# Add to your Claude Code skills
git clone https://github.com/AI-Anywhere/AI-AnywhereLast scanned: 8/17/2026
{
"issues": [
{
"type": "npm-audit",
"message": "astro: Astro: XSS in define:vars via incomplete </script> tag sanitization",
"severity": "high"
},
{
"type": "npm-audit",
"message": "esbuild: esbuild allows arbitrary file read when running the development server on Windows",
"severity": "low"
},
{
"type": "npm-audit",
"message": "miniflare: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "sharp: sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: undici vulnerable to TLS certificate validation bypass via dropped requestTls in SOCKS5 ProxyAgent",
"severity": "high"
},
{
"type": "npm-audit",
"message": "wrangler: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
},
{
"file": "README.md",
"line": 26,
"type": "remote-install",
"message": "Install command (remote install script piped to a shell — review the source before running): \"curl -fsSL https://tmux.online/install.sh | sh\"",
"severity": "low"
}
],
"status": "WARNING",
"scannedAt": "2026-08-17T04:41:34.165Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}AI-Anywhere is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by AI-Anywhere. Your agents. Any browser. Anywhere. It has 2,116 GitHub stars.
AI-Anywhere returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/AI-Anywhere/AI-Anywhere" and add it to your Claude Code skills directory (see the Installation section above).
AI-Anywhere is primarily written in TypeScript. It is open-source under AI-Anywhere on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh AI-Anywhere against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Your agents. Any browser. Anywhere.
AI Anywhere brings the agent CLI sessions running in tmux to a focused browser interface that works on desktop and mobile. One command starts the local service, and the web UI collects every task that needs attention without moving terminal state away from the machine where it is running.
This repository contains the web layer served at tmux.online:
The CLI, tmux integration, local server, and browser workspace live in the AI Anywhere core repository.
Run the installer on the machine that hosts your tmux sessions:
curl -fsSL https://tmux.online/install.sh | sh
The installer verifies the local prerequisites, installs @ai-anywhere/cli, and starts
AI Anywhere. The server listens on 127.0.0.1 by default, so terminal traffic remains on
the local machine.
| Area | Implementation |
|---|---|
| Public pages | Astro, prerendered HTML, inline critical CSS |
| Dashboard | React, React Router, SWR |
| Account API | https://api.tmux.online through the typed client in src/lib/api.ts |
| Localization | Typed copy tables in src/i18n |
| Installer | public/install.sh |
| Edge runtime | Cloudflare Worker in worker/index.js |
| Response policy | public/_headers and Worker response headers |
| Deployment | Wrangler and GitHub Actions |
The public pages do not load a framework runtime. React hydrates only dashboard and device authorization surfaces that require account state.
Dashboard HTML is cached privately in the browser for ten minutes and is explicitly
excluded from Cloudflare edge caching. Account data is fetched in the browser after the
session is resolved, and dashboard routes are excluded from search indexing through HTML,
response headers, robots.txt, and sitemap filtering.
| Route | Purpose |
|---|---|
/ |
English product site |
/ja, /ko, /zh-Hant |
Localized product sites |
/dashboard/devices |
Authorized devices |
/dashboard/api-keys |
API key management |
/dashboard/membership |
Trial, referrals, and membership |
/dashboard/device |
Device authorization |
/device |
Cookie-aware compatibility redirect |
/install.sh |
Shell installer download |
Localized dashboard routes use the same language prefixes as the public pages. The L
cookie records the active language so compatibility routes can select the correct location;
unknown values fall back to English.
src/components/ Astro page sections and shared site chrome
src/islands/ React dashboard and account surfaces
src/i18n/ Typed localized copy
src/layouts/ Shared HTML document layout
src/lib/ API, caching, icons, and content helpers
src/pages/ Public, dashboard, localized, and text routes
src/styles/ Public and dashboard styles
public/ Installer, icons, manifest, robots, and response headers
scripts/ Build-time optimization and asset scripts
worker/ Cloudflare request handling
The project uses pnpm.
pnpm install
pnpm dev
The development server runs at http://localhost:4321.
To use a local account API:
PUBLIC_API_URL=http://localhost:51994 pnpm dev
Useful commands:
pnpm build # Generate the production site in dist/
pnpm preview # Serve the production output locally
pnpm check # Run Astro and TypeScript checks
pnpm lint # Check formatting and Astro types
pnpm format # Apply repository formatting
pnpm images # Regenerate raster images from source assets
English is served without a URL prefix. Japanese, Korean, and Traditional Chinese use their own path prefixes.
To add a language:
src/i18n.src/i18n/index.ts.src/pages.The language switcher, alternate links, Open Graph metadata, sitemap, and machine-readable text pages all derive from the same locale registry.
Build and deploy the Cloudflare Worker and static assets with:
pnpm deploy
The GitHub Actions workflow in .github/workflows/deploy.yml deploys pushes to main. It
expects these repository secrets:
CLOUDFLARE_API_TOKENCLOUDFLARE_ACCOUNT_IDSecret values belong in GitHub repository settings and must never be committed.
This repository is the canonical source for the tmux.online website. Changes to the CLI, local service, tmux protocol, or npm package belong in AI Anywhere core. The website consumes those runtime artifacts through the public installer and documented HTTP interfaces.