Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Opt-in bind address for the Claude first-party intercept (serve LAN clients)

Open Beginner friendly
  • Is something wrong?
#6,737 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
85/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, typescript
Domain
backend

Research direction

Read src/claude/intercept/connect-proxy.ts around line 292 to see the hard-coded server.listen call. Add interceptBind and interceptAllowedClients to the Claude config schema, thread the bind address into startConnectProxy with validation that non-loopback requires a credential, and update the ocx claude desktop status command to display the active bind address. Done when the intercept listens on the configured address by default, LAN clients can reach it with the credential, and the status output shows the bind address.

Written by the indexing model from the issue text.

Description

account-pool enhancement needs-design proxy
Area

Proxy and routing

What are you trying to accomplish?

Run one opencodex on one machine and point Claude Code sessions on other machines on the same LAN at its first-party intercept: HTTPS_PROXY=http://opencodex:<password>@<host>:10200 plus that machine's CA in NODE_EXTRA_CA_CERTS. One proxy then holds the account pool, routing, usage log and config for every machine. The gateway listener already supports this for /v1/* with the data-plane key, so only the intercept is missing.

What prevents this today?

startConnectProxy in src/claude/intercept/connect-proxy.ts hard-codes the bind address. On v2.80.0 that is line 292:

server.listen({ port, host: "127.0.0.1", exclusive: true }, () => {

A client on another host can't reach the intercept, and nothing in config changes this. We carry a one-line local patch (host: "0.0.0.0"). The CONNECT proxy still requires its Basic credential, so a LAN client without it is refused.

What should OpenCodex do?

Add an opt-in setting for the intercept's bind address. It defaults to 127.0.0.1, so current behaviour is unchanged.

  • It would only take effect while the intercept requires its credential. Refuse to start with a non-loopback bind and no credential.
  • Optionally accept a list of allowed client networks (for example 192.168.0.0/16), like --allow-private-network elsewhere.
  • Show the bind address in ocx claude desktop status, so a LAN-exposed intercept is visible.
Example usage or interface
"claudeCode": {
  "interceptBind": "0.0.0.0",
  "interceptAllowedClients": ["192.168.254.0/24"]
}

or ocx claude desktop apply --first-party --intercept-bind 0.0.0.0.

Alternatives or workarounds
  • A local patch to connect-proxy.ts. It has to be re-applied after every update.
  • An SSH tunnel per client. Fragile, and every client needs its own.
  • A separate opencodex per machine. That duplicates the account pool, so two machines on one Muse Coding Plan account collide on its limits.
Additional context

Two machines in use today: one runs opencodex (macOS), the other (Linux) runs Claude Code sessions through it with the patched bind. Both are on a private LAN.

Dominant language
TypeScript
Stars
16.9k
Forks
1.3k
Avg merge
7h 34m
Merged PRs (30d)
667

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from lidge-jun/opencodex

All issues in lidge-jun/opencodex

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.