by codeking-ai
Private AI assistant, AI agent, and unified model proxy for Claude Code, Codex CLI, Gemini CLI & OpenClaw. Skills, MCP, tools, channels, tasks,model routing, accounts, keys, logs, dashboard.
# Add to your Claude Code skills
git clone https://github.com/codeking-ai/cligateLast scanned: 6/26/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@larksuiteoapi/node-sdk: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@protobufjs/utf8: protobufjs has overlong UTF-8 decoding",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@xmldom/xmldom: xmldom: XML injection via unsafe CDATA serialization allows attacker-controlled markup insertion",
"severity": "high"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "body-parser: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "electron: Electron: Use-after-free in offscreen shared texture release() callback",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "form-data: form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "protobufjs: protobuf.js: Code injection through bytes field defaults in generated toObject code",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tar: node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "high"
}
],
"status": "WARNING",
"scannedAt": "2026-06-26T07:53:34.123Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}cligate is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by codeking-ai. Private AI assistant, AI agent, and unified model proxy for Claude Code, Codex CLI, Gemini CLI & OpenClaw. Skills, MCP, tools, channels, tasks,model routing, accounts, keys, logs, dashboard. It has 101 GitHub stars.
cligate returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/codeking-ai/cligate" and add it to your Claude Code skills directory (see the Installation section above).
cligate is primarily written in JavaScript. It is open-source under codeking-ai on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh cligate against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.

CliGate is a local AI control plane built around two core capabilities:
It keeps both layers local-first on localhost: the assistant acts like a personal operator for real tasks, while the proxy owns provider access, routing, credentials, unified model names, and observability.
npx cligate@latest start
Or install globally:
npm install -g cligate
cligate start
Or use a desktop release package:
CliGate.Default dashboard:
http://localhost:8081
Use the dashboard:
Accounts for ChatGPT / Claude / AntigravityAPI Keys for provider keysLocal Models for on-device runtimesFor Assistant use, open Chat or Assistant Tasks and tell the private assistant what you want done.
For Model Proxy use, point a CLI tool or API-compatible client to CliGate.
Claude Code:
export ANTHROPIC_BASE_URL=http://localhost:8081
export ANTHROPIC_API_KEY=any-key
claude
Codex CLI:
# ~/.codex/config.toml
chatgpt_base_url = "http://localhost:8081/backend-api/"
openai_base_url = "http://localhost:8081"
Gemini CLI and OpenClaw can also be configured from the dashboard.
Use Chat, Assistant Tasks, Conversation Records, Scheduled, Skills, MCP, and channels to ask the resident assistant to execute real tasks, remember context, use tools, send follow-ups, and keep working in the background.
Start the service, add one credential, run one-click config, and send your first proxied request from Claude Code, Codex CLI, Gemini CLI, OpenClaw, or an API-compatible client.
Use the dashboard to manage accounts, API keys, routing priority, model mapping, local runtimes, pricing, request logs, usage, channel settings, skills, MCP, and desktop-agent settings.
| Dashboard | Chat |
|---|---|
![]() |
![]() |
| Routing and Settings | Channels |
|---|---|
![]() |
![]() |
| Usage and Costs |
|---|
![]() |
Start here if you want the shortest path to the right document:
After the server starts, a lightweight product guide is also available at:
http://localhost:8081/manual/http://localhost:8081/resources/Assistant Surfaces
Web Chat / Assistant Tasks / Telegram / Feishu / DingTalk / Scheduled Tasks
|
v
Private Assistant and Tools
Memory / Policies / Skills / MCP / Desktop Agent / Shell + File Tools / Optional Codex + Claude Code Delegation
|
v
CliGate Local Control Plane (localhost:8081)
|
+--> Model Proxy
| - Protocol translation
| - Account and API key routing
| - App-level bindings and model mapping
| - Local model routing
|
v
Upstream Providers and Local Runtimes
OpenAI / Anthropic / Gemini / Vertex AI / Kilo / Ollama / others
| Endpoint | Use |
|---|---|
POST /v1/messages |
Anthropic Messages proxy |
POST /v1/chat/completions |
OpenAI Chat Completions proxy |
POST /v1/responses |
OpenAI Responses proxy |
POST /backend-api/codex/responses |
Codex internal compatibility |
POST /v1beta/models/* |
Gemini CLI proxy |
GET /api/agent-runtimes/providers |
Runtime provider catalog |
GET /api/agent-channels/conversations |
Channel conversation records |
GET /api/assistant/tasks |
Assistant task records |
GET /api/assistant/mcp/servers |
MCP server management |
GET /api/assistant/skills |
Assistant skill management |
GET /api/desktop-agent/status |
Desktop-agent status |
GET /api/local-runtimes |
Local runtime status |
GET /api/resources |
Resource catalog |
GET /health |
Health and version |
See docs/API.md for more detail.
For Chinese-speaking users, you can also add the maintainer directly on personal WeChat:
Please include a short note such as CliGate when sending the request.
If you plan to contribute, read CONTRIBUTING.md before opening a pull request.
This project is licensed under AGPL-3.0.
CliGate is an independent open-source project and is not affiliated with Anthropic, OpenAI, Google, or other upstream providers.