust mitmproxy. I'm warier and less likely to use a new, unknown tool that has such broad security/privacy implications. Especially these days with so many vibe-coded projects being released (no idea if that's the case here, but it's a concern I have nonetheless).
- jmuncor 8mo ago
  Agee! This was a fun project that I build because it is so hard to understand what "really" is in you context window... What do you mean by plugin/add-on? Add-on to what? Thinking of what to add to it next... Maybe security would be a good direction, or at least visibility of what is happening to the proxy's traffic.
  - mikehotel 8mo ago
    Addon to mitmproxy: https://docs.mitmproxy.org/stable/addons/overview/ https://docs.mitmproxy.org/stable/addons/overview/
    - jmuncor 8mo ago
      What would you think of simply using an http relay for all providers? Would that make you feel better secutity wise? also could extend the tool to change the context you are sending and make it more granular to what you want/need...
      - deleted 8mo ago
        [deleted]
    - Retr0id 8mo ago
      Looks like it's implemented that way already? https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828ebc0e042f03d13caee502/sherlock/interceptor.py#L17 https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828...
the_arun 8mo ago
I understand this helps if we have our own LLM run time. What if we use external services like ChatGPT / Gemini (LLM Providers)? Shouldn't they provide this feature to all their clients out of the box?
- jmuncor 8mo ago
  This works with claude code and codex... So you can use with any of those, you dont need a local llm running... :)
daxfohl 8mo ago
Pretty slick. I've been wanting something like this that gets stored with a hash that is stored in the corresponding code change commit message. It'd be good for postmortems of unnoticed hallucinations, and might even be useful to "revive" the agent and see if it can help debug the problem it created.
someguy101010 8mo ago
Does this support bedrock?
- jmuncor 8mo ago
  Could add support if you need it! Just let me know :D
lifetimerubyist 8mo ago
lmao WTAF is this? build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/sherlock
- jmuncor 8mo ago
  That is what you would call vibe-ception... Hahahahah correcting it now! hahahahahahahaha!!
vitorbaptistaa 8mo ago
That looks great! Any plans on allowing exports to OpenTelemetry apps like Arize Phoenix? I am looking for ways to connect my Claude Code using Max plan (no API) to it and the best I found was https://arize.com/blog/claude-code-observability-and-tracing-introducing-dev-agent-lens/ https://arize.com/blog/claude-code-observability-and-tracing..., but it seems kinda overweight.
- cetra3 8mo ago
  Yeah would love this for logfire
  - jmuncor 8mo ago
    Something like sherlock start --otel-endpoint?
    - vitorbaptistaa 8mo ago
      Yes. It can get a bit more complex as some otels require authentication. You can check Pydantic AI Gateway, Cloudflare AI Gateway or LiteLLM itself. They do similar things. One advantage of yours would be simplicity.
      - jmuncor 8mo ago
        I love this idea... Going to look into it, thank you!
winchester6788 8mo ago
interesting that you chose to go the MITM way. https://github.com/quilrai/LLMWatcher https://github.com/quilrai/LLMWatcher here is my take on the same thing, but as a mac app and using BASE_URL for intercepting codex, claude code and hooks for cursor.
catlifeonmars 8mo ago
This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828ebc0e042f03d13caee502/sherlock/main.py#L181 https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.
- jmuncor 8mo ago
  Just fixed it and implemented a simple http relay, eliminating the mitmproxy and the ssl_insecure=true. The new implementation uses TLS verification, doing last tests and merging it... After the merge can you check it out and tell me if I earned your star? :D
  - catlifeonmars 8mo ago
    I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications and could have caused real harm to users.
    - jmuncor 8mo ago
      Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
      - jurgenaut23 8mo ago
        No, you’re in the process of vibe coding stuff you don’t understand and you will most likely never understand until you take the time to open a book.
maxkfranz 8mo ago
Could you use an approach like this much like a traditional network proxy, to block or sanitise some requests? E.g. if a request contains confidential information (whatever you define that to be), then block it?
- maxkfranz 8mo ago
  Forgot to mention: It’s a neat tool. Well done.
  - jmuncor 8mo ago
    Thank you, what I was thinking was more along the lines of optimizing how you use your context window. So that the LLM can actually access what it needs to, like a incredibly powerful compact that runs in the background with your file system working as a long term memory... Still thinking how to make it work, so I am super open to ideas.
- shepherdjerred 8mo ago
  I do kinda the opposite where I run my AI in a sandbox. it sends dummy tokens to APIs. the proxy then injects the real creds. so, the AI never has access to creds. https://clauderon.com/ https://clauderon.com/ -- not really ready for others to use it though
asyncadventure 8mo ago
[dead]
- jmuncor 8mo ago
  That is exactly the idea, later we can actually tap into the middle and optimize how the context is actually being used. Feels like the current anthropic tools like compact don't do a great job at it.
- teodorasgenova 8mo ago
  Curious - what pushed you toward a proxy vs adding observability/instrumentation in the code?
rgj 8mo ago
LiteLLM does this, and can do a lot more beyond that.
- jmuncor 8mo ago
  Sometimes simplicity is the best thing to have.
syntaxing 8mo ago
It’s actually really easy to use mitmproxy as a…proxy. You set it up as a SOCKS proxy (or whatever) and point your network or browser to the proxy. I did this recently when a python tool was too aggressive on crawling the web and the server would reject me. Forced my session to limit 5 requests per second and it worked rather than finding the exact file to change in the library. Just do the same to your browser and then turn on the capture mode and you’ll see the requests
- jmuncor 8mo ago
  The idea is to simplify and store it... Thinking of changing it to http relay, what do you think?
- konform 8mo ago
  Actually intercepting the cleartext data is less trivial (not inherently - the browsers just make it more obscure than it could be) but it can be done. https://news.ycombinator.com/item?id=46820977 https://news.ycombinator.com/item?id=46820977
canadiantim 8mo ago
Reminds me of claude-trace: https://simonwillison.net/2025/Jun/2/claude-trace/ https://simonwillison.net/2025/Jun/2/claude-trace/
jedberg 8mo ago
Amusingly, I had the same question and asked Claude Code to vibe code me something similar. :)
- jmuncor 8mo ago
  Now you can add on top of it :D and we can all create something great :D
  - jedberg 8mo ago
    As is the case with most vibe coded software, it wasn't polished, didn't work very well, had lots of edge cases, and was pretty much bespoke to my one use case. :) It answered the question "what the heck is this software sending to the LLM" but that was about all it was good for.
    - jmuncor 8mo ago
      That was what I wanted to answer.. hehe What edge cases can you think of, and what polish do you think I can add?
hunter-xue 8mo ago
more vibe coding tools support will be better, or capture any apps will more awesome
alde 8mo ago
The amount of AI slop hitting the HN front page is getting out of hand. Then you open the comments and there are obvious LLM bots commenting on it. Wonder if this is the end of HN.
dygd 8mo ago
A more advanced LLM API proxy with a nice dashboard: https://github.com/bazumo/clancy https://github.com/bazumo/clancy
trilogic 8mo ago
Activate controlled folder access and filesystem access to see what is trying to change every time loading and using a llm. Most LLM models are programmed to call home at first loading. Then the libs you are loading them with also log and smt looking to send bytes (check with firewall for details). HugstonOne uses Enforced Offline policy/ Offline switch because of that. Our Users are so happy lately :) and will realize it clearly in the future.
lionkor 8mo ago
Say it with me: If I wanted an AI written tool for this, I would have prompted an AI, not opened HN.
Roark66 8mo ago
I use litellm (slightly modified to allow cloud code telemetry pass through) and langfuse. There is no need for MitM, you can set Api base address to your own proxy in all the coding assistants (at least all I know - Claude Code, opencode, gemini, vc plugin). The changes I made allow use of the models endpoint in litellm at the same base url as telemetry and passing through Claude Max auth. This is not about using your Max with another cli tool, but about recording everything that happens. There is a tool that can send CC json logs to langfuse but the results are much inferior. You loose parts of the tool call results, timing info etc. I'm quite happy with this. If anyone is interested I can post a github link.
xebb44 8mo ago
[dead]
spl757 8mo ago
I usually have small mini-pc with at least two ethernet ports and configure it as a transparent bridge sitting between my desktop and the router/switch. Give the bridge a local IP, set up some packet inspection stuff, and you can easily monitor anything and everything going in and out. It's not all I use, but it's one part. I also run ai models locally and like to verify that things aren't talking to the internet if they aren't supposed to be.
deleted 8mo ago
[deleted]
deleted 8mo ago
[deleted]
mgabbardo 8mo ago
I built something similar after seeing this post: https://wiretaps.ai https://wiretaps.ai (repo: https://github.com/marcosgabbardo/wiretaps https://github.com/marcosgabbardo/wiretaps) Different approach: - No TLS verification bypass — works by setting OPENAI_BASE_URL - Built-in PII detection (SSN, credit cards, emails, phone numbers across ~20 countries) - Crypto detection (BTC/ETH addresses, private keys, seed phrases) - SQLite by default, zero config: pip install wiretaps && wiretaps start Still early (v0.3), but the PII detection is solid — 45+ regex patterns for global compliance (GDPR, LGPD, etc). Would love feedback from folks here.

218 points by jmuncor 8mo ago

deleted 8mo ago

[deleted]

david_shaw 8mo ago

Nice work! I'm sure the data gleaned here is illuminating for many users. I'm surprised that there isn't a stronger demand for enterprise-wide tools like this. Yes, there are a few solutions, but when you contrast the new standard of "give everyone at the company agentic AI capabilities" with the prior paradigm of strong data governance (at least at larger orgs), it's a stark difference. I think we're not far from the pendulum swinging back a bit. Not just because AI can't be used for everything, but because the governance on widespread AI use (without severely limiting what tools can actually do) is a difficult and ongoing problem.

LudwigNagasena 8mo ago
I had to vibe code a proxy to hide tokens from agents (https://github.com/vladimirkras/prxlocal https://github.com/vladimirkras/prxlocal) because I haven’t found any good solution either. I planned to add genai otel stuff that could be piped into some tool to view dialogues and tool calls and so on, but I haven’t found any good setup that doesn’t require lots of manual coding yet. It’s really weird that there are no solutions in that space.
- dtkav 8mo ago
  nice, I'm working on something similar with macroons so the tokens can be arbitrarily scopes in time and capability too. Mine uses an Envoy sidecar on a sandbox container. https://github.com/dtkav/agent-creds https://github.com/dtkav/agent-creds
daxfohl 8mo ago
Yes, I was just thinking about how, as engineers, we're trained to document every thought that has ever crossed our minds, for liability and future reference. Yet once an LLM is done with its task, the "hit by a bus" scenario takes place immediately.
- jmuncor 8mo ago
  Yes, I think you can actually later store this in a database and start querying and optimizing what is happening there. Even you can start using these files or a destilation of these as long term memory.

EMM_386 8mo ago

This is great. When I work with AI on large, tricky code bases I try to do a collaboration where it hands off things to me that may result in large number of tokens (excess tool calls, unprecise searches, verbose output, reading large files without a range specified, etc.). This will help narrow down exactly which to still handle manually to best keep within token budgets. Note: "yourusername" in install git clone instructions should be replaced.

kej 8mo ago
Would you mind sharing more details about how you do this? What do you add to your AI prompts to make it hand those tasks off to you?
jmuncor 8mo ago
Hahahah just fixed it, thank you so much!!!! Think of extending this to a prompt admin, Im sure there is a lot of trash that the system sends on every query, I think we can improve this.
cedws 8mo ago
I've been trying to get token usage down by instructing Claude to stop being so verbose (saying what it's going to do beforehand, saying what it just did, spitting out pointless file trees) but it ignores my instructions. It could be that the model is just hard to steer away from doing that... or Anthropic want it to waste tokens so you burn through your usage quickly.
- egberts1 8mo ago
  Simply assert that : you are a professional (insert concise occupation). Be terse. Skip the summary. Give me the nitty-gritty details. You can send all that using your AI client settings.
winchester6788 8mo ago
I had a similar problem, and when claude code (or codex) is running in sandbox, i wanted to put a cap or get notified on large contexts. especially, because once x0K words crossed, the output becomes worser. https://github.com/quilrai/LLMWatcher https://github.com/quilrai/LLMWatcher made this mac app for the same purpose. any thoughts would be appreciated

mrbluecoat 8mo ago

So is it just a wrapper around MitM Proxy?

guessmyname 8mo ago
> So is it just a wrapper around MitM Proxy? Yes. I created something similar months ago [*] but using Envoy Proxy [1], mkcert [2], my own Go (golang) server, and Little Snitch [3]. It works quite well. I was the first person to notice that Codex CLI now sends telemetry to ab.chatgpt.com and other curiosities like that, but I never bothered to open-source my implementation because I know that anyone genuinely interested could easily replicate it in an afternoon with their favourite Agent CLI. [1] https://www.envoyproxy.io/ https://www.envoyproxy.io/ [2] https://github.com/FiloSottile/mkcert https://github.com/FiloSottile/mkcert [3] https://www.obdev.at/products/littlesnitch/ https://www.obdev.at/products/littlesnitch/ [*] In reality, I created this something like 6 years ago, before LLMs were popular, originally as a way to inspect all outgoing HTTP(s) traffic from all the apps installed in my macOS system. Then, a few months ago, when I started using Codex CLI, I made some modifications to inspect Agent CLI calls too.
- tkp-415 8mo ago
  Curious to see how you can get Gemini fully intercepted. I've been intercepting its HTTP requests by running it inside a docker container with: -e HTTP_PROXY=http://127.0.0.1:8080 http://127.0.0.1:8080 -e HTTPS_PROXY=http://host.docker.internal:8080 http://host.docker.internal:8080 -e NO_PROXY=localhost,127.0.0.1 It was working with mitmproxy for a very brief period, then the TLS handshake started failing and it kept requesting for re-authentication when proxied. You can get the whole auth flow and initial conversation starters using Burp Suite and its certificate, but the Gemini chat responses fail in the CLI, which I understand is due to how Burp handles HTTP2 (you can see the valid responses inside Burp Suite).
  - jmuncor 8mo ago
    Tried with gemini and gave more headaches than anything else, would love if you can help me adding it to sherlock... I use claude and gemini, claude mainly for coding, so wanted to set it up first. With gemini, ran into the same problem that you did...

deleted 8mo ago

[deleted]

alickkk 8mo ago

Nice work! Do i need to update Claude Code config after start this proxy service?

jmuncor 8mo ago
Nope... You just run "sherlock claude" and that sets up the proxy for you. So you dont have to think about it... And just use claude normally, every prompt you send in that session will be stored in the files.

FEELmyAGI 8mo ago

Dang how will Tailscale make any money on its latest vibe coded feature [0] when others can vibe code it themselves? I guess your SaaS really is someones weekend vibe prompt. [0]https://news.ycombinator.com/item?id=46782091 https://news.ycombinator.com/item?id=46782091

3abiton 8mo ago
That's what LLMs enabled. Faster prototyping. Also lots of exposed servers and apps. It's never been more fun to be a cyber security researcher.
- jmuncor 8mo ago
  I think it just has been more fun being into computers overall!
  - pixl97 8mo ago
    It's interesting because if you're into computers it's more accessible than ever and there are more things you can mess with more cheaply than ever. I mean we have some real science fiction stuff going on. At the same time it's probably different for the newer generations. Computers were magical to me and a lot of that was because they were rare. Now they are everywhere, they are just a backdrop to everything else going on.
    - jmuncor 8mo ago
      I agree, I remember when the feed forward NN were the shit! And now the LLMs are owning, I think this adoption pattern will start pulling a lot of innovations on other computer science fields. Networking, for example. But the ability to have that peer programer next to you makes it so much more fun to build, when before you had to spend a whole day debugging something, Claude now just helps you out and gives you time to build. Feels like long roadtrips with cruise control and lane keeping assist!

andrewstuart 8mo ago

What about SSL/certificates ?

jmuncor 8mo ago
I didn't understand the quesion I am sorry.
- actionfromafar 8mo ago
  I also assumed Claude Code would need some kind of cert nudging to accept a proxy. But it's in the README: Prompt you to install it in your system trust store

Havoc 8mo ago

You don't need to mess with certificates - you can point CC at a HTTP endpoint and it'll happily play along. If you build a DIY proxy you can also mess with the prompt on the wire. Cut out portions of the system prompt etc. Or redirect it to a different endpoint based on specific conditions etc.

jmuncor 8mo ago
Have you tried this with Gemini? or Codex?
- thehamkercat 8mo ago
  Have tried with gemini-cli and claude-code both, it works, honestly, it should work with most if not all cli clients
  - jmuncor 8mo ago
    Working on this feature right now!! Thank you for the suggestion, will start the branch for it... Whent think of improving the context window usage, now that with an http relay we can start thinking of intercepting the context window, anything that you think could be cool to implement?
    - jmuncor 8mo ago
      Got it on the feature branch http-relay, let me know what you think!
- Havoc 8mo ago
  I personally switched to opencode. The prompt I wanted to mess with - search - I don’t need to intercept there so less need for a proxy

zahlman 8mo ago

Or we could just demand agents that offer this level of introspection?

bandrami 8mo ago
I certainly wouldn't trust self-reporting on this
- jmuncor 8mo ago
  Not only trust, but how you later optimize what is in the context to cater how you use llms... There is a whole world to be explored inside that context window.

elphard 8mo ago

This is fantastic. Claude doesn't make it easy to inspect what it's sending - which would actually be really useful for refining the project-specific prompts.

jmuncor 8mo ago
Love you like it!! Let me know any ideas to improve it... I was thining in the direction of a file system and protocol for the md files, or dynamic context building. But would love to hear what you think.

ctippett 8mo ago

As someone who just set up mitmproxy to do something very similar, I wish this would've been a plugin/add-on instead of a standalone thing. I know and trust mitmproxy. I'm warier and less likely to use a new, unknown tool that has such broad security/privacy implications. Especially these days with so many vibe-coded projects being released (no idea if that's the case here, but it's a concern I have nonetheless).

jmuncor 8mo ago
Agee! This was a fun project that I build because it is so hard to understand what "really" is in you context window... What do you mean by plugin/add-on? Add-on to what? Thinking of what to add to it next... Maybe security would be a good direction, or at least visibility of what is happening to the proxy's traffic.
- mikehotel 8mo ago
  Addon to mitmproxy: https://docs.mitmproxy.org/stable/addons/overview/ https://docs.mitmproxy.org/stable/addons/overview/
  - jmuncor 8mo ago
    What would you think of simply using an http relay for all providers? Would that make you feel better secutity wise? also could extend the tool to change the context you are sending and make it more granular to what you want/need...
    - deleted 8mo ago
      [deleted]
  - Retr0id 8mo ago
    Looks like it's implemented that way already? https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828ebc0e042f03d13caee502/sherlock/interceptor.py#L17 https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828...

the_arun 8mo ago

I understand this helps if we have our own LLM run time. What if we use external services like ChatGPT / Gemini (LLM Providers)? Shouldn't they provide this feature to all their clients out of the box?

jmuncor 8mo ago
This works with claude code and codex... So you can use with any of those, you dont need a local llm running... :)

daxfohl 8mo ago

Pretty slick. I've been wanting something like this that gets stored with a hash that is stored in the corresponding code change commit message. It'd be good for postmortems of unnoticed hallucinations, and might even be useful to "revive" the agent and see if it can help debug the problem it created.

someguy101010 8mo ago

Does this support bedrock?

jmuncor 8mo ago
Could add support if you need it! Just let me know :D

lifetimerubyist 8mo ago

lmao WTAF is this? build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/build/lib/sherlock

jmuncor 8mo ago
That is what you would call vibe-ception... Hahahahah correcting it now! hahahahahahahaha!!

vitorbaptistaa 8mo ago

That looks great! Any plans on allowing exports to OpenTelemetry apps like Arize Phoenix? I am looking for ways to connect my Claude Code using Max plan (no API) to it and the best I found was https://arize.com/blog/claude-code-observability-and-tracing-introducing-dev-agent-lens/ https://arize.com/blog/claude-code-observability-and-tracing..., but it seems kinda overweight.

cetra3 8mo ago
Yeah would love this for logfire
- jmuncor 8mo ago
  Something like sherlock start --otel-endpoint?
  - vitorbaptistaa 8mo ago
    Yes. It can get a bit more complex as some otels require authentication. You can check Pydantic AI Gateway, Cloudflare AI Gateway or LiteLLM itself. They do similar things. One advantage of yours would be simplicity.
    - jmuncor 8mo ago
      I love this idea... Going to look into it, thank you!

winchester6788 8mo ago

interesting that you chose to go the MITM way. https://github.com/quilrai/LLMWatcher https://github.com/quilrai/LLMWatcher here is my take on the same thing, but as a mac app and using BASE_URL for intercepting codex, claude code and hooks for cursor.

catlifeonmars 8mo ago

This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828ebc0e042f03d13caee502/sherlock/main.py#L181 https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.

jmuncor 8mo ago
Just fixed it and implemented a simple http relay, eliminating the mitmproxy and the ssl_insecure=true. The new implementation uses TLS verification, doing last tests and merging it... After the merge can you check it out and tell me if I earned your star? :D
- catlifeonmars 8mo ago
  I’m not sure you fully understand the implications of the misconfiguration of mitmproxy there. Effectively you provided an easily accessible front door for remote code execution on a user’s machine. No offense, but I wouldn’t trust anything else you published. I think it’s great that you are learning and it is difficult to put yourself out there and publish code, but what you originally wrote had serious implications and could have caused real harm to users.
  - jmuncor 8mo ago
    Ohh my, no offense taken... The next time I will be a lot more careful with the stuff that I put out there. Learning and getting the hang of it, would love if you either comment on the code or here any other things you think could be improved. I am in the process of getting better and appreciate all the blunt and transparent feedback. No one grows out of praise.
    - jurgenaut23 8mo ago
      No, you’re in the process of vibe coding stuff you don’t understand and you will most likely never understand until you take the time to open a book.

maxkfranz 8mo ago

Could you use an approach like this much like a traditional network proxy, to block or sanitise some requests? E.g. if a request contains confidential information (whatever you define that to be), then block it?

maxkfranz 8mo ago
Forgot to mention: It’s a neat tool. Well done.
- jmuncor 8mo ago
  Thank you, what I was thinking was more along the lines of optimizing how you use your context window. So that the LLM can actually access what it needs to, like a incredibly powerful compact that runs in the background with your file system working as a long term memory... Still thinking how to make it work, so I am super open to ideas.
shepherdjerred 8mo ago
I do kinda the opposite where I run my AI in a sandbox. it sends dummy tokens to APIs. the proxy then injects the real creds. so, the AI never has access to creds. https://clauderon.com/ https://clauderon.com/ -- not really ready for others to use it though

asyncadventure 8mo ago

[dead]

jmuncor 8mo ago
That is exactly the idea, later we can actually tap into the middle and optimize how the context is actually being used. Feels like the current anthropic tools like compact don't do a great job at it.
teodorasgenova 8mo ago
Curious - what pushed you toward a proxy vs adding observability/instrumentation in the code?

rgj 8mo ago

LiteLLM does this, and can do a lot more beyond that.

jmuncor 8mo ago
Sometimes simplicity is the best thing to have.

syntaxing 8mo ago

It’s actually really easy to use mitmproxy as a…proxy. You set it up as a SOCKS proxy (or whatever) and point your network or browser to the proxy. I did this recently when a python tool was too aggressive on crawling the web and the server would reject me. Forced my session to limit 5 requests per second and it worked rather than finding the exact file to change in the library. Just do the same to your browser and then turn on the capture mode and you’ll see the requests

jmuncor 8mo ago
The idea is to simplify and store it... Thinking of changing it to http relay, what do you think?
konform 8mo ago
Actually intercepting the cleartext data is less trivial (not inherently - the browsers just make it more obscure than it could be) but it can be done. https://news.ycombinator.com/item?id=46820977 https://news.ycombinator.com/item?id=46820977

canadiantim 8mo ago

Reminds me of claude-trace: https://simonwillison.net/2025/Jun/2/claude-trace/ https://simonwillison.net/2025/Jun/2/claude-trace/

jedberg 8mo ago

Amusingly, I had the same question and asked Claude Code to vibe code me something similar. :)

jmuncor 8mo ago
Now you can add on top of it :D and we can all create something great :D
- jedberg 8mo ago
  As is the case with most vibe coded software, it wasn't polished, didn't work very well, had lots of edge cases, and was pretty much bespoke to my one use case. :) It answered the question "what the heck is this software sending to the LLM" but that was about all it was good for.
  - jmuncor 8mo ago
    That was what I wanted to answer.. hehe What edge cases can you think of, and what polish do you think I can add?

hunter-xue 8mo ago

more vibe coding tools support will be better, or capture any apps will more awesome

alde 8mo ago

The amount of AI slop hitting the HN front page is getting out of hand. Then you open the comments and there are obvious LLM bots commenting on it. Wonder if this is the end of HN.

dygd 8mo ago

A more advanced LLM API proxy with a nice dashboard: https://github.com/bazumo/clancy https://github.com/bazumo/clancy

trilogic 8mo ago

Activate controlled folder access and filesystem access to see what is trying to change every time loading and using a llm. Most LLM models are programmed to call home at first loading. Then the libs you are loading them with also log and smt looking to send bytes (check with firewall for details). HugstonOne uses Enforced Offline policy/ Offline switch because of that. Our Users are so happy lately :) and will realize it clearly in the future.

lionkor 8mo ago

Say it with me: If I wanted an AI written tool for this, I would have prompted an AI, not opened HN.

Roark66 8mo ago

I use litellm (slightly modified to allow cloud code telemetry pass through) and langfuse. There is no need for MitM, you can set Api base address to your own proxy in all the coding assistants (at least all I know - Claude Code, opencode, gemini, vc plugin). The changes I made allow use of the models endpoint in litellm at the same base url as telemetry and passing through Claude Max auth. This is not about using your Max with another cli tool, but about recording everything that happens. There is a tool that can send CC json logs to langfuse but the results are much inferior. You loose parts of the tool call results, timing info etc. I'm quite happy with this. If anyone is interested I can post a github link.

xebb44 8mo ago

[dead]

spl757 8mo ago

I usually have small mini-pc with at least two ethernet ports and configure it as a transparent bridge sitting between my desktop and the router/switch. Give the bridge a local IP, set up some packet inspection stuff, and you can easily monitor anything and everything going in and out. It's not all I use, but it's one part. I also run ai models locally and like to verify that things aren't talking to the internet if they aren't supposed to be.

deleted 8mo ago

[deleted]

deleted 8mo ago

[deleted]

mgabbardo 8mo ago

I built something similar after seeing this post: https://wiretaps.ai https://wiretaps.ai (repo: https://github.com/marcosgabbardo/wiretaps https://github.com/marcosgabbardo/wiretaps) Different approach: - No TLS verification bypass — works by setting OPENAI_BASE_URL - Built-in PII detection (SSN, credit cards, emails, phone numbers across ~20 countries) - Crypto detection (BTC/ETH addresses, private keys, seed phrases) - SQLite by default, zero config: pip install wiretaps && wiretaps start Still early (v0.3), but the PII detection is solid — 45+ regex patterns for global compliance (GDPR, LGPD, etc). Would love feedback from folks here.