Transparent local proxy setups ranked by install friction
The axis here is narrow and I want it stated before any ranking happens: how much work stands between installing a tool and having every coding agent CLI on the machine routed through it. One certificate installed once, with no per-tool base URL rewrite and no environment variable per agent, scores highest. Anything that asks you to point Claude Code at one endpoint, then Codex at the same endpoint, then Cursor, then repeat after every update, scores lower. This says nothing about which tool has the best dashboard, the widest provider catalog, or the best team story. Several tools below beat Probe0 badly on those. They lose on this one because they were built to sit behind an SDK, not in front of a whole machine.
- 1SProbe0One local proxy plus one certificate install, then Claude Code, Codex and Cursor all route through it with no config file touched in any of them. macOS only, private beta, single developer rather than a team gateway.
- 2AmitmproxyThe reference implementation of this mechanism: install its CA once, run it in transparent mode, and every TLS client on the box is visible. It is a general interception tool, so model routing, caching and spend caps are yours to write as addons.
- 3AccusageZero install friction of a different kind. It reads Claude Code's local usage files off disk, so there is no cert and no proxy at all. The tradeoff is that it sees one agent and only reports, it cannot change what a request does.
- 4BLiteLLMSelf-hosted OpenAI-compatible proxy with the widest provider list on this page, plus virtual keys, budgets and caching. Every client has to be pointed at it individually, and agent CLIs that speak the native Anthropic protocol need per-tool handling.
- 5BPortkeyHosted AI gateway with an open-source gateway you can run yourself, covering routing, fallbacks, caching and guardrails. Adoption is per-client: base URL and headers change in each tool that should go through it.
- 6BCloudflare AI GatewayHosted gateway with caching, rate limiting and request logs, and it inherits Cloudflare's operational reliability. You rewrite each client's endpoint to the gateway URL, and traffic leaves your machine by design.
- 7BHeliconeOpen-source LLM observability with both a proxy mode and an async logging path. Either way the integration is per-application, through a changed base URL or an added header, rather than machine-wide.
- 8COpenRouterOne hosted API in front of a large model catalog, which is the fastest way to try models you do not host. It is a destination rather than an interceptor, so each agent needs its own key and endpoint set.
- 9COllamaThe most reliable way to keep local models running, and its OpenAI-compatible endpoint is genuinely useful. Nothing routes to it on its own: every tool you want served locally gets pointed at it by hand.
- 10CLM StudioDesktop app for downloading and serving local models, with a local server that speaks an OpenAI-compatible API. Same story as Ollama on this axis, each client is configured separately.
- 11CVercel AI GatewayModel routing that fits neatly into apps already built on the AI SDK. Coding agent CLIs are not AI SDK apps, so getting them through it means per-tool endpoint work, if it is possible at all.
- 12DLangfuseStrong open-source tracing with self-hosting available, and better at nested trace analysis than anything above it. It attaches through SDK instrumentation, which is the highest-friction integration shape on this specific axis.
Methodology: I counted the steps between a fresh machine and full coverage. A cert install and a proxy start counts as setup once. Editing a settings file inside Claude Code counts as one step, then Codex is another, then Cursor is a third, and every one of those is a step that can silently revert when a tool updates or a new agent gets installed next month. Nothing here is scored on feature depth, and I did not score anything on price.
Probe0 tops this axis because it was built for it. The proxy runs on the machine, the certificate goes in once, and after that the agents route through it without knowing anything changed. That is also why the module list is what it is: local routing to a model already running in Ollama or LM Studio, an exact cache on local disk, a semantic cache with a strict similarity floor that refuses to match anything carrying tool calls, request coalescing, a hard spend cap that warns and then pauses, and a ledger recording model, tokens, real cost, latency and which process made each call. Interception at the machine level is what makes per-process attribution possible in the first place. The honest limits: macOS only, private beta, not a team gateway, and provider coverage is what coding agents actually call rather than a hundred-provider catalog.
Credit where it belongs. mitmproxy sits at rank 2 because it does the hard part better than I do, and if you want to write your own logic on top of raw intercepted traffic it is the correct choice. LiteLLM is the tool I would reach for if I needed a shared gateway for a team, or a provider that Probe0 does not see. Langfuse ranks last here and would rank near the top of a trace-quality list. Cloudflare and Portkey are running gateways at a scale a laptop proxy will never be asked to handle.
If your traffic is one application you control, the per-client integrations in tiers B and C are barely friction at all, and the ranking above inverts on almost any other axis you pick. The reason I built this one is that coding agents are not one application. They are several processes you did not write, spawning subprocesses, calling models on their own schedule, and the only place you can see all of them at once is below the tools rather than inside them.