Collector inputs

Eight ingest paths in one process. Enable any combination — unconfigured inputs cost nothing.

OTel HTTP + gRPC

inputs:
  otel:
    enabled: true
    http_addr: ":4318"
    grpc_addr: ":4317"
    tls:
      enabled: false
      cert_file: "/etc/trefur/server.crt"
      key_file:  "/etc/trefur/server.key"

When tls.enabled: true, both HTTP (ListenAndServeTLS) and gRPC (grpc.Creds) terminate TLS using the same cert/key pair. Mutual TLS is supported — see the mTLS recipe in the collector repo's docs/otel-mtls-example.md.

LLM proxy

inputs:
  llm_proxy:
    enabled: true
    addr: ":9091"
    upstream: "https://api.openai.com"  # default
    format: "auto"                       # auto | anthropic | openai
    capture_input: true
    capture_output: true
    max_preview: 500

Acts as a reverse proxy in front of any HTTPS LLM endpoint:

• OpenAI — default; no override needed.
• Anthropic — upstream: "https://api.anthropic.com"
• Amazon Bedrock — upstream: "https://bedrock-runtime.<region>.amazonaws.com", format: "openai"
• Gemini / Vertex / MiniMax — set the upstream URL and the parser auto-detects the protocol.

Redaction is on by default. To disable (e.g. when evaluating a redactor itself), set both processing.redact.enabled: false and inputs.llm_proxy.unsafe_no_redact: true. Without the explicit acknowledgement, the collector refuses to start.

MCP proxy

inputs:
  mcp_proxy:
    enabled: true
    addr: ":9092"
    servers:
      - name: "fs"
        upstream: "http://localhost:3001"
    observe_endpoint: "https://api.trefur.com"
    observe_api_key: "${TREFUR_API_KEY}"

Sits between an MCP client and one or more MCP servers. Emits the tool manifest on first contact and one tool-call telemetry event per invocation.

Shell hook

inputs:
  shell_hook:
    enabled: true
    addr: ":8889"
    # Optional override; safe defaults applied if unset.
    redact_args:
      - '(?i)--password\s+\S+'

Receives preexec / precmd hooks from zsh, bash, or fish. Install the hook with:

eval "$(trefur shell-hook --shell zsh)"

When redact_args is omitted, the collector pre-populates a defensive list covering --password, --token, --api-key, Authorization headers, and export *_KEY=... env-var leaks.

Exec wrapper

Wrap any command — your agent process, a build script, a Claude Code session — and capture exec / stdout / stderr telemetry:

trefur run -- python my_agent.py
trefur run -- node ./tools/refactor.ts

HTTP forward proxy

inputs:
  http_proxy:
    enabled: true
    addr: ":8890"
    mitm: false            # opt-in bool; auto-generates a per-tenant CA
    max_body_bytes: 65536  # body-capture cap in MITM mode (default 65536)

Default mode is observe-only — emits one http_call / llm_call step per request. Opt in to MITM mode to capture full request + response bodies up to max_body_bytes (the collector auto-generates a CA at ~/.trefur/proxy/<tenant>/ca.pem; run trefur identity verify --install-ca for the operator recipe to trust it on every client).

SDK proxy

inputs:
  sdk_proxy:
    enabled: true
    addr: ":9090"

Receives payloads from in-process SDK clients that have been pointed at this collector (set the SDK's endpoint to http://localhost:9090). Useful when you want the collector to handle batching + retry + buffering instead of doing it in-process.

Shell input

inputs:
  openshell:
    enabled: true
    mode: "file"             # file | socket | api
    file_path: "/var/log/trefur/shell-events.jsonl"   # used when mode: file
    # socket: "/var/run/trefur/shell.sock"            # used when mode: socket
    # api_url: "http://localhost:8695/events"         # used when mode: api

Reads policy events emitted by the host shell daemon — file tail (mode: file + file_path), Unix socket (mode: socket + socket), or HTTP API (mode: api + api_url).

Next

• Full configuration reference
• Multi-agent traces — how OTel + LLM proxy + MCP proxy traces stitch into a single call tree.