Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: A MitM proxy to see what your LLM tools are sending

github.com

Post reply on HN
Print view View original

81–90 of 128 posts

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#81

Post by jmuncor »

maxkfranz wrote: post #57
maxkfranz wrote: post #56

Could you use an approach like this much like a traditional network proxy, to block or sanitise some requests? E.g. if a request contains confidential information (whatever you define that to be), then block it?

Forgot to mention: It’s a neat tool. Well done.

Thank you, what I was thinking was more along the lines of optimizing how you use your context window. So that the LLM can actually access what it needs to, like a incredibly powerful compact that runs in the background with your file system working as a long term memory... Still thinking how to make it work, so I am super open to ideas.

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#82

Post by jmuncor »

bandrami wrote: post #60
zahlman wrote: post #58

Or we could just demand agents that offer this level of introspection?

I certainly wouldn't trust self-reporting on this

Not only trust, but how you later optimize what is in the context to cater how you use llms... There is a whole world to be explored inside that context window.

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#84

Post by jmuncor »

jedberg wrote: post #70
jmuncor wrote: post #68

Earlier quoted context omitted.

Now you can add on top of it :D and we can all create something great :D

As is the case with most vibe coded software, it wasn't polished, didn't work very well, had lots of edge cases, and was pretty much bespoke to my one use case. :) It answered the question "what the heck is this software sending to the LLM" but that was about all it was good for.

That was what I wanted to answer.. hehe What edge cases can you think of, and what polish do you think I can add?

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#85

Post by [deleted] »

catlifeonmars wrote: post #54

This tool looks like it unconditionally disables tls verification for upstream requests. It shells out to mitmproxy with "--set", "ssl_insecure=true" This took all of 5 minutes to find reading through main.py on my phone. https://github.com/jmuncor/sherlock/blob/fb76605fabbda351828... Edit: In case it’s not clear, you should not use this.

[deleted]

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#86

Post by throwaway277432 »

jmuncor wrote: post #73
throwaway277432 wrote: post #72

Earlier quoted context omitted.

>tell me if I earned your star Since you asked: Not in a million years, no. A bug of this type is either an honest typo or a sign that the author(s) don't take security seriously. Even if it were a typo, any serious author would've put a large FIXME right there when adding that line disabling verification. I know I would. In any case a huge red flag for a mitm tool. Seeing that it's vibe coded leads me believe it's d…

I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D

I'm not going to review it in full, sorry. Reviewing is so much more effort compared to producing something with AI. But don't let me deter you, keep on learning and keep on building.

I wish I had the possibilities to learn and build on such a large scale when I started out. AI is a blessing and a curse I guess.

My own early projects were most definitely crap, and I made the exact same mistakes in the past. Honestly my first attempts were surely worse. But my projects were also tiny and incomplete, so I never published them.

However: What little parts I did publish as open-source or PRs were meticulously reviewed before ever hitting send, and I knew these inside and out and they were as good as I could make it.

Vibe-coded software is complete but never as good as you could make it, so the effort in reviewing it is mostly wasted.

I guess what I'm trying to say is I'm a bit tired of seeing student-level projects on HN / Github cosplaying as production ready software built by an experienced engineer. It used to be possible to distinguish these from the README or other cues, but nowadays they all look professional and are unintentionally polluting the software space when I'm actually looking for something.

Please understand that this is not specifically directed at you, it's pent up frustration from reading HN projects over the last months. Old guy yelling at clouds.

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#87

Post by Havoc »

jmuncor wrote: post #23
Havoc wrote: post #20

You don't need to mess with certificates - you can point CC at a HTTP endpoint and it'll happily play along. If you build a DIY proxy you can also mess with the prompt on the wire. Cut out portions of the system prompt etc. Or redirect it to a different endpoint based on specific conditions etc.

Have you tried this with Gemini? or Codex?

I personally switched to opencode. The prompt I wanted to mess with - search - I don’t need to intercept there so less need for a proxy

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#88

Post by gr4vityWall »

jmuncor wrote: post #73
throwaway277432 wrote: post #72

Earlier quoted context omitted.

>tell me if I earned your star Since you asked: Not in a million years, no. A bug of this type is either an honest typo or a sign that the author(s) don't take security seriously. Even if it were a typo, any serious author would've put a large FIXME right there when adding that line disabling verification. I know I would. In any case a huge red flag for a mitm tool. Seeing that it's vibe coded leads me believe it's d…

I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D

I appreciate that attitude. Keep it up.

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#89

Post by antonvs »

jmuncor wrote: post #77
jamespo wrote: post #75

Earlier quoted context omitted.

unlikely to get that from a throwaway

You can always try right?

Only if you don’t care about your reputation.

“Give me your time for free” is not the kind of request that earns respect.

Re: Show HN: A MitM proxy to see what your LLM tools are sending

#90

Post by CurleighBraces »

throwaway277432 wrote: post #86
jmuncor wrote: post #73

Earlier quoted context omitted.

I love the real feedback tbh, I am still learning, and want to learn as much as possible. Would love if you can review it and tell me bluntly either in the repo or here the things that should be improved. I would love to learn more from you and get better :D

I'm not going to review it in full, sorry. Reviewing is so much more effort compared to producing something with AI. But don't let me deter you, keep on learning and keep on building. I wish I had the possibilities to learn and build on such a large scale when I started out. AI is a blessing and a curse I guess. My own early projects were most definitely crap, and I made the exact same mistakes in the past. Honestly…

The README is really annoying.

You used to be able to tell so easily what was a good well looked after repo by viewing the effort and detail that had gone into the README.

Now it's too easy to slop up a README.

Post reply on HN