I had the same suspicion so made this to examine where my tokens went.
Claude code caches a big chunk of context (all messages of current session). While a lot of data is going through network, in ccaudit itself, 98% is context is from cache.
Granted, to view the actual system prompt used by claude, one can only inspect network request. Otherwise best guess is token use in first exchange with Claude.
I got kinda obsessed with observability a month ago and wired together a full stack for personal use.
https://github.com/simple10/agent-super-spy - llm proxy + http MiTM proxy + LLMetry + other goodies
https://github.com/simple10/agents-observe - fancier claude hooks dashboard
It started as a need to keep an eye on OpenClaw but is incredibly useful for really understanding any agent harness at the raw LLM request level.