cctrace

cctrace is a local, zero-config TLS-intercepting proxy that sits between coding agents (Claude Code, OpenAI Codex CLI, Grok CLI, Kimi Code CLI, and opencode) and their respective APIs, capturing every HTTP call in real time. Unlike base-URL proxies that only see the chat endpoint, cctrace intercepts at the transport layer, reaching OAuth flows, usage/credit endpoints, MCP registry calls, bootstrap requests, and telemetry that a simple URL rewrite cannot observe. The tool auto-generates a CA certificate and configures the agent to route through it via HTTPS_PROXY, requiring no manual setup. First-party hosts are decrypted and fully captured; external hosts (npm, GitHub, apt) pass through as opaque byte-counted tunnels, keeping traces lean. The live web UI provides categorized request views with filter chips, decoded SSE streams, reasoning-effort and prompt-cache verdicts, first-token latency, and estimated per-request cost. Sessions are reconstructed the way a human counts them, with a trajectory bar showing lanes over time, tool rows naming touched files, subagent branches, model epochs, and compaction boundaries. Session replay steps or plays back any captured session, with live tailing during active runs. A Context view shows the agent's window over time with an interactive overview: stacked columns per wire request colored by six context categories, compaction markers, and wall-clock breakdowns. The selection can be read three ways: as a context graph (icicle decomposition), as a linear stream of records, or as an events timeline of injections and compactions. Cost tracking shows where quota goes with cache read/write/input/output breakdowns, identifies cache misses with causes (expired TTL, prefix changes, 529 retries), and displays account quota as polled by the client. The insights command aggregates across runs by day, project, and client, with optional deep scanning for cache splits and quota percentages. The doctor command diagnoses a session's latest request window, identifying unused tool schemas, recurring harness injections, duplicate content, and cache inefficiencies with actionable levers. Traces are saved as .jsonl files (archived to .jsonl.zst), reopenable anytime with cctrace view, and exportable as markdown transcripts or offline HTML snapshots. A cross-project dashboard shows all live and finished runs with one-click session views, stop controls, and storage management. Credentials are redacted from headers, bodies, and URLs before anything hits disk. Traces live outside the project tree in ~/.local/share/cctrace/. The tool requires Bun, openssl, and the target CLI, and is available via npm or as a standalone compiled binary.