One terminal, two trust levels — running Claude Code against a real subscription and a cheap proxy

#claudecode #ai #llm #devops

Part of an ongoing series on model routing and trust tiering for agentic coding tools. This one's the boring, working half — no bug hunt, just a setup that's been running clean across two machines.

The problem

Claude Code does one thing well: careful, scoped edits with a real plan-then-execute loop behind them, backed by a subscription you're already paying for. Not every task needs that. Exploratory reads, "summarize this directory," draft-and-discard scratch work — most of that doesn't need the most capable model watching every token.

The fix is a second, cheaper backend for that category of work. The catch: Claude Code only speaks Anthropic's Messages API. It has no built-in notion of "same tool, different model." So the question is how to point it somewhere else without giving up the interface.

The stack

Trusted agent:  claude       — real Anthropic subscription, default session
Cheap agent:    claude-cheap — same CLI, routed through a self-hosted proxy
Proxy:          LiteLLM, translating Anthropic-format requests to
                DeepSeek V4 (pro for Sonnet-tier calls, flash for Haiku-tier)
                served through an OpenRouter API
Transport:      a persistent SSH tunnel from a small VPS back to each machine

The proxy itself wasn't new. It's the same LiteLLM instance already routing a separate content pipeline I run. The actual work here was wiring Claude Code to it: a shell function and a few environment variables.

The core trick and it took me a few week to learn this is to point ANTHROPIC_BASE_URL at LiteLLM's /v1/messages endpoint, not the OpenAI-compatible path LiteLLM also exposes. Claude Code only understands the Anthropic shape, so the OpenAI-shaped endpoint fails in ways that look like a client bug and aren't. Once LiteLLM sits on the right endpoint and translates underneath, Claude Code has no idea it isn't talking to Anthropic.

The one bug worth flagging

Claude Code's Plan Mode attaches a context_management parameter to its requests. Anthropic's API handles it. Most other backends don't recognize it and reject the whole request with a 400 — which looks like Plan Mode itself is broken, when it's a parameter the downstream model was never built to accept.

One-line fix in the LiteLLM config:

litellm_config.yaml
---
drop_params: true

That tells LiteLLM to silently strip unsupported parameters instead of forwarding them and letting the backend reject the call. Plan Mode then works the same regardless of which model is actually answering.

Two commands, deliberately asymmetric

This is the part worth copying more than any proxy config: the trusted and cheap agents don't look the same, on purpose.

claude — the real thing, full subscription, no wrapper. Default terminal, default prompt. It's the session where mistakes cost the most, so I want zero visual noise between me and what it's doing.

claude-cheap — a shell function that drops into an isolated subshell, retitles the tab with a distinct label and icon, and resets on exit. Not aesthetics: at 11pm switching between six tabs, I want it structurally impossible to mistake the cheap, more permissive session for the one running on my subscription. The expensive tool gets no ceremony; the cheap tool gets a costume, because misidentifying that direction is the failure mode worth guarding against.

# --- Cheap agent: DeepSeek via self-hosted LiteLLM proxy ---
claude-cheap() {
  (
    unset ANTHROPIC_API_KEY
    export ANTHROPIC_BASE_URL=http://localhost:3456
    export ANTHROPIC_AUTH_TOKEN=anything
    export ANTHROPIC_MODEL=deepseek/deepseek-v4-pro
    export ANTHROPIC_DEFAULT_SONNET_MODEL=deepseek/deepseek-v4-pro
    export ANTHROPIC_DEFAULT_HAIKU_MODEL=deepseek/deepseek-v4-flash
    export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
    echo -ne "\033]0;🐋 DEEPSEEK-AGENT\007"
    claude "$@"
    echo -ne "\033]0;Terminal\007"
  )
}

The subshell ( ... ) is what makes the exports throwaway — they don't leak into the parent shell once the function returns. ANTHROPIC_AUTH_TOKEN is set to a dummy value because LiteLLM doesn't check it; it just needs something present so Claude Code doesn't refuse to start. CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC cuts calls back to Anthropic's own telemetry endpoints, since this session has no real Anthropic account behind it.

Why bother

Because the goal was never "make Claude Code cheaper." It's a supervisor/executor split: the subscription session does planning, review, anything I'd be upset to see broken. The proxy session handles high-volume, low-stakes work, and its output gets reviewed before it's trusted the same way.

Same shape of decision as picking a cloud model over a local one for a monitoring agent [earlier in this series] — not "which model is smarter," but "which failure mode can I tolerate, and what's the cheapest thing that clears the bar." Here the axis is subscription cost instead of on-device vs. cloud. The underlying question is identical: what am I willing to have wrong, and what's watching for when it is.

What's still open

There's also a local-only variant: same two-tier pattern, but the cheap tier runs entirely on-device instead of through a hosted proxy. That one hit a tool-calling format mismatch — a story of its own, I will write it up separately soon.

DEV Community