Malcolm 0.1.0

First public release of Malcolm, a transparent monitoring proxy for LLM API calls. Malcolm sits between LLM client tools (Claude Code, OpenCode, etc.) and the model backend, capturing every request and response for inspection.

Highlights

• Transparent proxy that forwards traffic to any LLM backend (OpenAI, Anthropic, Ollama, or any HTTP API) while persisting full request/response payloads to a local SQLite database, including streaming events.
• Pluggable transform pipeline configured in malcolm.yaml. Plugins may act as transforms (mutate traffic) or annotators (observe traffic and emit structured metadata without breaking forwarding).
• Terminal UI for browsing logs without leaving the terminal: two-level drill-down (request list → detail view), syntax highlighting, follow mode for live tailing, and dynamic columns driven by annotations.
• Entry-point based plugin discovery: third-party transforms install as regular pip packages and are picked up automatically at startup.

Built-in plugins

Plugin	Kind	Description
llm_annotator	annotator	Extracts LLM metadata (model, messages, tools, usage) for the TUI
ghostkey	transform	Obfuscates secrets (API keys, tokens) before they reach the backend
translation	transform	Protocol translation between Anthropic and OpenAI formats, including path rewriting and streaming event conversion

Installation

pip install malcolm-proxy

Quick start

malcolm --malcolm-target-url=http://localhost:11434/v1

Then point your LLM tool to Malcolm (default http://127.0.0.1:8900) and browse captured traffic with:

malcolm tui

Compatibility

• Python 3.12+
• Tested on Linux. Should work on macOS and Windows but is not yet validated there.

Documentation

• README
• Architecture
• Configuration
• Scenarios

Notes

Malcolm is in early development. APIs and configuration may change between releases until the project reaches 1.0.