Codesteward/Audit Proxy

Every decision your agent makes,
recorded and queryable

A zero-config reverse proxy that intercepts LLM API traffic from any AI coding agent and writes structured audit logs — including thinking blocks, narration, and tool calls. One environment variable is all it takes.

Claude CodeCodex CLIGemini CLIany LLM API client
Live Logs
AgentProxyLLM APIAudit Log
Recent events
thinking"I need to refactor the auth middleware…"
narration"I'll update the session handler to…"
tool_callfile_write → src/auth/session.ts
thinking"Now I should verify the tests pass…"

AI agents operate without a record

Coding agents read files, write code, run commands, and make architectural decisions autonomously. But unless you instrument each agent individually, you have no record of why an agent did what it did, what it was planning, or what alternatives it considered.

Hooks and MCP servers capture tool calls, but miss the most important part. Thinking blocks and assistant narration — the plan and the why — live in the raw API message stream, not in tool events. The only way to capture them is at the HTTP layer.

The plan, the why, and the what

Every LLM API response is decomposed into three structured components and stored as a linked audit record.

01

Thinking blocks

The agent's internal reasoning before it acts — what it understood, what approach it chose, what risks it identified.

02

Assistant text

The agent's narration to the user — the explanation it gives for its next action.

03

Tool calls

The exact tool invoked with full input arguments, linked to the thinking and narration that preceded it.

Transparent. Zero overhead. Non-blocking.

The proxy sits between the agent and the upstream LLM API. From the agent's perspective, nothing changes.

Stream tap, never buffer

Tokens are forwarded immediately while capturing a copy for audit asynchronously. Zero latency overhead.

Multi-provider support

Anthropic, OpenAI, and Gemini APIs. Streaming and non-streaming responses across all three providers.

Batched storage

Events accumulate in memory and flush to ClickHouse on size or time threshold. Storage failures never interrupt the agent.

Multi-tenancy

Project and branch tags on every row so multiple repositories share one ClickHouse instance.

OpenTelemetry traces

One span per request with gen_ai.system, session IDs, latency, and W3C trace context propagation.

Proxy chaining

Slots into existing proxy chains — Portkey, LiteLLM, corporate firewalls. No need to replace what you have.

Native plugins for VSCode and JetBrains

Configure the proxy, inject developer identity, and monitor audit headers — without leaving your IDE.

VSCode Extension

  • One-click proxy enable/disable from the status bar
  • Auto-detects git user, project, and branch
  • Header inspector panel shows active audit metadata
  • Works with Claude Code, Cline, Continue, and more

JetBrains Plugin

  • Terminal-level env var injection for all agents
  • Branch change tracking via VCS listeners
  • Shared team config via .codesteward.json
  • Health check monitoring with status bar widget

Supported agents

Claude CodeCodex CLIGemini CLIClineAiderContinue

One variable. That's it.

Prerequisites: Go 1.22+ and a running ClickHouse instance.

# 1. Apply the schema
clickhouse-client --multiquery < migrations/001_initial.sql

# 2. Start the proxy
CLICKHOUSE_DSN=clickhouse://localhost:9000/audit go run ./cmd/proxy

# 3. Point your agent at the proxy
ANTHROPIC_BASE_URL=http://localhost:8080  # Claude Code
OPENAI_BASE_URL=http://localhost:8080/v1   # Codex CLI
API keys are never stored. Authorization headers are forwarded transparently but scrubbed from all audit records. The proxy binds to 127.0.0.1 by default.

Full audit trail for every agent action.

See the documentation for configuration and query examples.