> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corporatelabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Intercept LLM traffic

> Capture HTTPS calls from an agent process to LLM vendors.

Intercept runs a local HTTPS proxy, decrypts traffic to known LLM APIs, and
sends labeled events to CorporateLabs. Use it when you want to see model calls
(and related PII/canary hits), not only process discovery.

## Easiest path: console recipe

1. Console → **Installations** → create or select a **clabs CLI** installation.
2. Open the **Intercept** recipe.
3. Copy the script, paste your access key if prompted, and run it on the host.

That path generates a CA, starts intercept, and runs a sample egress check.

## CLI overview

```bash theme={null}
export CLABS_ACCESS_KEY='clt_…'

# one-time CA for this machine/job
clabs ca generate -out ./data/ca

# wrap your agent (proxy + trust store injected; scoped to the child PID)
clabs intercept -ca-dir ./data/ca -- python3 agent.py
```

Or attach to an already-running process:

```bash theme={null}
clabs intercept -ca-dir ./data/ca -pid 12345
# configure that process to use HTTPS_PROXY=http://127.0.0.1:8888
# and trust ./data/ca/cert.pem
```

## What success looks like

In **Events** you should see `http_request` (or similar) rows targeting an LLM
vendor host (for example `api.openai.com`), often with intercept-related labels.

<Tip>
  Intercept is best for demos and controlled jobs. Prefer discover (`clabs run`) for always-on host coverage.
</Tip>