claudecodeui

Name: claudecodeui
Author: siteboon

Issues

Use Claude Code, Cursor CLI or Codex on mobile and web with CloudCLI (aka Claude Code UI). CloudCLI is a free open source webui/GUI that helps you manage your Claude Code session and projects remotely

11,374stars

1,544forks

TypeScript

Added 12/27/2025

View on GitHub Download ZIP

CLI Toolsanthropicanthropic-aianthropic-claudeclaudeclaude-api

Installation

# Add to your Claude Code skills
git clone https://github.com/siteboon/claudecodeui

Getting Started

Guides for using cli tools skills like claudecodeui.

Security ReportIssues

Last scanned: 4/17/2026

{
  "issues": [
    {
      "type": "npm-audit",
      "message": "@remix-run/router: React Router vulnerable to XSS via Open Redirects",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "basic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
      "severity": "critical"
    },
    {
      "type": "npm-audit",
      "message": "body-parser: Vulnerability found",
      "severity": "low"
    },
    {
      "type": "npm-audit",
      "message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "cacache: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "defu: defu: Prototype pollution via `__proto__` key in defaults argument",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "express: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "glob: glob CLI: Command injection via -c/--cmd executes matches with shell:true",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "jws: auth0/node-jws Improperly Verifies HMAC Signature",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "lodash: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "make-fetch-happen: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "mdast-util-to-hast: mdast-util-to-hast has unsanitized class attribute",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "multer: Multer vulnerable to Denial of Service via incomplete cleanup",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "node-gyp: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "prismjs: PrismJS DOM Clobbering vulnerability",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "react-router: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "react-router-dom: Vulnerability found",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "react-syntax-highlighter: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "refractor: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "release-it: Vulnerability found",
      "severity": "medium"
    },
    {
      "type": "npm-audit",
      "message": "rollup: Rollup 4 has Arbitrary File Write via Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar: node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "tar-fs: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "undici: Undici has an unbounded decompression chain in HTTP responses on Node.js Fetch API via Content-Encoding leads to resource exhaustion",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "vite: vite allows server.fs.deny bypass via backslash on Windows",
      "severity": "high"
    },
    {
      "type": "npm-audit",
      "message": "yaml: yaml is vulnerable to Stack Overflow via deeply nested YAML collections",
      "severity": "medium"
    }
  ],
  "status": "FAILED",
  "scannedAt": "2026-04-17T06:07:25.244Z",
  "semgrepRan": false,
  "npmAuditRan": true,
  "pipAuditRan": true
}

README.md

LLM Engineer for Beginners

Ship LLM features to production - prompts, RAG, structured outputs, evaluation

39 minBeginner

Comments (0)

to leave a comment.

No comments yet. Be the first to share your thoughts!

Related Skills

ECC

by affaan-m

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

194,955

Popular in CLI Tools

Top skills in this category by stars

CLIProxyAPI

by router-for-me

Wrap Gemini CLI, Antigravity, ChatGPT Codex, Claude Code, Grok Build as an OpenAI/Gemini/Claude/Codex compatible API service, allowing you to enjoy the free Gemini 3.1 Pro, GPT 5.5, Grok 4.3, Claude model through API

claude-relay-service ccstatusline

Screenshots

Features

Responsive Design - Works seamlessly across desktop, tablet, and mobile so you can also use Agents from mobile
Interactive Chat Interface - Built-in chat interface for seamless communication with the Agents
Integrated Shell Terminal - Direct access to the Agents CLI through built-in shell functionality
File Explorer - Interactive file tree with syntax highlighting and live editing
Git Explorer - View, stage and commit your changes. You can also switch branches
Session Management - Resume conversations, manage multiple sessions, and track history
Plugin System - Extend CloudCLI with custom plugins — add new tabs, backend services, and integrations. Build your own →
TaskMaster AI Integration (Optional) - Advanced project management with AI-powered task planning, PRD parsing, and workflow automation
Model Compatibility - Works with Claude, GPT, and Gemini model families (see shared/modelConstants.js for the full list of supported models)

Quick Start

CloudCLI Cloud (Recommended)

The fastest way to get started — no local setup required. Get a fully managed, containerized development environment accessible from the web, mobile app, API, or your favorite IDE.

Get started with CloudCLI Cloud

Self-Hosted (Open source)

npm

Try CloudCLI UI instantly with npx (requires Node.js v22+):

npx @cloudcli-ai/cloudcli

Or install globally for regular use:

npm install -g @cloudcli-ai/cloudcli
cloudcli

Open http://localhost:3001 — all your existing sessions are discovered automatically.

Visit the documentation → for full configuration options, PM2, remote server setup and more.

Docker Sandboxes (Experimental)

Run agents in isolated sandboxes with hypervisor-level isolation. Starts Claude Code by default. Requires the sbx CLI.

npx @cloudcli-ai/cloudcli@latest sandbox ~/my-project

Supports Claude Code, Codex, and Gemini CLI. See the sandbox docs for setup and advanced options.

Which option is right for you?

CloudCLI UI is the open source UI layer that powers CloudCLI Cloud. You can self-host it on your own machine, run it in a Docker sandbox for isolation, or use CloudCLI Cloud for a fully managed environment.

| | Self-Hosted (npm) | Self-Hosted (Docker Sandbox) (Experimental) | CloudCLI Cloud | |---|---|---|---| | Best for | Local agent sessions on your own machine | Isolated agents with web/mobile IDE | Teams who want agents in the cloud | | How you access it | Browser via [yourip]:port | Browser via localhost:port | Browser, any IDE, REST API, n8n | | Setup | npx @cloudcli-ai/cloudcli | npx @cloudcli-ai/cloudcli@latest sandbox ~/project | No setup required | | Isolation | Runs on your host | Hypervisor-level sandbox (microVM) | Full cloud isolation | | Machine needs to stay on | Yes | Yes | No | | Mobile access | Any browser on your network | Any browser on your network | Any device, native app coming | | Agents supported | Claude Code, Cursor CLI, Codex, Gemini CLI | Claude Code, Codex, Gemini CLI | Claude Code, Cursor CLI, Codex, Gemini CLI | | File explorer and Git | Yes | Yes | Yes | | MCP configuration | Synced with ~/.claude | Managed via UI | Managed via UI | | REST API | Yes | Yes | Yes | | Team sharing | No | No | Yes | | Platform cost | Free, open source | Free, open source | Starts at $7/month |

All options use your own AI subscriptions (Claude, Cursor, etc.) — CloudCLI provides the environment, not the AI.

Security & Tools Configuration

🔒 Important Notice: All Claude Code tools are disabled by default. This prevents potentially harmful operations from running automatically.

Enabling Tools

To use Claude Code's full functionality, you'll need to manually enable tools:

Open Tools Settings - Click the gear icon in the sidebar
Enable Selectively - Turn on only the tools you need
Apply Settings - Your preferences are saved locally

Tools Settings Modal Tools Settings interface - enable only what you need

Recommended approach: Start with basic tools enabled and add more as needed. You can always adjust these settings later.

Plugins

CloudCLI has a plugin system that lets you add custom tabs with their own frontend UI and optional Node.js backend. Install plugins from git repos directly in Settings > Plugins, or build your own.

Available Plugins

| Plugin | Description | |---|---| | Project Stats | Shows file counts, lines of code, file-type breakdown, largest files, and recently modified files for your current project | | Web Terminal | Full xterm.js terminal with multi-tab support| | CloudCLI Scheduler | Create workspace-scoped scheduled prompts and execute them through a local CLI such as Codex, Claude Code, or Gemini CLI|

Build Your Own

Plugin Starter Template → — fork this repo to create your own plugin. It includes a working example with frontend rendering, live context updates, and RPC communication to a backend server.

Plugin Documentation → — full guide to the plugin API, manifest format, security model, and more.

FAQ

Claude Code Remote Control lets you send messages to a session already running in your local terminal. Your machine has to stay on, your terminal has to stay open, and sessions time out after roughly 10 minutes without a network connection.

CloudCLI UI and CloudCLI Cloud extend Claude Code rather than sit alongside it — your MCP servers, permissions, settings, and sessions are the exact same ones Claude Code uses natively. Nothing is duplicated or managed separately.

Here's what that means in practice:

All your sessions, not just one — CloudCLI UI auto-discovers every session from your ~/.claude folder. Remote Control only exposes the single active session to make it available in the Claude mobile app.
Your settings are your settings — MCP servers, tool permissions, and project config you change in CloudCLI UI are written directly to your Claude Code config and take effect immediately, and vice versa.
Works with more agents — Claude Code, Cursor CLI, Codex, and Gemini CLI, not just Claude Code.
Full UI, not just a chat window — file explorer, Git integration, MCP management, and a shell terminal are all built in.
CloudCLI Cloud runs in the cloud — close your laptop, the agent keeps running. No terminal to babysit, no machine to keep awake.

Yes. CloudCLI provides the environment, not the AI. You bring your own Claude, Cursor, Codex, or Gemini subscription. CloudCLI Cloud starts at $7/month for the hosted environment on top of that.

Yes. For self-hosted, run the server on your machine and open `[y