Local API Proxy and WSS Tunnel
Route configured CLI API traffic through a local analytics proxy.
Availability
Partially implemented in stable. Read the limits below before relying on this workflow.
Reviewed against stable v0.5.1. Rust candidate additions are labeled separately. Release status.
The pain this solves
- API call metadata is otherwise split across provider clients and terminal sessions.
- A local loopback proxy is easy to misdescribe as a general network-wide HTTPS interceptor.
What ships with it
- Optional analytics starts a local proxy sidecar and injects supported loopback base URLs.
- The TLS listener serves the loopback WSS path with a self-signed local certificate and tunnels WebSocket frames.
- Supported-client coverage is bounded; Gemini CLI is partial and other clients are not guaranteed.
Questions this answers
- How to intercept LLM API calls from terminal AI agents?
- Monitor OpenAI API calls from Claude Code in terminal
- Transparent proxy for AI agent API traffic
- How does Chau7 capture LLM API requests?
- Can I see what API calls my AI coding agent makes?
How it works
When API analytics is enabled, Chau7 starts a local proxy sidecar and injects loopback base URLs into supported terminal-client environments. The proxy forwards recognized provider requests and records available call metadata.
The TLS listener uses a self-signed certificate for the loopback address for configured WSS transport, and the WebSocket path tunnels frames. This is not a general certificate authority, domain-wide HTTPS interception, or transparent capture of every application on the Mac.
Proxy coverage depends on supported clients and their configuration. Stable settings list Claude Code, Codex, Aider, Cursor, and partial Gemini CLI support; a cached Google OAuth session may bypass or prevent the expected Gemini routing. API authentication headers pass through, and Chau7 does not store the CLI API keys.
Why it matters
A local proxy can record metadata for supported CLI calls without requiring Chau7 to store provider API keys. Because routing is configured for selected clients, it should not be described as universal HTTPS interception or as an always-on proxy.
Frequently asked questions
Does Chau7 decrypt all HTTPS traffic with a local CA?
No. It routes supported clients to loopback endpoints and has a self-signed loopback TLS listener for WSS. It is not a general-purpose TLS MITM certificate authority.
Does the WSS path expose token and cost details?
The WebSocket path tunnels frames. Do not assume it provides the same parsed usage and cost records as supported HTTP API routes.
Which clients are covered?
The stable settings list Claude Code, Codex CLI, Aider, and Cursor as full support and Gemini CLI as partial. Other clients are not guaranteed to be proxied.