Traffic inspector and redactor for AI coding agents

What to build

A local CLI proxy that wraps coding agents like Claude Code, Cursor, and Copilot CLI, logging every request and response and redacting secrets or sensitive file paths before they leave the developer's machine. Built for security-conscious engineers and teams under data-handling policies who need an audit trail of what their AI agent actually transmits.

Coding agents are sending raw prompts, file contents, and sometimes secrets to third-party vendors with no local audit or redaction layer, and security teams have no vendor-agnostic way to see or control that traffic.

Demand

Security-conscious engineers and companies with data-handling policies want this now because coding-agent adoption is outpacing vendor-side guardrails, leaving a visible gap between what agents send and what compliance teams can verify.

• Product HuntLaunch

  Product Hunt listing for shim-cli: 'See what your coding agent sends. Mask what you can.' — a live launch discussion thread for a tool matching this exact opportunity.

• Signal opportunity description (shim-cli)Opportunity

  Opportunity framed around building a lightweight CLI proxy/observability layer for coding agents that logs every request/response, redacts secrets and sensitive paths before they leave the machine, and gives developers an audit trail of what their AI agent actually sent.

• Signal metadata (shim-cli)Score

  Signal scored 0.56 with historical match 'none', indicating a novel/unmatched tech opportunity with moderate confidence and no prior comparable signal on record.

Stack

• Go or Rust CLI (single static binary for easy distribution)
• Local TLS MITM proxy (mitmproxy-style cert injection)
• Gitleaks-style regex/entropy secret detection rules
• SQLite for local audit log storage
• YAML config for redaction allowlists/denylists
• Shell wrapper hooks around Claude Code / Cursor CLI / Copilot CLI invocation

Solo + AI difficulty

The basic version — wrapping one agent's CLI, piping its traffic through a local proxy, and regex-redacting obvious secrets — is a solid weekend-to-2-week build for one person with AI help. The hard part is keeping redaction accurate across multiple agents' differing protocols (some use plain HTTP, some have their own session/auth layers) without breaking the agent's functionality, which pushes a solid multi-agent MVP to 4-6 weeks.

Entry threshold

A solo developer can build a basic version (local proxy intercepting CLI agent traffic, pattern-based masking, simple log viewer) in one to two weeks; deeper coverage of multiple agent protocols and robust secret detection takes longer and is the main technical barrier.

Window

6-9 months

Where to find first users

• Hacker News launch (Show HN)
• r/netsec and r/devops
• Product Hunt (listing already exists for shim-cli, worth engaging that thread)
• Security engineering Slack/Discord communities and newsletters

Counter-signals & risks

• No concrete market evidence (user demand signals, competitor launches, or incident reports) is cited beyond the opportunity description itself, making the claim largely speculative at this stage.

• Major AI coding tool vendors (Anthropic, GitHub, Cursor) could ship native logging/redaction/audit features directly, eliminating the need for a third-party proxy layer.

• Security-conscious teams may prefer enterprise-grade solutions (e.g., SSO-integrated DLP or CASB tools) over a standalone CLI shim, limiting adoption to a narrow niche of individual developers.