<p align="center"<img src="assets/cctrace-logo.svg" width="84" alt="cctrace"</p
cctrace
See what your coding agent really sends. Every request Claude Code makes -- messages, OAuth, usage/credits, MCP -- captured live in your browser. Codex, Grok, and Kimi Code too.
English | 简体中文
Docs · Install · Web UI · Saved traces · Beyond Claude · llms.txt
<subAI agents / LLMs: read /llms.txt; an agent skill ships in skills/cctrace.</sub
<p align="center" <img src="assets/cctrace-demo.gif" alt="cctrace live demo" width="100%" </p
cctrace sits between your coding agent and its API, recording every HTTP call to a live categorized web UI and a .jsonl trace you can reopen any time with cctrace view. No cloud, no account, nothing leaves your machine.
cctrace # trace Claude Code
cctrace codex # or the OpenAI Codex CLI
cctrace grok # or the Grok CLI
cctrace kimi # or the Kimi Code CLI (Moonshot AI)That's it. The agent launches normally. You get a browser tab showing everything it does.
Why
cctrace is built for exactly two jobs:
- LLM tracing -- see exactly what your agent sends and receives each
turn: system prompt, context, tool definitions, streamed replies, token/cache usage.
- Security & privacy tracing -- audit what actually leaves your machine:
which hosts get contacted, what telemetry goes out, what's inside every payload.
Both jobs need the full picture -- every request, not just the convenient ones. Claude Code ships as a Bun-compiled native binary, so the classic node --require fetch-hook is dead. cctrace captures at the transport layer instead: a zero-config TLS-intercepting proxy (Charles-style) that the agent routes through via HTTPSPROXY, trusting an auto-generated CA. Intercepting below where URLs are built is what reaches the OAuth and usage/credit endpoints a base-URL proxy physically cannot see -- and since 0.16 the scope is deliberate: first-party hosts are decrypted, everything else (npm, GitHub, apt) passes through as an opaque byte-counted tunnel.