Trace Claude Code Agent LLM Interactions via mitmproxy Proxy

To analyze the detailed interaction between a code agent and a large language model — including prompts, tool calls, and responses — you need a way to trace the API traffic. This article presents a practical method using cc-trace, a skill that automates the setup of mitmproxy as a transparent proxy for Claude Code.

Tool and Resources

GitHub repository: https://github.com/alexfazio/cc-trace LobeHub skill page:

https://lobehub.com/skills/alexfazio-cc-trace/skill.md

Installation and Configuration

Inside Claude Code, run the following prompt to fetch and install the skill:

Read https://lobehub.com/skills/alexfazio-cc-trace/skill.md to understand how to install and use this skill. Install it as documented, then open the installed SKILL.md and follow its instructions. Ask for confirmation before any credential use, external service setup, or irreversible action.

The installation adds a proxy_claude function to ~/.bashrc that configures environment variables for mitmproxy:

# === cc-trace: mitmproxy for Claude Code API interception ===</code><code>proxy_claude() {</code><code>    # Set proxy environment variables</code><code>    export HTTP_PROXY=http://127.0.0.1:8080</code><code>    export HTTPS_PROXY=http://127.0.0.1:8080</code><code>    export http_proxy=http://127.0.0.1:8080</code><code>    export https_proxy=http://127.0.0.1:8080</code><code></code><code>    # Point Node.js to mitmproxy's CA certificate</code><code>    export NODE_EXTRA_CA_CERTS="$HOME/.mitmproxy/mitmproxy-ca-cert.pem"</code><code></code><code>    # Disable SSL verification warnings (local debugging only)</code><code>    export NODE_TLS_REJECT_UNAUTHORIZED=0</code><code></code><code>    echo "🔍 Proxy configured for mitmproxy (http://127.0.0.1:8080)"</code><code>    echo "📜 Using CA cert: $NODE_EXTRA_CA_CERTS"</code><code>    echo "🚀 Starting Claude Code..."</code><code></code><code>    # Launch Claude Code</code><code>    claude</code><code>}

Running the Trace

Open two terminal windows (inside WSL or Linux):

Terminal 1 — Start mitmweb (proxy + web UI)

For Anthropic API traffic:

mitmweb --web-port 8081 --set flow_filter="~d api.anthropic.com"

For DeepSeek API traffic (also saves a flow file for later analysis):

mitmweb --web-port 8081 --set flow_filter='~d api.deepseek.com' --save-stream-file ~/claude-flows.mitm

The flow_filter limits captured traffic to the target domain, reducing noise. The web UI becomes available at http://127.0.0.1:8081.

Terminal 2 — Launch Claude Code through the proxy

source ~/.bashrc && proxy_claude

This sources the updated .bashrc and invokes the proxy_claude function, which starts Claude Code with all HTTP/HTTPS traffic routed through mitmproxy on port 8080.

Inspecting the Interaction

Once both terminals are running, open the mitmweb UI in a browser. You can view each request/response pair, including:

Full prompt payloads sent to the model

Tool definitions and invocations

Model responses, including streaming chunks

Headers, timing, and status codes

The screenshot illustrates the web UI displaying a list of intercepted flows filtered to api.anthropic.com, with details of a request/response pair expanded.

Key Points

The method works for any LLM provider by adjusting the flow_filter domain (e.g., api.deepseek.com). NODE_EXTRA_CA_CERTS and NODE_TLS_REJECT_UNAUTHORIZED=0 are required because Node.js (used by Claude Code) must trust the mitmproxy CA certificate to allow TLS interception.

The --save-stream-file option persists the captured flows for offline analysis.

All steps are performed locally; no external services receive your API keys or conversation data.