What I learned by putting GitHub Copilot behind a MitM proxy

TL;DR Highlight

Routing Copilot through mitmproxy exposed its context injection and session store.

Who Should Read

A developer who wants to know what context AI coding tools actually send to their servers.

Core Mechanics

Fast-draining credits started it
- The author noticed Copilot credits running out earlier each month.
- That led them to pick VS Code and Copilot as the test subject.
Traffic first, source second
- Source shows what an app can do but not what it actually does at runtime.
- The author watched requests and responses first, then checked the source.
Electron apps share a similar structure
- Electron bundles Node.js with web tech and renders it via Chromium.
- Requests can go through Chromium's network stack or Node's http/https/fetch, which affects interception.
mitmproxy splits the TLS connection in two
- Trusting mitmproxy's local CA creates one TLS connection to the app and another to the server.
- That lets it decrypt and inspect requests.
The public part ends at setup

Community Reactions

The author's own summary comment
- Model and capability discovery and routing were visible in real time.
- Recent edits can pull in context from other files, including .env.
- A SQLite session store behind Chronicle holds past prompts and responses, and the model queries it via tool calls.
Experience that eBPF makes this easier
- It captures plaintext right before encryption and after decryption, so certificate pinning and mTLS don't matter.
- The commenter says it shows telemetry to prompts, including much collection unrelated to the user's request.
Tip about a built-in debug log
- A commenter says the ... menu's "show agent debug logs" shows tool calls, prompts, model selection and token use.
- They add that VS Code can now connect your own otel service.
Opinion: handle .env exposure with sandboxes
- Some were surprised there is no .env rule.
- Others suggested sandboxes without env access, and one team uses per-run, spend-capped keys deleted at teardown.

How to Apply

Open agent debug logs in VS Code
- Today, open the ... menu in a Copilot chat and click "show agent debug logs".
- Check tool calls, prompts and token use to see where credits go.
Separate .env from agent workspaces
- Remove real-secret .env files from directories where agents run.
- If needed, issue per-run spend-capped keys and delete them at teardown.
Audit internal AI tool traffic with mitmproxy
- Install mitmproxy, trust its local CA, and point the tool's proxy setting at it.
- Check which file contents appear in requests and add exclusion rules for sensitive files.

Try It

copy & run

# Paste into Claude or ChatGPT (simplified version of the article's idea)

Below is content I copied from an AI coding tool's request log (mitmproxy or agent debug logs).

{{request log}}

Summarize it in a table:
1. Types of context included (current file, recently edited files, history, system prompt, etc.)
2. Files or data that look unrelated to the current task
3. Strings that may be sensitive such as .env, keys, tokens (mask values, show location only)

Next: suggest which settings I should change to exclude the sensitive items.

Terminology

MITM proxyA middleman between client and server that relays and can read requests and responses. Like a postal worker who opens and reseals letters.

mitmproxyAn open-source proxy that intercepts and shows HTTPS traffic.

ElectronA framework that bundles Node.js and web tech (HTML, CSS, JS) rendered by Chromium into desktop apps. Essentially a website in an app shell.

eBPFA way to run small safe programs in the kernel to observe system behavior. A commenter says it can read data right before encryption and after decryption.

harnessThe app-side control code around an LLM that handles context building, tool calls and memory. Like the chassis and controls around an engine.