--- title: See What Claude Code and Codex Send to the Model description: How to capture what Claude Code, Codex and Grok Build send to the model with a process-scoped proxy, safely. First requests were 15–20k tokens, no MCP tools. canonical: https://spiritroom.app/blog/capture-agent-model-traffic/ published: 2026-10-21 updated: 2026-10-21 --- > Markdown version of https://spiritroom.app/blog/capture-agent-model-traffic/ for agents. Index: /llms.txt [Blog](/blog/) / [Test MCP servers with agents](/guides/test-mcp-servers-with-agents/) # See exactly what your agent sends to the model: wire-capturing Claude Code, Codex and Grok Most of what we know about how agent apps load MCP tools came from looking at the actual requests. Here's the method, minus the scripts, and the traps that change what you see. Leonid Bugaev · Published 21 Oct 2026 **TL;DR** - **Process-scoped proxy:** a fresh CA trusted only by the agent's own process, deleted afterwards. Nothing added to the system keychain. - **Redact before saving:** authorization, API-key and cookie headers, and token patterns. Keep raw dumps out of git. - **What we saw:** first requests of 17,564 (Claude Code), 15,383 (Codex) and 19,674 tokens (Grok Build). None contained the 99 MCP tools. - **Don't use a base-URL proxy for Claude Code:** a custom ANTHROPIC\_BASE\_URL turned tool search off and preloaded every tool, so you'd capture a different app. - **Count tokens yourself** with a fixed tokenizer, and use each provider's usage for billing. [Why capture the wire](#why)[The method](#method)[Redaction](#redact)[What the first requests contained](#saw)[Traps](#traps)[How we measured](#how-we-measured)[FAQ](#faq) ## Why capture the wire Agent apps change fast and their docs lag. The only reliable way to know what reaches the model is to look at the requests. That's how we found that Claude Code sends no MCP definitions up front, that Codex writes JavaScript to find tools, and that a lab flag had silently turned tool search off. See [Claude Code tool search, seen from the wire](/blog/claude-code-tool-search-explained/). ## The method 1. **Start an HTTPS proxy** (we use mitmproxy) on a local port, with a fresh CA in a temporary config folder. 2. **Trust the CA only in the child process:** set `HTTPS_PROXY` plus the app's CA variable (`NODE_EXTRA_CA_CERTS` for Node apps, `SSL_CERT_FILE` or the app's own setting for others) in that process's environment only. 3. **Run the app normally,** with its usual login and endpoint, against your MCP server. 4. **Delete the CA** when the process exits (a shell trap), so nothing stays trusted. 5. **Tokenize the saved bodies** with a fixed tokenizer (we use o200k\_base) and keep each provider's own usage for per-request input. agent process + temp CAlocal proxy, bodies onlymodel API **Want to see what agents send with your server attached?** We capture each agent app's real requests with your MCP server and show what's loaded, searched, cut and resent. [Capture your MCP →](/#contact) ## Redaction - Strip `Authorization`, `x-api-key` and cookie headers. - Mask token patterns in bodies: API-key prefixes, JWTs, Bearer strings. - Grep excerpts again before sharing. Keep raw dumps local and out of git. - For MCP traffic, record JSON-RPC bodies only, never headers. ## What the first requests contained | App | First request | Tools in it | MCP tools | | --- | --- | --- | --- | | Claude Code 2.1.301 | 17,564 tokens | 13, incl. ToolSearch | 0 (113 names in a reminder) | | Codex 0.161.0 | 15,383 tokens | Namespaces: one code tool with a 6,471-token description | 0; found via `ALL_TOOLS` in code | | Grok Build 1.0.60 | 19,674 tokens | 28, incl. search\_tool and use\_tool | 0; server names and counts in a reminder | Same prompt and 99-tool server; all three called the right tool. Totals for the task: about 76k (Claude Code), 137k (Codex), 158k (Grok Build) input tokens. ## Traps - **Base-URL proxies change Claude Code.** With a custom `ANTHROPIC_BASE_URL`, first-request input jumped to 143,357 tokens with tool search off; setting `ENABLE_TOOL_SEARCH=true` brought it back to 22,446. See [Claude Code can't see your MCP tools?](/blog/claude-code-mcp-tools-not-found/) - **Lab flags change defaults.** `--tools ""` also removed ToolSearch: 110,998 tokens, and the env var couldn't restore it. Check your lab command against a default run. - **Untrusted folders.** Grok Build dropped a project MCP server silently in headless mode until the folder was trusted. - **Async connections.** Grok connects servers asynchronously; in about 1 of 8 preflight runs the first request didn't yet list the server. **Go deeper:** [How Codex finds MCP tools](/blog/how-codex-finds-mcp-tools/), [How agents load MCP tools](/guides/how-agents-load-mcp-tools/), [Test against production read-only](/blog/read-only-agent-testing-production/). Back to [testing MCP servers with agents](/guides/test-mcp-servers-with-agents/). ## How we measured - **Captures:** one prompt per app against a local 99-tool stub, 16 Oct 2026, normal logins. - **Config matrix:** Claude Code 2.1.301, “say hi” with the 99-tool mock, first-request input tokens, single runs per config. - **We don't publish our capture scripts;** this page describes the method only. ## FAQ ### How can I see what tools and context Claude Code or Codex sends to the model? Run the app behind an HTTPS proxy scoped to that process, with a temporary CA trusted only by the child process, and record request bodies. Redact credentials before saving. Avoid changing the app's API base URL, which can change its behaviour. ### Is it safe to MITM my own agent app? It can be, if the CA is temporary, trusted only by that process, deleted afterwards, and every credential is redacted before anything is written. Never commit raw captures. ### Does a capture change what the app does? It can. With a custom ANTHROPIC\_BASE\_URL, Claude Code turned tool search off and sent all 99 tool definitions. With an HTTPS proxy and the normal endpoint, tool search stayed on. **Want to see what agents send with your server attached?** We capture each agent app's real requests with your MCP server and show what's loaded, searched, cut and resent. [Capture your MCP →](/#contact) ## Keep reading - Up[How to test an MCP server with real AI agents (guide)](/guides/test-mcp-servers-with-agents/) - Related[How agent apps load MCP tools: what the model sees (guide)](/guides/how-agents-load-mcp-tools/) - Related[Claude Code tool search, seen from the wire: the model picks your tool from its name](/blog/claude-code-tool-search-explained/) - Related[How Codex finds MCP tools: code mode and ALL\_TOOLS](/blog/how-codex-finds-mcp-tools/)