Skip to main content
The runagain package is a transparent HTTP(S) proxy you drop into your agent’s sandbox. It captures every outbound API/tool call and ships it to RunAgain as a span in the agent’s trace. See Probes for the concept. It bundles mitmproxy — there is nothing else to install or run.

​
Install

​
Run your agent through it

Wrap your agent’s command with runagain-proxy run:
runagain-proxy run starts the bundled proxy, points the child process at it (HTTP_PROXY / HTTPS_PROXY / NO_PROXY), runs your command, and tears the proxy down on exit.
1

Set your key and collector

2

Trust the CA (once per image)

HTTPS interception needs the proxy’s CA certificate in the sandbox trust store:
Prints the certificate path and install steps for common base images (Debian/Ubuntu, Alpine, RHEL).
3

Run

Outbound calls now appear in the agent’s traces with an http badge.

​
Configuration

Set via environment variables (or overridden per session by the backend): On startup the proxy registers with POST /sessions and applies any backend-configured policy, so you can change mode or fixture set without rebuilding the sandbox.

​
Trace matching

Captured calls nest under the span that made them only if the agent’s HTTP client propagates the W3C traceparent header — standard for any OpenTelemetry-instrumented client. Without it, captures fall back to a degraded, best-effort match. See OTLP → trace context.
Probes capture request and response bodies. Secret headers (Authorization, Cookie, API keys) are redacted inside the sandbox before anything leaves it, but review your capture scope for sensitive payload bodies, and use passthrough for traffic you don’t want recorded.