Intercept LLM traffic - CorporateLabs

Intercept runs a local HTTPS proxy, decrypts traffic to known LLM APIs, and sends labeled events to CorporateLabs. Use it when you want to see model calls (and related PII/canary hits), not only process discovery.

Easiest path: console recipe

Console → Installations → create or select a clabs CLI installation.
Open the Intercept recipe.
Copy the script, paste your access key if prompted, and run it on the host.

That path generates a CA, starts intercept, and runs a sample egress check.

CLI overview

export CLABS_ACCESS_KEY='clt_…'

# one-time CA for this machine/job
clabs ca generate -out ./data/ca

# wrap your agent (proxy + trust store injected; scoped to the child PID)
clabs intercept -ca-dir ./data/ca -- python3 agent.py

Or attach to an already-running process:

clabs intercept -ca-dir ./data/ca -pid 12345
# configure that process to use HTTPS_PROXY=http://127.0.0.1:8888
# and trust ./data/ca/cert.pem

What success looks like

In Events you should see http_request (or similar) rows targeting an LLM vendor host (for example api.openai.com), often with intercept-related labels.

Intercept is best for demos and controlled jobs. Prefer discover (clabs run) for always-on host coverage.