See what your apps are
actually sending to OpenAI & Anthropic.
turbo-flow taps every outbound LLM call at the kernel, scans every prompt and response for PII, credentials, and regulated identifiers, and writes a per-process audit log your CISO can show an auditor. SOC 2 evidence, HIPAA-aligned PHI tripwire, DLP control — all from a single MIT-licensed binary. Zero SDK changes.
curl -fsSL https://github.com/blasrodri/turbo-flow/releases/latest/download/install.sh | shSee it. Audit it. Govern it.
Three layers, one binary.
Catch sensitive data at the wire
Every prompt and response is regex-scanned in-process for emails, phones, credit cards (Luhn-checked), SSNs, API keys (sk-…, sk_live_…, AKIA…), and bearer tokens. Hits land as compliance_flags on the JSONL line — raw matched text never leaves your host.
Per-process LLM call log
Append-only JSONL of every Anthropic / OpenAI call leaving the host: PID, comm, model, input/output tokens, HTTP status, container ID. Suitable for SOC 2 CC7 (system monitoring) and as the operational layer of any enterprise LLM data-handling policy.
Live dashboard, force-graph
Companion turbo-flow-live process tails the JSONL via SSE and ships an embedded dashboard: hour-window stats, animated app→provider flow graph, compliance hits highlighted in coral. Read-only — payload content never leaves the host. Live demo on a real workload below.
Three probes. One bit flip.
eBPF uprobe on SSL_write
Every agent hitting libssl, BoringSSL, or crypto/tls triggers a uprobe. 384-byte preview + direction into a ring buffer.
User-space policy engine
Rust daemon drains the ring, classifies model tier, debits a shared rolling 60s budget. Response usage reconciles estimates.
TC egress drops packets
Budget flipped? One bit flips in an eBPF map. Matching TCP packets return TC_ACT_SHOT. Well-behaved PIDs keep flowing.
[agent] → SSL_write → [uprobe] → ring-buf → [daemon] → { JSONL, Prom, ENFORCE_MAP }
│
▼
[tc-egress] budget blown? SHOT.A real production dashboard,
streaming real LLM traffic.
| time | pid | comm | model | in | out | status | flags |
|---|---|---|---|---|---|---|---|
| 07:08:43 | 146981 | server | claude-sonnet | 874 | 300 | 200 | |
| 07:06:12 | 146981 | server | claude-sonnet | 554 | 248 | 200 | |
| 07:05:48 | 146981 | server | claude-sonnet | 17 | 0 | 529 | clean |
| 07:04:33 | 146981 | server | claude-sonnet | 792 | 300 | 200 |
I'll set it up for you.
Free, on a 30 min call.
You bring a host that hits Anthropic. I install turbo-flow live on the call, pick the right levers (cap / downgrade / cache) for your traffic, and leave you with a Grafana dashboard showing dollars saved per minute.