Your Cheap Claude Code Proxy Is a Trust Decision

A pattern is quietly becoming standard practice among heavy users of agentic coding tools: one terminal, two backends. Your real Claude Code subscription handles the work where mistakes are expensive — architecture decisions, refactors that touch twenty files, anything you'd hate to review line-by-line. A second shell alias points the same CLI at a cheap third-party model through a local proxy, and that session gets the grunt work: exploratory greps, boilerplate, throwaway scripts, first-draft tests.

A recent dev.to write-up describes exactly this setup — a claude-cheap() shell function that spawns Claude Code in a subshell with ANTHROPIC_BASE_URL pointed at a self-hosted LiteLLM proxy, which translates the Anthropic Messages format to DeepSeek via OpenRouter. The author even styles the cheap session's terminal differently so a tired brain at 1 a.m. can't confuse which tier it's typing into. It's a tidy piece of engineering. It's also a good excuse to talk about what this pattern actually trades away, because the trade is bigger than most of the how-to posts admit.

The accidental standard

The reason any of this works is that Claude Code reads its backend from an environment variable. Set ANTHROPIC_BASE_URL to anything that speaks the Anthropic Messages API and ANTHROPIC_AUTH_TOKEN to whatever key that endpoint issues, and the CLI doesn't care who's on the other end. Anthropic documents this officially for enterprise LLM gateways — Bedrock, Vertex, corporate proxies that do cost tracking and audit logging.

The community took that enterprise escape hatch and ran with it. LiteLLM serves a unified /v1/messages endpoint that translates Anthropic-format requests to OpenAI, Gemini, or DeepSeek models. Standalone proxies on npm do the same for Qwen, GLM, MiniMax, and Kimi — and several of those providers now ship Anthropic-compatible endpoints natively, precisely because Claude Code is the client they want to capture. /v1/messages has become a de facto standard the way S3's API did: not because anyone declared it one, but because the most popular client speaks it.

The economics explain the enthusiasm. DeepSeek-class models through OpenRouter run around a dollar per million output tokens; Claude Sonnet-class pricing is an order of magnitude higher, Opus-class higher still. If a third of your agentic token burn is low-stakes drudgery, tiering is just rational capacity planning — the same supervisor/worker split every multi-agent framework converges on, done manually with shell functions.

Three trust decisions, not one

Here's what the cost math hides. When you route Claude Code through a cheap proxy, you're not making one trust decision ("is this model good enough?"). You're making three.

Where your code goes. Every file the agent reads gets shipped to whatever sits behind the proxy. Your Anthropic subscription comes with known data-handling terms; a chain of proxy → aggregator → upstream provider comes with three privacy policies, at least one of which you haven't read. For a hobby repo, fine. For anything with a client's name in it, that's a data-governance decision someone other than you should probably sign off on.

What the plumbing itself can do. This one stopped being hypothetical in March, when LiteLLM's PyPI package — roughly three million downloads a day — shipped versions 1.82.7 and 1.82.8 containing a credential stealer. Attackers had compromised a scanner in the project's CI pipeline, lifted the maintainer's PyPI credentials, and published wheels with a malicious .pth file that executed on every Python interpreter start, no import required. It harvested environment variables, SSH keys, and cloud credentials, and attempted lateral movement into Kubernetes clusters. Think about what lives in the environment of a machine running an AI coding agent: API keys for every provider you've ever tried, at minimum. The proxy you installed to save $40 a month is a root-adjacent daemon sitting in the middle of your credential flow. The versions were yanked within hours, but the lesson stands — the gateway layer is now a high-value supply-chain target, and it's mostly maintained like a hobby project.

Which session you're actually in. The subshell isolation in the dev.to setup matters more than it looks. Exporting ANTHROPIC_BASE_URL globally means every future Claude Code invocation — including the one where you paste a production secret into the prompt — silently routes to the cheap endpoint. Scoping the override to a subshell, and never reusing your real Anthropic key as the proxy token, is the difference between a tiering system and a misdirection bug.

The verdict

The two-tier pattern itself is sound, and I'd expect it to get absorbed into the tools: model routing is already a first-class feature in every gateway product, and the CLIs will eventually grow native per-task tiering rather than leaving it to shell aliases. If you run this today, treat the proxy like production infrastructure, because it is: pin LiteLLM to a known-clean release, install from a lockfile, keep the proxy host's environment free of credentials it doesn't need, and route only work whose failure mode you can tolerate — the original author's framing of "what am I willing to have wrong" is the right question.

But be honest about what you built. It's not "Claude Code, but cheaper." It's a second, lower-trust supply chain grafted onto your most privileged development tool. The subscription tier isn't just paying for a smarter model — it's paying for the shortest possible path between your code and the model, with one vendor accountable for it. That's worth more than the pricing page suggests, and the LiteLLM incident is what it looks like when the discount tier reminds you why.