cc-gateway is a TypeScript-based reverse proxy that rewrites device identity, environment fingerprints, and prompts to a canonical profile for Claude Code API access. It manages OAuth, launcher clients, and optional proxy routing, aiming to reduce telemetry leakage.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (1 so far).
What it is
Motiful/cc-gateway is a reverse proxy that normalizes device fingerprints, environment telemetry, and prompt text for Claude Code API requests. It provides launcher scripts for clients and centralizes OAuth token handling. It supports proxy environments and aims to strip or rewrite telemetry-related data.
How it works
The gateway sits between Claude Code clients and the Anthropic API. It performs identity rewriting (device_id, email, session metadata, user_id), replaces the env object (40+ fields), sanitizes the system prompt (env block), strips the x-anthropic-billing-header, and masks process metrics like RAM and heap values. Clients connect via generated launcher scripts; the gateway injects the real OAuth token and forwards requests upstream. It supports outbound proxy configurations via HTTPS_PROXY / HTTP_PROXY / ALL_PROXY and uses a single canonical identity for all traffic.
Getting started
Quick Start steps from the README:
git clone https://github.com/motiful/cc-gateway.git
cd cc-gateway
npm install
bash scripts/quick-setup.sh
This sequence extracts OAuth credentials from the keychain, generates a canonical device identity and client token, writes config.yaml, generates a client launcher at ./clients/cc-<hostname>, and starts the gateway at http://localhost:8443.
Use it
./clients/cc-<hostname>
Behind a proxy?
HTTPS_PROXY=http://127.0.0.1:7890 bash scripts/quick-setup.sh
Deployment
Local development:
npm run dev
Docker production:
bash scripts/admin-setup.sh
This automated script handles credential extraction, config + first client launcher generation, docker build/start, and prompting for gateway address. To add more clients:
bash scripts/add-client.sh <name>
Then restart the Docker setup:
docker compose restart
What gets rewritten
- Identity: device_id, email, and related metadata to canonical values
- Environment: env object (40+ fields) replaced entirely
- Process: constrainedMemory, rss, heapTotal, heapUsed rewritten or masked
- Headers: User-Agent canonicalized; x-api-key replaced with OAuth token; x-anthropic-billing-header stripped
- Prompt text: Platform, Shell, OS Version, Working directory, and home prefixes rewritten
- Billing/Leak fields: x-anthropic-billing-header stripped; baseUrl and gateway fields removed
Deployment specifics
Local and Docker deployment details are included, with options for TLS and multi-machine setups. There is an OAuth lifecycle section indicating startup with existing tokens, auto-refresh, and token lifecycle management. Configuration notes mention access_token and expires_at alongside refresh_token in config.yaml.
Changelog highlights
The latest v0.2.0 changes include: billing header stripping strategy, new add-client.sh launcher generation, OAuth startup without network calls on launch, proxy support, and enhanced connection-level logging. Earlier v0.1.0 introduced identity rewriting, environment normalization, centralized OAuth, and SSE passthrough.