mirage-proxy

name	mirage-proxy
description	Install and configure mirage-proxy as a transparent PII/secrets filter for OpenClaw LLM API calls. Handles binary installation, provider config, auto-restart, and multi-model routing through the proxy.

mirage-proxy for OpenClaw

Transparent secrets/PII filter between OpenClaw and LLM providers. Replaces sensitive data with plausible fakes — the LLM never knows.

GitHub: https://github.com/chandika/mirage-proxy

Quick Setup

Run the bundled setup script:

bash ~/.openclaw/workspace/skills/mirage-proxy/setup.sh

This downloads the binary, creates an auto-restart wrapper, starts the proxy, and verifies it's running.

To uninstall: bash ~/.openclaw/workspace/skills/mirage-proxy/setup.sh --uninstall

Configure OpenClaw Providers

After setup.sh succeeds, patch the OpenClaw config. Keep original providers AND add mirage versions for instant fallback:

{
  "models": {
    "mode": "merge",
    "providers": {
      "mirage-anthropic": {
        "baseUrl": "http://127.0.0.1:8686/anthropic",
        "api": "anthropic-messages",
        "apiKey": "${ANTHROPIC_API_KEY}",
        "models": [
          { "id": "claude-opus-4-6", "name": "Claude Opus 4.6 (mirage)", "api": "anthropic-messages", "reasoning": true, "input": ["text", "image"], "cost": {"input":0,"output":0,"cacheRead":0,"cacheWrite":0}, "contextWindow": 200000, "maxTokens": 32000 },
          { "id": "claude-sonnet-4-6", "name": "Claude Sonnet 4.6 (mirage)", "api": "anthropic-messages", "reasoning": true, "input": ["text", "image"], "cost": {"input":0,"output":0,"cacheRead":0,"cacheWrite":0}, "contextWindow": 200000, "maxTokens": 16000 },
          { "id": "claude-haiku-3-6", "name": "Claude Haiku 3.6 (mirage)", "api": "anthropic-messages", "reasoning": false, "input": ["text", "image"], "cost": {"input":0,"output":0,"cacheRead":0,"cacheWrite":0}, "contextWindow": 200000, "maxTokens": 8192 }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "models": {
        "anthropic/claude-opus-4-6": { "alias": "anthropic-opus" },
        "anthropic/claude-sonnet-4-6": { "alias": "anthropic-sonnet" },
        "anthropic/claude-haiku-3-6": { "alias": "anthropic-haiku" },
        "mirage-anthropic/claude-opus-4-6": { "alias": "mirage-opus" },
        "mirage-anthropic/claude-sonnet-4-6": { "alias": "mirage-sonnet" },
        "mirage-anthropic/claude-haiku-3-6": { "alias": "mirage-haiku" }
      }
    }
  }
}

OpenAI / Codex (OAuth)

For OAuth-based providers (no API key env var), override the built-in provider baseUrl instead of creating a custom provider:

{
  "models": {
    "mode": "merge",
    "providers": {
      "openai-codex": {
        "baseUrl": "http://127.0.0.1:8686"
      }
    }
  }
}

⚠️ Do NOT add "apiKey": "${OPENAI_API_KEY}" to custom providers unless the env var exists in your container — it will crash OpenClaw on startup.

Model Aliases

After config, switch with /model:

Alias	Route
anthropic-opus	Direct to Anthropic
mirage-opus	Via mirage-proxy → Anthropic
anthropic-sonnet	Direct
mirage-sonnet	Via mirage
codex	Direct to OpenAI (or miraged if baseUrl overridden)

Persistence

mirage-proxy dies on OpenClaw restarts. Two solutions:

Docker entrypoint (recommended):

# docker-compose.yml
command: sh -c "nohup /home/node/.openclaw/workspace/start-mirage.sh > /dev/null 2>&1 & exec openclaw start"

Heartbeat check (fallback): Add to HEARTBEAT.md:

curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8686/

If 000 or connection refused → restart via start-mirage.sh.

Verify

# Proxy running?
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:8686/
# Expect 502 (up, no path matched)

# Check redaction stats
tail -20 ~/.openclaw/workspace/mirage-proxy.log
# Look for: 🛡️ SECRET (AWS Access Key) [40 chars] → AKIA••••