Cc Gateway

Take back control of your AI API telemetry

Quick Start · Add Clients · What Gets Rewritten · Deployment · Changelog

---

Alpha — This project is under active development. Test with a non-primary account first.

Disclaimer — See full disclaimer below.

Why

Claude Code collects 640+ telemetry event types across 3 parallel channels, fingerprints your machine with 40+ environment dimensions, and phones home every 5 seconds. Your device ID, email, OS version, installed runtimes, shell type, CPU architecture, and physical RAM are all reported to the vendor — continuously.

If you run Claude Code on multiple machines, each device gets a unique permanent identifier. There is no built-in way to manage how your identity is presented to the API.

CC Gateway is a reverse proxy that sits between Claude Code and the Anthropic API. It normalizes device identity, environment fingerprints, and process metrics to a single canonical profile — giving you control over what telemetry leaves your network.

Features

• Full identity rewrite — device ID, email, session metadata, and the user_id JSON blob in every API request are normalized to one canonical identity
• 40+ environment dimensions replaced — platform, architecture, Node.js version, terminal, package managers, runtimes, CI flags, deployment environment — the entire env object is swapped, not patched
• System prompt sanitization — the <env> block injected into every prompt (Platform, Shell, OS Version, working directory) is rewritten to match the canonical profile
• Billing header stripped — the x-anthropic-billing-header (which contains a per-session fingerprint hash) is removed entirely, consistent with the official CLAUDE_CODE_ATTRIBUTION_HEADER=false toggle. This also enables cross-session prompt cache sharing, reducing system prompt costs by ~85%
• Process metrics normalization — physical RAM (constrainedMemory), heap size, and RSS are masked to canonical values so hardware differences don't leak
• Zero-login client setup — clients receive a single launcher script. No browser OAuth, no ~/.zshrc changes, no config files
• Centralized OAuth — the gateway manages token refresh internally; client machines never contact platform.claude.com
• Instant startup — gateway uses your existing access token on launch. No network call until the token actually expires
• Proxy-aware — supports HTTPS_PROXY / HTTP_PROXY env vars for outbound connections (Clash, V2Ray, etc.)
• Telemetry leak prevention — strips baseUrl and gateway fields that would reveal proxy usage in analytics events

Quick Start

One command. Requires Node.js 22+ and an existing Claude Code login on this machine.

git clone https://github.com/motiful/cc-gateway.git
cd cc-gateway
npm install
bash scripts/quick-setup.sh

This will:

1. Extract your OAuth credentials from macOS Keychain (access token + refresh token)
2. Generate a canonical device identity and client token
3. Write config.yaml
4. Generate a client launcher at ./clients/cc-<hostname>
5. Start the gateway on http://localhost:8443

Use it

In another terminal:

./clients/cc-<hostname>

That's it. Claude Code launches, traffic routes through the gateway. No env vars to set, no files to edit.

Behind a proxy?