Tollbooth

# Tollbooth

A transparent proxy for inspecting, debugging, and modifying network traffic—built for LLM agent research but applicable to any HTTP/HTTPS traffic.

Works with **Claude Code**, **Codex CLI**, **Cursor**, **Aider**, and any tool that makes network requests.

> **[Read the full documentation](https://flechettelabs.com/tollbooth)**

## What It Does

Tollbooth is a man-in-the-middle proxy that captures **all network traffic** from the agent container. While built for monitoring LLM agent communications (with automatic parsing of API calls into conversations), it intercepts everything—including requests from tools that agents invoke, package managers, and any other network activity. Useful for agent research, security testing, and network debugging.

- **Inspect All Traffic** - See every HTTP request. LLM API calls are parsed into readable conversations; other traffic shown raw.
- **Conversation Trees** - Visualize branching conversations with a gitflow-style tree view. Branches from retries, replays, and natural divergence are shown with merge connectors where paths reconverge.
- **Modify Requests** - Intercept and edit any request before it reaches its destination. Mark items as timeout-immune for extended inspection.
- **Mock Responses** - Serve stored responses instead of forwarding requests
- **Rules Engine** - Automated traffic handling with priority-based rules, static modifications, drop actions, and smart fall-through when modifications don't apply
- **Export Conversations** - Export conversations as JSON, Markdown, or styled HTML
- **Detect Refusals** - ML-powered detection of LLM refusals with automatic handling

## Quick Start

```bash
# 1. Generate certificates
./setup-certs.sh

# 2. Start services
docker compose up

# 3. Open UI
open http://localhost:5173

# 4. Run your agent through the proxy
docker compose run --rm agent
```

## Architecture

```
┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│   LLM Agent     │────▶│