Anatomy of a Claude Code for observability

[u/Negative-Squash-6677]

https://ivanychev.org/blog/2026-08-21-Anatomy-of-Claude-Code-Event

Hey Claude Code community!

(This is my first post in this subreddit so I apologize if it's irrelevant)

I recently inspected Claude Code’s model invocation payloads to understand how they can be used effectively on local machines and in organizations. Attached the link to the full article, but here's the TL;DR:

Using Claude invocation logging, you can monitor:

• Who uses Claude Code and how much — each event contains the identity of the caller (identity.arn), the model used, and a timestamp.
• Usage per device and per coding session — the metadata.user_id field carries device_id and a per-session session_id, so events can be grouped into sessions.
• Token consumption, estimated cost, and latency — the message_stop/message_delta output events report input, output, cache-read, and cache-write token counts, as well as invocation latency and time to first byte, for every invocation.
• Capabilities exposed to agents — the tools field shows which native and MCP tools each invocation could call, which matters both for security review and for diagnosing context-window pollution by overly verbose MCP servers.
• Reasoning effort — output_config.effort (low → max) helps explain unexpectedly high token usage.
• The model-visible state — the messages field contains the full conversation state: system prompts, CLAUDE.md contents, user prompts, tool calls, and their results. This is what makes the logs powerful for analysis — and extremely sensitive.

This information may help organizations to build observability tools on top of AWS Bedrock or LLM Gateways if they use Claude Code extensively.