Claude Code Router (CCR) is a cross-platform desktop application built with Electron and React that functions as a local gateway and router for AI agent traffic. It intercepts requests from local AI agents (Claude Code, Codex, ZCode) and routes them to various LLM providers (OpenAI, Anthropic, DeepSeek, etc.) through a configurable proxy. The application manages API keys, routing rules, fallback strategies, and provides detailed usage observability via a system tray and dashboard. It supports complex features like Fusion models (combining base models with tools), IM bot relay integrations (WeChat, Slack, etc.), and deep linking for provider provisioning. The architecture follows a standard Electron pattern with a Main process handling system-level tasks (proxy, SQLite storage, process management) and a Renderer process for the React UI. Data persistence relies on SQLite for configuration and usage logs. The codebase demonstrates significant engineering effort in handling cross-platform differences (macOS/Windows/Linux) for proxy installation, certificate management, and agent profile injection. While the code is well-structured with clear separation of concerns, it carries medium technical drift due to heavy reliance on native dependencies (better-sqlite3) and OS-specific commands for proxy and certificate management.
Proxelar is a high-performance, scriptable local traffic workbench for HTTP, HTTPS, and WebSocket debugging. It functions as a man-in-the-middle (MITM) proxy that can capture, inspect, intercept, modify, replay, and export traffic across multiple protocols (HTTP/1.1, HTTP/2, HTTP/3, WebSocket, SOCKS5, DNS, UDP, and WireGuard). The system is built as a Rust workspace with four crates: `proxelar-cli` (binary with TUI, terminal, and web GUI interfaces), `proxyapi` (core proxy engine with TLS interception, Lua scripting, addon system, route rules, and session export/import), `proxelar-proto` (transport-neutral HTTP core with sans-I/O parsers for HTTP/1 and HTTP/2), and `proxyapi_models` (shared data types for headers, sessions, and captured exchanges). It supports forward and reverse proxy modes, declarative JSON routing rules, Lua addons with SHA-256 verification, and exports to HAR, curl, and raw formats. The architecture is modular with clean dependency direction, extensive integration tests, performance benchmarks, and property-based testing. It is a production-quality developer tool comparable to mitmproxy or Charles Proxy, with a focus on performance, correctness, and extensibility.
SpyGuard is a network traffic analysis tool designed for detecting signs of compromise, particularly stalkerware and spyware, by monitoring WiFi traffic from connected devices. It consists of a frontend Vue.js 3 application for user interaction and capture initiation, and a backend Flask API for managing configuration, threat intelligence, and analysis. The core analysis engine processes PCAP files using Suricata, checks traffic against IOC databases and whitelists, performs heuristic and active checks (passive DNS, WHOIS, SSL validation), and generates JSON/PDF reports. External watchers periodically update threat intelligence feeds from sources like Cisco Umbrella and IP-to-ASN mappings. The architecture separates concerns: frontend handles capture UI and device management, backend provides authenticated APIs for system administration, and the analysis engine performs the detection logic. Key entry points include server/frontend/main.py (frontend service), server/backend/main.py (backend API), server/backend/watchers.py (threat intelligence updater), and analysis/analysis.py (analysis trigger).