I could not point Claude Code at localhost, so I MITM Bedrock on loopback

Description and use

The claude‑sniff tool intercepts, inspects, and optionally edits Claude Code requests to Bedrock via a local MITM proxy, enabling cost tracking and secure handling of AWS credentials.

Problem

Claude Code on Amazon Bedrock does not expose its invoke requests to a local proxy, making it hard to inspect, edit, or cost‑track requests.

Outcome

The claude-sniff tool enables local inspection, editing, and cost tracking of Claude Code requests without exposing AWS credentials, improving transparency and control for developers.

Workflow

• 1. Install dependencies with uv sync and run uv run python main.py --aws-profile your-profile to start mitmproxy on 127.0.0.1:9090.
• 2. In the same shell, set HTTP_PROXY and HTTPS_PROXY to the mitmproxy address and launch Claude Code with claude.
• 3. Keep Proxy and Intercept disabled by default; enable Intercept only when you want to decrypt and edit requests.
• 4. Export the mitmproxy CA certificate and restart Claude Code to trust the proxy.
• 5. Intercept Bedrock invoke/invoke-with-response-stream calls, edit the JSON payload as needed, then forward the request.
• 6. The tool re‑signs edited requests and resumes untouched JSON as-is; no calls are dropped unless explicitly configured.

Evidence

I built claude-sniff: one Python process, mitmproxy on 127.0.0.1:9090, UI on 8765.

Source

Intercept holds Bedrock invoke / invoke-with-response-stream that carry x-claude-code-session-id.

Source