Secure local control plane for coding agents

Operate your AI coding agents from the clients you already use.

Give supported web, desktop, CLI, and remote MCP clients one user-owned gateway for Claude Code, Codex, Gemini, Grok, Vibe, Devin, Cursor, and API-provider LLMs while keeping execution workspace-scoped, approval-gated, durable, and auditable.

Install with an agent View GitHub
7 native CLI providers API-token LLM routing SQLite or Postgres jobs Bearer or OAuth HTTP
> consensus_check({ models, claim })
claude_request: catches missing migration rollback
codex_request: flags test gap in auth boundary
gemini_request: suggests smaller deployment slice
validation_receipt: durable evidence, retrievable after restart
$ llm-cli-gateway.dev --view <TAB>
llm-cli-gateway - secure local control plane for AI coding agents
Claude / Codex / Gemini / Grok / Mistral / Devin / Cursor - durable async jobs - MIT
Paste this into your AI agent:
Read https://llm-cli-gateway.dev/install.md and configure yourself to use llm-cli-gateway as an MCP server.
View the install spec · Repository
or run manually
npx -y llm-cli-gateway
$ npx -y llm-cli-gateway
  MCP server connected over stdio
$ LLM_GATEWAY_AUTH_TOKEN=… llm-cli-gateway --transport=http
  HTTP MCP server listening on 127.0.0.1:3333/mcp (bearer or OAuth, per-principal isolation)
> consensus_check({ models: ["claude", "codex", "gemini"], claim })
  claude_request: accepts with caveat
  codex_request: flags missing test
  gemini_request: suggests smaller patch
  result: disagreement summarized for review
> claude_request_async({ prompt, outputFormat: "stream-json" })
  jobId: 1f0c9a2e-…
  status: running
  persisted: SQLite by default, Postgres when configured
> llm_job_result({ jobId })
  complete - result recovered after gateway restart
API proxy
POST /v1/messages
model response
no native Claude Code session
no Codex CLI resume
no local provider CLI config
file and test access must be rebuilt
Good for hosted chat. Thin for local coding agents.
llm-cli-gateway
MCP tool call
claude_request keeps Claude Code semantics
codex_request uses real Codex sessions
gemini_request uses the installed Antigravity CLI (agy)
grok_request, mistral_request, devin_request, and cursor_request follow provider CLIs
One MCP surface, real local CLIs and configured API providers underneath.
Why It Exists

Coding agents are strongest when they keep their native tools, credentials, and session semantics. `llm-cli-gateway` puts Claude Code, Codex, Gemini/Antigravity, Grok Build, Vibe, Devin, Cursor Agent, and API-provider LLMs behind one control plane without flattening them into a generic chat proxy.

The practical payoff: supported clients can delegate work to local agents, scope remote execution to registered workspaces, gate risky actions, survive disconnects, and retrieve validation receipts after the gateway restarts.

Review before you ship

Consensus, red-team, compare, and second-opinion tools turn model disagreement into an artifact you can inspect.

Keep native agent behavior

Provider CLIs keep their auth stores, local file access, resume semantics, tool execution, and model-specific controls.

Run it like infrastructure

Async jobs persist to SQLite by default or Postgres for service deployments, with per-principal isolation over HTTP.

Add API models safely

OpenAI-compatible, Anthropic, and xAI-style providers read keys from named environment variables at request time.

claude_request-> Claude Code with sessions and MCP server selection
codex_request-> OpenAI Codex CLI with real resume IDs
*_request_async-> long-running jobs persisted to SQLite or Postgres
consensus_check-> ask several models and inspect disagreement
session_create-> reusable provider sessions and worktree-aware flows
approval_list-> review approval decisions from one place

The gateway orchestrates local CLIs and configured API providers. It does not replace them.

Posture
CI Security SAST OpenSSF Scorecard OpenSSF Best Practices npm package Sigstore CODEOWNERS Dependabot MIT
Signal Status Why it matters
Runtime local stdio or remote HTTP run on your machine, or expose it behind a bearer token or OAuth
Remote auth bearer or built-in OAuth 2.0 PKCE, opt-in consent gate, per-principal isolation, fail-closed posture
Async jobs SQLite default, Postgres optional long calls can survive gateway restarts
Validation cross-model tools compare, red-team, second opinion, and consensus workflows
Release audited npm package + Sigstore installers published artifacts have supply-chain controls
License MIT open source and installable without a hosted service
Integration
MCP clientsnpx -y llm-cli-gatewaystdio server for local MCP clients (or --transport=http for remote clients)
Providersclaude / codex / agy / grok / vibe / devin / cursor-agent / api_*uses installed CLI credentials or API keys from named environment variables
Registryio.github.verivus-oss/llm-cli-gatewaypublished to the official MCP Registry