See what your AI tools actually send
When you press Tabin Cursor or paste into Claude, the assumption is “just my prompt goes out.” The reality is messier. upbox is a local proxy and dashboard that records every request your AI assistants make, redacts secrets before forwarding, and shows you what happened: on your machine, with zero cloud calls.
A day in the life of one developer.
illustrative figures · your real numbers appear in the dashboard · single workstation
“Just my prompt goes out.” Not really.
Vendors aren't necessarily being shady. Their docs just don't match what people think is happening, and there's no built-in way to verify from the outside. So we built one.
- 01The current file. Often neighbor files too.Tab-complete in Cursor frequently ships several KB of surrounding context, including files you didn't have open.
- 02The project tree, env vars, sometimes shell history.Workspace metadata gets bundled in. None of it is logged anywhere you can read.
- 03Secrets from .env files you never meant to share.An AWS_ACCESS_KEYsitting two lines above the function you're editing goes out by default.
- 044–8 AI tools running at once.A typical developer can't track all of it. Nobody can.
The dashboard, running locally.
Every request, in real time, grouped by tool. Click any row to inspect the body, headers, redactions, and what was forwarded.
Request body (4 KB excerpt)
{
"model": "gpt-4o-cursor",
"stream": true,
"messages": [
{ "role": "system", "content": "You are a coding assistant." },
{ "role": "user", "content": "Fix the type error in this file." }
],
"context": {
"file": "src/payments.ts",
"neighbors": ["lib/utils.ts", "types.d.ts"],
"snippet": "const STRIPE_KEY = 'sk_live_3Hf9...XQpZ';\n const AWS_ACCESS = 'AKIAXXXXXXXXXXXXXXXX';"
},
"metadata": { "endpoint": "cmd-k", "workspace": "monorepo" }
}Six capabilities. One binary. One SQLite file.
Curated capture scope: VPN-safe by default
upbox start now only redirects packets from a curated list of AI-tool processes: Claude, Cursor, ChatGPT, Codex, Ollama, common browsers. VPN clients (Tailscale, WireGuard, OpenVPN, NordVPN, Mullvad, ProtonVPN) and unrelated apps are never touched, so tunnels stay up.
Live feed
Every request as it happens, grouped by tool. Tiles for Cursor, Claude desktop, Copilot, ChatGPT, Codeium, plus generic OpenAI / Anthropic / Gemini fallbacks.
Bodies, headers, the lot
The actual prompt. The actual file content. The actual headers. Content-Type-aware: parses JSON properly so gzipped or nested-field secrets don't slip through.
Strip secrets before forwarding
Regex rules strip .env blocks, API keys, and PII patterns before the request reaches the cloud. Ships with AWS / OpenAI / Anthropic / GitHub defaults.
Domain allowlist per tool
Allow only the destinations you've sanctioned. Warn or block unknown hosts. See the receipts in the audit log when a tool reaches somewhere new. A TLS allowlist (built from tools.yaml) means non-AI HTTPS traffic passes as a CONNECT tunnel without decryption: banking, Teams, pinned-cert apps keep working.
JSONL + CSV export
Article-26-friendly fields. Tamper-evident hash chain lands in v0.2. Filter by tool, time range, status. The compliance team gets a real artifact, not a screenshot.
Nothing leaves your machine
SQLite on disk. Dashboard binds to 127.0.0.1 only and refuses to start on any other host. Zero outbound calls from upbox itself.
One process. Boring stack.
mitmproxy as the TLS interception core, captured at the OS level via the mitmproxy-rs LocalMode redirector. A TLS allowlist routes non-AI traffic through as a CONNECT tunnel without decryption: banking and pinned-cert apps keep working. SQLite as the audit store. FastAPI + HTMX for the dashboard, no build step.
- → mitmproxy · MIT · proxy core
- → FastAPI · MIT · dashboard backend
- → HTMX · BSD-2 · frontend without a build
- → SQLite · public domain · audit log
- → Pico.css · MIT · minimal styles
curated AI processes (VPN clients, banking, OS noise: Claude · Cursor · ChatGPT never redirected · tunnels stay up) Codex · Ollama · code · browsers │ ▼ LocalMode redirector · mitmproxy-rs · OS-level capture ┌─────────────────────────────────┐ │ mitmproxy core + upbox addons │ ─ AI host (allowlist) ─▶ decrypt · process · forward │ ┌───────────────────────────┐ │ to cloud LLM │ │ 1 fingerprint (tag tool) │ │ │ │ 2 enforce (allow|warn|403)│ │ ─ pinned host (off list) ─▶ CONNECT tunnel │ │ 3 redact (json-aware) │ │ (no decryption · │ │ 4 capture → SQLite │ │ Teams · banking │ └───────────────────────────┘ │ keep working) └────────────────┬────────────────┘ ▼ ┌──────────────────┐ ┌──────────────────┐ │ SQLite · WAL │ ◀────┤ dashboard │ │ ~/.upbox/ │ │ FastAPI + HTMX │ └──────────────────┘ └──────┬───────────┘ │ ▼ 127.0.0.1:8800 ← you ✗ refuses any other host
Five ways. Same binary.
Pick whichever fits your setup. Python 3.12+ required.
Endpoint-level evidence, before the deadline.
upbox is a deployer-side tool. It does not certify you compliant on its own, but it produces the evidence and controls that the obligations demand.
- Live dashboard groups traffic by tool, host, request size
- Audit log is queryable and exportable: real artefacts, not policy slides
- Per-tool allowlist enforces destination policy
- ts · tool · method · scheme · host · path: every interaction
- req_bytes · resp_bytes · status: size + outcome
- headers_json · body_excerpt · body_hash: integrity (SHA-256 of full body)
- redactions_applied_json · blocked: what the engine intervened on
- upbox export --format jsonl|csv with --since / --until / --tool filters
- What was sent, when, where, by which tool, in what size, with what status. All queryable per tool.
- Auditable open-source proxy + redaction + enforcement + retention
- Exportable evidence trail rather than verbal policy claims
- Content-aware: JSON bodies parsed + walked + re-serialised
- Defaults: AWS / OpenAI / Anthropic / GitHub keys + dotenv lines
- Extendable via ~/.upbox/rules/redact.yaml
- Local CA the user installs and can uninstall (upbox init --uninstall)
- Dashboard binds 127.0.0.1 only: refuses any other host
- Zero outbound calls from upbox itself
- Encrypted-at-rest SQLite + tamper-evident hash chain land in v0.2
- Per-tool destinations + data classes + observed volume: straight from the audit log
- upbox export --format csv produces a spreadsheet your privacy team can hand off
upbox is not legal advice. It is a deployer-side technical measure: it produces evidence and controls, not a certification. Consult counsel for compliance sign-off.
Questions you should be asking.
A closed-source tool that watches your AI traffic is itself a privacy problem. The auditor has to be open.
No. upbox makes zerooutbound network calls of its own. The proxy forwards the requests your AI tools were going to make anyway: that's the entire network footprint. The dashboard binds to 127.0.0.1 only and refuses to start on any other host.
Stored locally in ~/.upbox/upbox.db (SQLite, WAL mode). The body_excerpt column holds the first 4 KB; full bodies are not persisted. body_hash (SHA-256) is recorded for integrity.
About 5 KB per request. ~500 requests/day is roughly 2.5 MB/day or ~900 MB/year. Configurable retention lands in v0.2; until then, prune manually with a one-line SQL DELETE.
Negligible. The mitmproxy core handles tens of thousands of requests per second; AI tools peak in the low hundreds per hour. Latency added per request: ~1–5 ms.
A handful of mobile and certain desktop clients ship with hard-coded CA fingerprints. Without modifying the app binary, you can't MITM them. Known-working and known-broken tools are listed in the docs.
Yes. Edit ~/.upbox/rules/tools.yaml (or redact.yaml, or allowlist.yaml), or use the dashboard's /settings page. Restart upbox start to apply.
Not in v0.1: the body_hashcolumn proves each captured body is intact, but the row sequence itself isn't chained. Tamper-evident hash chain lands in v0.2 as part of the compliance lens.
Install once. Run it for a week. The first screenshot is usually a surprise.
v0.1.0 just shipped and is moving fast. The fastest way to help: install it, run it against your daily tools, and report what surprised you.