9router CLAUDE.md

Repository instructions for working on 9Router, a local gateway and dashboard that sends AI requests to multiple providers. They describe its parts, commands, and request flow.

In plain words
What is it for?
Use them when developing, testing, or troubleshooting the 9Router repository. They cover setup commands and the main project areas.
Why use it?
They give an AI coding agent the background needed to navigate the repository and understand how the dashboard, gateway, command-line launcher, and routing code fit together.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/decolua/9router/claude-md
Clone the repo
git clone --depth 1 https://github.com/decolua/9router
Per session 1,970 This file is loaded in full into every session.
When invoked 1,970 The same file — it is already loaded in full.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01970 $0.01970
Opus 5 $0.00985 $0.00985
Sonnet 5 $0.00394 $0.00394
Haiku 4.5 $0.00197 $0.00197

Measured yesterday against content hash 18e534304130, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

9router CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

CLAUDE.md · 92 lines

How it starts

The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

What this is

9Router (9router-app) — a local AI routing gateway + Next.js dashboard. It exposes one OpenAI-compatible endpoint (/v1/*) and routes traffic across 40+ upstream providers with format translation, model-combo fallback, multi-account fallback, OAuth/API-key credential management, token refresh, quota/usage tracking, and optional cloud sync.

Two published artifacts live in this one repo:

  • The dashboard + gateway (root package.json, 9router-app) — the Next.js server that does the actual routing.
  • The CLI launcher (cli/, published to npm as 9router) — a separate package that installs/starts the server and manages the tray. It has its own package.json, version, and build.

The code lives in src/ (Next.js app + dashboard/compat APIs), open-sse/ (the provider-agnostic routing/translation engine), cli/ (the launcher package), and tests/.

Commands

Dashboard/gateway (run from repo root):

cp .env.example .env
npm install
PORT=20128 NEXT_PUBLIC_BASE_URL=http://localhost:20128 npm run dev   # dev (webpack, port 20127 by default via next dev)
npm run build && PORT=20128 HOSTNAME=0.0.0.0 npm run start           # production
  • Bun variants: npm run dev:bun / build:bun / start:bun.
  • Default runtime port is 20128 (dashboard at /dashboard, API at /v1).
  • Lint: npx eslint . (config eslint.config.mjs, extends eslint-config-next).

CLI package (cli/):

npm run cli:pack       # build + npm pack from root
cd cli && npm run dev  # nodemon watch

Tests (vitest, in tests/, an independent ESM package — not wired into root npm test):

npm install                             # ROOT deps first — tests import from src/ which needs `open`, `undici`, etc.
cd tests && npm install                 # then tests' own deps (vitest) → tests/node_modules (allowed by tests/.gitignore)
npx vitest run                          # all tests; auto-discovers tests/vitest.config.js
npx vitest run unit/capabilities.test.js   # single file (path relative to tests/)

The committed tests/package.json test script hardcodes Unix paths (NODE_PATH=/tmp/node_modules …) — a shared-install workaround from upstream. On Windows (or anywhere), ignore it and use the npx vitest form above; vitest.config.js resolves the open-sse/@/ aliases from the repo root regardless of where vitest lives.

The suite is NOT expected to be all-green on a plain checkout. ~938 pass, ~64 fail. Judge regressions with tests/__baseline__/verify-no-regression.mjs, not a raw run. Expected red:

  • 26 catalogued in tests/__baseline__/known-fails.txt (rtk, oauth-cursor-auto-import, translator-request-normalization, …).
  • unit/embeddings.cloud.test.js imports cloud/src/handlers/embeddings.js — the cloud/ worker dir is not in this repo, so it always fails here.
  • unit/xai-oauth-service.test.js times out (5s) when the xAI endpoint-discovery fetch isn't reachable/mocked.
  • real/*.real.test.js make live provider calls — need credentials, skip otherwise.
  • *.real.test.js under tests/translator/real/ make live provider calls — skip unless credentials are set.
  • Regression baselines: tests/__baseline__/verify-*.mjs compare against committed snapshots (providers, aliases, OAuth URLs). Run these after touching provider registry / alias logic.

Read the full file on GitHub · 92 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 92 lines · 1,970 tokens per session scan A 18e534304130

Subscribe to this mod's changes

9router CLAUDE.md is an instructions file published in the GitHub repository decolua/9router (26,675 stars, last pushed 3d ago), licensed MIT. It adds 1,970 tokens to every session, about $0.0098 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.