keirouter

---

So, what's the deal? 🤔

You use AI coding tools — Claude Code, Codex, Cursor, Cline, or honestly anything that talks to OpenAI, Anthropic or Gemini. And you know the headaches: a drawer full of API keys, rate limits that hit at the worst time, and a token bill that keeps creeping up.

KeiRouter is the smart middleman that makes all of that someone else's problem. Point your tools at one local endpoint and let it handle the boring stuff — routing each request to the right model, failing over the moment a provider taps out, caching repeat questions, and squeezing oversized prompts down before they ever cost you a token.

Oh, and it's written in Go. So it's light on memory, boots instantly, ships as one binary plus a static dashboard, and the dashboard is actually nice to look at. ✨

Heads up: KeiRouter is under active development. Check the CHANGELOG for what landed recently, and peek at Architecture to see how a request flows.

---

📑 What's inside

• Highlights
• Screenshots
• Quick Start
  • macOS · Windows · Linux · Docker / VPS
  • First login
  • Everyday commands
  • Updating · Uninstalling
  • Connect your tools
• API Surface
• Token Savings
• Smart Routing (Chains)
• Semantic Cache
• Connect via OAuth
• Skills
• Plans & Budgets
• Rate Limiting
  • High availability (multiple replicas)
• Guardrails
• Observability
  • Audit log
• Networking: Proxy Pools & Tunnels
• Import, Export & Backups
• Branding & White-Label
• CLI Tools Auto-Config
• Usage Portal
• Supported Providers
• Configuration
• Architecture
• Security
• Development & Contributing
• License

---

⭐ The good stuff

Routing & reliability

• 🔀 One endpoint, every provider — Your apps speak OpenAI Chat, the OpenAI Responses API, Anthropic Messages, or native Gemini; KeiRouter quietly translates to whatever you actually want to use.
• 🛡️ Never stop coding — Provider down? Rate limited? Fallback chains with priority, round-robin, latency or cost ordering keep you moving like nothing happened.
• 🏢 Enterprise clouds, natively — AWS Bedrock, SageMaker, Azure AI Foundry, IBM watsonx.ai, Oracle Cloud, SAP Generative AI Hub, Databricks and Snowflake Cortex, with their own auth (IAM roles, Entra ID, signed requests) handled for you.
• 🩺 Provider health — Real-traffic telemetry plus synthetic probes, with 24h / 7d history that survives restarts.
• ⚡ Response cache — Ask the same thing twice and get it back instantly for $0.00. Exact-match out of the box, true semantic matching with an embeddings API.

Cost control

• 💸 Five token savers — Two on the way in, three on the way out, all on a live savings dashboard. Details in Token Savings.
• 💰 Budget engine — Per-key USD and token hard limits, with an auto-cutoff so surprise bills stay fictional.
• 🚦 Rate limiting — Per-key RPM, TPM, and concurrency caps via global defaults or reusable plans, with TPM settled against the real usage the provider reports.
• 🧩 HA-ready — Run several replicas behind a load balancer on Postgres + Redis: rate limits, concurrency and budget counters are shared at one round trip per request.
• 📈 Quota tracker — Upstream limits and local usage for every provider account in one place.

Safety & governance

• 🛡️ Guardrails — PII, prompt-injection, toxicity, topics, and bias detectors layered global → provider → model → chain → key, with mid-stream output scanning, an ML classifier, an LLM judge, native engines that need no outside service, and a monitor that shows what got blocked and what it cost.
• 📜 Audit log — Every sign-in and config change, hash-chained so tampering shows, exported as OpenTelemetry logs and JSONL for your SIEM. Optionally ship every gateway request too (who, which model, tokens, cost, outcome; never the prompt).
• 🔐 Locked down by default — AES-256-GCM envelope encryption for credentials, a loopback-only admin API, a password-gated dashboard, HMAC sessions, and SSRF protection on outbound calls.

Operations & UX

• 📊 See everything — Usage by provider, model, chain and request; TTFT and p95 latency; a live console that traces every request through its fallbacks; host and process resource charts; Prometheus metrics.
• 🧠 Skills — Custom instructions injected into matching chat requests, plus reference skills that teach any agent how to use your gateway.
• 🔧 CLI auto-config — Detects 11 coding tools on your machine and writes their config in one click.
• 🌐 Proxy pools & tunnels — Route upstream traffic through proxies or a one-click Cloudflare Worker relay, and expose the gateway via Cloudflare Tunnel or Tailscale Funnel.
• 📦 Bring your setup with you — Import from 9router (JSON or SQLite) and OmniRoute, plus encrypted portable backups.
• 🎨 White-label it — Rebrand the dashboard and portal with your own name, logo, and palette.
• 🖥️ System tray — Run it in the background with a tray icon on macOS, Windows and Linux.

---

📸 Screenshots

Chains — build fallback routes and preview them live	Providers — each provider asks for exactly the credentials it needs
Provider health — uptime, fallbacks and p95 latency per upstream	Guardrails — scoped policies with a dry-run tester
Audit log — hash-chained sign-ins and config changes	Endpoints — base URL, quick-start snippets and API reference
Token saving — toggle each saver independently	CLI tools — detects your coding tools and configures them in one click

---

🚀 Quick Start

Three steps on any OS: install → start → open the dashboard. Prebuilt binaries mean no Go, no Node, and no config file.

Your machine	Install with	Run in the background with
🍎 macOS	Homebrew	brew services start keirouter
🪟 Windows 10/11	PowerShell one-liner	keirouter tray
🐧 Linux (Ubuntu, Debian, Fedora, …)	Shell one-liner	--service (systemd)
🐳 Server / VPS	Docker Compose	Docker itself

🍎 macOS

brew tap mydisha/keirouter https://github.com/mydisha/keirouter
brew install keirouter
keirouter start

Your browser opens the dashboard. Want it running all the time, even after a reboot?

brew services start keirouter   # starts now and on every login

Prefer a menu-bar icon you can quit any time? Run keirouter tray instead.

curl -fsSL https://raw.githubusercontent.com/mydisha/keirouter/main/scripts/install.sh | bash

It downloads the right build for Apple Silicon or Intel, checks its checksum, and installs keirouter to /usr/local/bin (it may ask for your password once).

🪟 Windows

Open PowerShell and run:

irm https://raw.githubusercontent.com/mydisha/keirouter/main/scripts/install.ps1 | iex

Then open a new terminal (so the PATH change applies) and start it:

keirouter start

Want it in the background? keirouter tray puts an icon in the taskbar tray. To start it automatically when you log in, add a shortcut to your Startup folder:

$s = (New-Object -ComObject WScript.Shell).CreateShortcut("$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\KeiRouter.lnk"); $s.TargetPath = (Get-Command keirouter).Source; $s.Arguments = "tray --no-browser"; $s.WindowStyle = 7; $s.Save()

Pin a version or change the location with $env:KEIROUTER_VERSION / $env:KEIROUTER_DIR before running the installer.

🐧 Linux (Ubuntu, Debian, Fedora, …)

curl -fsSL https://raw.githubusercontent.com/mydisha/keirouter/main/scripts/install.sh | bash
keirouter start

Works on amd64 and arm64 (including 64-bit Raspberry Pi OS). All it needs is curl (or wget) and tar, which every Ubuntu already has.

To keep KeiRouter running in the background and start it on boot, install it as a systemd service instead:

curl -fsSL https://raw.githubusercontent.com/mydisha/keirouter/main/scripts/install.sh | bash -s -- --service

systemctl --user status keirouter      # is it up?
journalctl --user -u keirouter -f      # follow the logs
systemctl --user restart keirouter     # restart after a config change

On a desktop with a system tray, keirouter tray works too.

🐳 Docker / VPS

The easiest way to run KeiRouter on a server:

curl -fsSL https://raw.githubusercontent.com/mydisha/keirouter/main/scripts/install.sh | bash -s -- --docker

Or by hand with Docker Compose:

git clone https://github.com/mydisha/keirouter.git
cd keirouter
cp .env.example .env       # set KEIROUTER_MASTER_KEY (openssl rand -base64 32)
docker compose up -d --build

Want PostgreSQL instead of SQLite? Layer on compose.postgres.yaml. VPS, PostgreSQL, Coolify and reverse-proxy notes live in deploy/README.md.