Kangraemin MITM Analysis (Claude Inspector)

Description

macOS desktop app ('Claude Inspector') built to intercept Claude Code's real-time API traffic. Key findings: CLAUDE.md is sent on every request, not just the first (as a system-reminder block on every turn's user message); MCP tools use lazy-loaded schemas while built-in tools ship full schemas every request; single screenshots add hundreds of KB via base64 encoding; skills vs commands handled fundamentally differently (local commands like /clear send only output; skills like /commit inject full prompt text that persists).

Key claims

Relations

Sources

src-20260423-542f02260352