Traffic Lens — Security skill for Claude Code

traffic-lens

**See what talks to what in your system.** traffic-lens is a [Claude Code](https://claude.com/claude-code) skill that maps every API call between your apps, services, workers, databases, queues and third-party APIs, and turns it into an interactive diagram you can open in any browser.

https://github.com/user-attachments/assets/ddbbb3b2-80e5-44e7-8964-2c85925883ce

Why

Architecture diagrams go stale, and they rarely show the details you actually need: which service calls which route, whether it's authenticated, and what breaks when something goes down. traffic-lens builds the map from the system itself:

• The code: Claude reads your repo(s) and records every route served and every call made, with the file:line that makes it.
• Real traffic (optional): browser HAR captures and OpenTelemetry, Jaeger or Zipkin traces are merged in, so the map shows what actually happens, not just what the code says.

Where the two disagree, you get a finding.

What you get

A single, self-contained HTML file that works offline and is easy to share:

• Map: services as cards and calls as lines. Animated particles show the direction of traffic, line thickness shows volume, and color shows health.
• Click anything: a service shows the routes it serves, who calls it and what it calls. A line shows every route on it, with request counts, error rates, latency and source locations.
• Flows: follow one request (e.g. checkout) hop by hop across the system, with a waterfall of real sample requests when traces are available.
• Blast radius: pick a service and see everything that breaks if it goes down.
• Findings: automatic checks, each one highlighted on the map:

Category	Examples
Security	unauthenticated write/admin routes, internal services reachable from outside, plain-HTTP calls, wildcard CORS
Contract	calls to routes that don't exist, routes nobody calls, traffic the code doesn't explain
Health	high error