Point anything that speaks POST /v1/chat/completions at it and the replies come from claude -p under your own login, with no API key. It is deliberately not an agent: every call runs with no tools, no MCP servers, no skills and an empty working directory, and that lockdown is checked at startup rather than assumed. /ready reports exactly what the probe saw load and refuses every call until it was nothing.
What stands out
- OpenAI wire format: /v1/models, /v1/chat/completions, JSON schema answers
- Startup probe proves the lockdown; refuses calls otherwise
- Loopback only, documented as such
- Design doc records the measurements that chose each CLI flag