CC Gateway: Control Claude Code Telemetry
Claude Code tracks 640+ telemetry events and fingerprints your machine every 5 seconds. CC Gateway is a reverse proxy that normalizes your device identity, sanitizes system prompts, and blocks privacy leaks. Deploy with Docker, route traffic through your canonical profile, and maintain privacy across multiple machines. Features centralized OAuth, Clash rules for network blocking, and full environment rewriting. Take back control of your AI API usage.
CC Gateway: Take Control of Claude Code Telemetry
Claude Code aggressively collects telemetry - 640+ event types across 3 channels, 40+ environment fingerprints, device IDs, emails, OS details, and hardware specs reported every 5 seconds. CC Gateway is a TypeScript reverse proxy that sits between your Claude Code clients and Anthropic's API, normalizing everything to a single canonical identity.
Why You Need This
- Multi-machine privacy: Use the same 'device' identity across laptops, servers, VMs
- Zero leaks: Environment variables, process metrics, system prompts - all rewritten
- Defense in depth: Env vars + Clash blocking + proxy rewriting
- No browser logins: Centralized OAuth token management
Quick Deployment (5 minutes)
git clone https://github.com/motiful/cc-gateway.git
cd cc-gateway
npm install
npm run generate-identity
npm run generate-token my-laptop
cp config.example.yaml config.yaml
Extract OAuth token from Keychain:
bash scripts/extract-token.sh
Run with Docker:
docker-compose up -d
curl http://localhost:8443/_health
Client Setup (Any Machine)
export ANTHROPIC_BASE_URL="https://your-gateway:8443"
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
export CLAUDE_CODE_OAUTH_TOKEN="gateway-managed"
export ANTHROPIC_CUSTOM_HEADERS="Proxy-Authorization: Bearer YOUR_TOKEN"
claude
No login prompts. Traffic routes automatically.
What Gets Protected
| Layer | What | Action |
|---|---|---|
| Identity | device_id, email, user_id | โ Canonical values |
| Environment | 40+ fields (OS, Node, shell, CI) | โ Single profile |
| Hardware | RAM, heap, CPU | โ Normalized metrics |
| Prompts | block, paths | โ Sanitized |
| Leaks | baseUrl, gateway fields | โ Stripped |
Network Safety Net (Clash Rules)
rules:
- DOMAIN,gateway.your-domain.com,DIRECT
- DOMAIN-SUFFIX,anthropic.com,REJECT
- DOMAIN-SUFFIX,claude.com,REJECT
- DOMAIN-SUFFIX,datadoghq.com,REJECT
Blocks direct connections even if Claude Code updates bypass env vars.
Architecture
โโโโโโโโโโโโโโ ANTHROPIC_BASE_URL โโโโโโโโโโโโโโโโโโโโ
โ Claude Code โ โโโโโโโโโโโโโโโโโโโโโโโ โ CC Gateway โ
โ (any machine)โ โ โข OAuth refresh โ
โโโโโโโโโโโโโโ โ โข Identity rewriteโ
โ โข Prompt sanitize โ
โโโโโโโโโโโโฌโโโโโโโโโโ
โ
Single canonical
identity โ Anthropic
Production Ready
โ MIT License โ Docker Compose โ Health checks โ Token verification endpoint โ 277 GitHub stars โ TypeScript + automated tests
Alpha warning: Test with non-primary accounts first. Monitor Clash logs for new endpoints.
Deploy CC Gateway and reclaim your privacy from AI telemetry tracking.