[opensourcedex]

cc-gateway is a free, open source api development & testing project written in TypeScript and released under MIT. It has 3,044 GitHub stars, 503 forks and 21 open issues, and was last pushed 6 months ago. On this registry it ranks #67 of 103 tracked projects in API Development & Testing, with 5 head-to-head comparisons available. It gained 3 stars over the last 3 tracked days.

What is cc-gateway?

CC Gateway is a reverse proxy that sits between Claude Code and the Anthropic API and normalizes device identity, environment fingerprints and process metrics into a single canonical profile, so developers and teams can decide exactly what telemetry leaves their network.

What it is

CC Gateway is an open-source TypeScript project, MIT-licensed, that acts as an identity gateway in front of the Anthropic API for users of Claude Code. It is a reverse proxy: Claude Code keeps running as normal, but its traffic is routed through the gateway, which rewrites the identifying content of each request before forwarding it. The rewrite covers the device ID, email, session metadata, the user_id JSON blob, the entire env object, the system prompt block injected into every request, and process metrics such as constrainedMemory, heap size and RSS. The result is that many machines appear as one canonical profile rather than as many distinct fingerprints.

The problem it solves is that Claude Code, by default, has no built-in way to manage how identity is presented to the API. The README states that the client collects 640+ telemetry event types across three parallel channels, fingerprints the machine on 40+ environment dimensions, and phones home every five seconds, reporting device ID, email, OS version, installed runtimes, shell type, CPU architecture and physical RAM. On multiple machines, each device receives a unique permanent identifier. The gateway replaces that native per-device reporting with one controlled profile, so the environment differences that would otherwise leak across a fleet are masked.

Key capabilities

  • Full identity rewrite: the device ID, email, session metadata and the user_id JSON blob in every API request are normalized to one canonical identity.
  • 40+ environment dimensions replaced: platform, architecture, Node.js version, terminal, package managers, runtimes, CI flags and deployment environment — the whole env object is swapped rather than patched.
  • System prompt sanitization: the block injected into every prompt (Platform, Shell, OS Version, working directory) is rewritten to match the canonical profile.
  • Billing header stripped: x-anthropic-billing-header, which carries a per-session fingerprint hash, is removed entirely, consistent with the official CLAUDE_CODE_ATTRIBUTION_HEADER=false toggle; the README notes this enables cross-session prompt cache sharing and reduces system prompt costs by roughly 85%.
  • Process metrics normalization: constrainedMemory, heap size and RSS are masked to canonical values so hardware differences do not leak.
  • Zero-login client setup with centralized OAuth: clients receive a single launcher script with no browser OAuth, no ~/.zshrc changes and no config files, while the gateway refreshes tokens internally so client machines never contact platform.claude.com.
  • Telemetry leak prevention: baseUrl and gateway fields that would reveal proxy usage in analytics events are stripped.

Who uses it and how

  • Developers running Claude Code on several machines, who would otherwise accumulate a unique permanent identifier per device and want one consistent profile across all of them.
  • Small teams, where an admin generates a per-person launcher with bash scripts/add-client.sh alice, producing ./clients/cc-alice to hand to that person.
  • Privacy-conscious operators behind corporate or personal proxies, routing outbound traffic through HTTPS_PROXY or HTTP_PROXY with tools such as Clash or V2Ray.
  • Environments where CI flags and deployment environment values would otherwise distinguish one machine from another.

Getting started

Quick Start requires Node.js 22+ and an existing Claude Code login on the machine; clone the repository at https://github.com/motiful/cc-gateway.git, run npm install and then bash scripts/quick-setup.sh. The script extracts OAuth credentials from the macOS Keychain, generates a canonical device identity and client token, writes config.yaml, produces a client launcher under ./clients/, and starts the gateway on http://localhost:8443.

How it compares

The facts provide no list of paid products that this project replaces, and they name no directly comparable tools, so CC Gateway stands alone in this registry. It is best understood as a privacy-oriented mediator for Claude Code traffic.

When to use it — and when not to

CC Gateway is labelled Alpha and under active development, so it should be tested with a non-primary account before any wider rollout, and a self-hoster must operate a Node.js 22+ runtime plus a local gateway on port 8443, with the Quick Start credential path relying on the macOS Keychain. Anyone not running Claude Code, or anyone who needs a stable production-grade component with a full release history rather than an alpha, should not adopt it yet.

project readme (upstream, from github) — read inline

Take back control of your AI API telemetry

[![License: MIT][license-shield]][license-url] [![Version][version-shield]][version-url] [![Tests][tests-shield]][tests-url] [![Follow @whiletrue0x][twitter-shield]][twitter-url]

Quick Start · Add Clients · What Gets Rewritten · Deployment · Changelog

Alpha — This project is under active development. Test with a non-primary account first.

Disclaimer — See full disclaimer below.

Why

Claude Code collects 640+ telemetry event types across 3 parallel channels, fingerprints your machine with 40+ environment dimensions, and phones home every 5 seconds. Your device ID, email, OS version, installed runtimes, shell type, CPU architecture, and physical RAM are all reported to the vendor — continuously.

If you run Claude Code on multiple machines, each device gets a unique permanent identifier. There is no built-in way to manage how your identity is presented to the API.

CC Gateway is a reverse proxy that sits between Claude Code and the Anthropic API. It normalizes device identity, environment fingerprints, and process metrics to a single canonical profile — giving you control over what telemetry leaves your network.

Features

  • Full identity rewrite — device ID, email, session metadata, and the user_id JSON blob in every API request are normalized to one canonical identity
  • 40+ environment dimensions replaced — platform, architecture, Node.js version, terminal, package managers, runtimes, CI flags, deployment environment — the entire env object is swapped, not patched
  • System prompt sanitization — the `` block injected into every prompt (Platform, Shell, OS Version, working directory) is rewritten to match the canonical profile
  • Billing header stripped — the x-anthropic-billing-header (which contains a per-session fingerprint hash) is removed entirely, consistent with the official CLAUDE_CODE_ATTRIBUTION_HEADER=false toggle. This also enables cross-session prompt cache sharing, reducing system prompt costs by ~85%
  • Process metrics normalization — physical RAM (constrainedMemory), heap size, and RSS are masked to canonical values so hardware differences don't leak
  • Zero-login client setup — clients receive a single launcher script. No browser OAuth, no ~/.zshrc changes, no config files
  • Centralized OAuth — the gateway manages token refresh internally; client machines never contact platform.claude.com
  • Instant startup — gateway uses your existing access token on launch. No network call until the token actually expires
  • Proxy-aware — supports HTTPS_PROXY / HTTP_PROXY env vars for outbound connections (Clash, V2Ray, etc.)
  • Telemetry leak prevention — strips baseUrl and gateway fields that would reveal proxy usage in analytics events

Quick Start

One command. Requires Node.js 22+ and an existing Claude Code login on this machine.

git clone https://github.com/motiful/cc-gateway.git
cd cc-gateway
npm install
bash scripts/quick-setup.sh

This will:

  1. Extract your OAuth credentials from macOS Keychain (access token + refresh token)
  2. Generate a canonical device identity and client token
  3. Write config.yaml
  4. Generate a client launcher at ./clients/cc-
  5. Start the gateway on http://localhost:8443

Use it

In another terminal:

./clients/cc-<hostname>

That's it. Claude Code launches, traffic routes through the gateway. No env vars to set, no files to edit.

Behind a proxy?

HTTPS_PROXY=http://127.0.0.1:7890 bash scripts/quick-setup.sh

The gateway will route all outbound traffic (API calls + token refresh) through your proxy.

Add Clients

Each person gets their own launcher script with a unique token. The admin generates it:

bash scripts/add-client.sh alice
bash scripts/add-client.sh bob

This creates ./clients/cc-alice and ./clients/cc-bob. Send each file to the respective person.

Client setup (what you tell them)

chmod +x cc-alice
./cc-alice install        # installs as 'ccg' command
ccg                       # start Claude Code through gateway

That's it. All Claude arguments work: ccg --print "hello", ccg --resume, etc.

Optional: make claude go through gateway too

ccg hijack                # alias claude → ccg (new terminals auto-apply)
claude                    # now goes through gateway
ccg release               # undo — restore native claude

All commands

ccg                       Start Claude Code through gateway
ccg install               Install as 'ccg' system command
ccg uninstall             Remove 'ccg' and clean up
ccg hijack                Make 'claude' also go through gateway
ccg release               Restore 'claude' to native
ccg native [args]         Run native claude once (bypass gateway)
ccg status                Show gateway connection and hijack status
ccg help                  Show help

ccg and claude coexist by default. Hijack is opt-in and reversible. Supports zsh, bash, and fish.

What Gets Rewritten

Layer Field Action
Identity device_id in metadata + events → canonical ID
email → canonical email
Environment env object (40+ fields) → entire object replaced
Process constrainedMemory (physical RAM) → canonical value
rss, heapTotal, heapUsed → randomized in realistic range
Headers User-Agent → canonical CC version
x-api-key → real OAuth token (injected by gateway)
x-anthropic-billing-header → stripped
Prompt text Platform, Shell, OS Version → canonical values
Working directory → canonical path
/Users/xxx/, /home/xxx/ → canonical home prefix
Billing x-anthropic-billing-header system block → stripped entirely
Leak fields baseUrl (ANTHROPIC_BASE_URL) → stripped
gateway (provider detection) → stripped

Deployment

Local (development)

npm run dev    # tsx watch, auto-reload

Docker (production)

bash scripts/admin-setup.sh

This interactive script:

  1. Extracts OAuth credentials
  2. Generates config + first client launcher
  3. Builds and starts the Docker container
  4. Asks for the gateway address clients should connect to

After setup, add more clients with:

bash scripts/add-client.sh <name>
# Restart to pick up new tokens:
docker compose restart

Multi-machine deployment

Mac-A ──┐
Mac-B ──┼──→ gateway-server:8443 ──→ api.anthropic.com
Mac-C ──┘

Important: All machines — including the admin — should use the gateway. Direct connections from the admin machine would create a second device fingerprint visible to Anthropic.

For remote deployment, generate TLS certificates:

mkdir certs
openssl req -x509 -newkey rsa:2048 \
  -keyout certs/key.pem -out certs/cert.pem \
  -days 365 -nodes -subj "/CN=cc-gateway"

Uncomment the tls section in config.yaml, then generate client launchers pointing to the server address:

bash scripts/add-client.sh alice "" <gateway-ip>:8443 https

Alternative: Tailscale (zero config networking)

If all devices have Tailscale installed, run the gateway on any machine in the mesh. No TLS needed (Tailscale encrypts the tunnel), no public IP needed, no port forwarding.

Architecture

Client machines                        CC Gateway                    Anthropic
┌────────────┐                    ┌──────────────────┐
│ ./cc-alice  │── ANTHROPIC_ ────│  Auth: x-api-key  │
│  (launcher) │   BASE_URL       │  OAuth: auto-     │
│  + env vars │                  │    refresh        │──── single ────▶ api.anthropic.com
│             │                  │  Rewrite: all     │     identity
│             │                  │    identity       │
└────────────┘                    │  Strip: billing   │
                                  │    header         │
                                  │  Stream: SSE      │
                                  │    passthrough    │
                                  └──────────────────┘
                                         │
                                   platform.claude.com
                                   (token refresh only,
                                    from gate

readme truncated — read the full docs on github

Frequently asked questions

Is cc-gateway free to use?

cc-gateway is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does cc-gateway do?

AI API identity gateway — reverse proxy that normalizes device fingerprints and telemetry for privacy-preserving API proxying

What is cc-gateway written in?

cc-gateway is primarily written in TypeScript. Its source is publicly available at https://github.com/motiful/cc-gateway, and it has 3,044 GitHub stars.