@context-mode/cli

Connect Claude Code and Codex to the context-mode gateway, and sign your terminal in.

npx @context-mode/cli setup     # point Claude Code and/or Codex at the gateway: diff shown, backup first
npx @context-mode/cli login     # opens the browser, waits until you are signed in
npx @context-mode/cli status    # signed in or not, as whom, and each client's setup state
npx @context-mode/cli logout    # signs this terminal out: its agent is asked to sign in again

Installed globally (npm i -g @context-mode/cli), the command is context-mode-cli. The 0.1.0 name, context-mode-login, still works and runs the same program.

| Command | What it does | Network | |---|---|---| | setup | Writes the gateway settings into Claude Code's and/or Codex's config file. Details below. | None | | login | POST /__cli-login, opens the sign-in link, then polls /__cli-status until you are signed in. | Gateway only | | status | /__cli-status: signed in, as whom (email, account, workspace) and how. Then one line per client: configured, not configured, or not installed. Exit 0 signed in, 2 not. --json for scripts. | Gateway only | | logout | POST /__cli-logout. --json for scripts. | Gateway only |

setup

Which clients: --client claude, --client codex or --client all. Without --client, it sets up the clients installed here (the config directory exists, or claude / codex is on your PATH), and says which.

Claude Code: ~/.claude/settings.json (or $CLAUDE_CONFIG_DIR/settings.json)

Merged into the env block. Nothing else in the file changes: the edit replaces only these keys' text, so line endings (CRLF stays CRLF), indentation and number spellings such as 1.0 are kept.

| Key | Value | Why | |---|---|---| | ANTHROPIC_BASE_URL | the gateway | sends Claude Code's requests through the gateway | | ENABLE_TOOL_SEARCH | true | If you already set it to something else ("false"), that is your choice: setup asks before changing it, and --yes keeps it and says so. Claude Code turns tool search off for any base URL that is not api.anthropic.com and then sends every tool in full on every call. Measured through the gateway, turning it back on sends about 15% fewer prompt tokens for the same work. That is a token count, not a cost claim: no session saving has replicated, and the gateway has not been measured cheaper than calling Anthropic directly. |

Setup never writes _CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL. It is not recommended: it gives no benefit through the gateway (no global-cache hit, no fewer tokens than ENABLE_TOOL_SEARCH alone), it is undocumented, and in this user-level file it would apply to every base URL you set later. 0.2.1 removed the --internal flag that wrote it. A 1 an earlier setup wrote is removed, and the diff shows it.

Restart Claude Code afterwards.

Codex: ~/.codex/config.toml (or $CODEX_HOME/config.toml)

model_provider = "context-mode"

[model_providers.context-mode]
name = "context-mode"
base_url = "https://cm-gateway-poc.mksglu.workers.dev/v1"
wire_api = "responses"
requires_openai_auth = true

| Key | Why | |---|---| | model_provider | selects the provider below. Codex's default (openai) is switched without asking; any other provider is a conflict (see below). | | base_url | the gateway, with /v1: Codex posts /v1/responses and probes /v1/models there | | wire_api = "responses" | Codex speaks the Responses API | | requires_openai_auth = true | Required. Without it Codex sends no credential at all to a custom provider (measured on Codex 0.156.1). With it, a ChatGPT login sends its token and the gateway routes the turn to ChatGPT's Codex backend; an API-key login sends the sk- key and the turn goes to api.openai.com. |

Codex sends a key only from its own login. An OPENAI_API_KEY that is only exported in your shell is not sent; setup tells you to run printenv OPENAI_API_KEY | codex login --with-api-key. It also names any [profiles.*] that selects another provider, because that profile wins while it is active.

The file is parsed with a real TOML parser before anything is written. The edit changes only the lines of these keys, so comments, spacing and every other table stay exactly as they were, and the edited file is parsed again and must hold exactly the intended settings, or nothing is written. A provider table written inline or with dotted keys is refused rather than rewritten. Start a new Codex session afterwards.

What setup promises, for both clients

• It stops and writes nothing if the file does not parse.
• It shows the key-level diff and asks before writing. It never prints credentials.
• It never replaces a different ANTHROPIC_BASE_URL, a different Codex model_provider, or a different base_url in its own provider table unless you say so: --replace-base-url, or yes to that question. --yes alone does not cover it.
• It copies the original to <file>.cm-setup-bak-<timestamp> (the bytes it read, same mode), then writes atomically.
• If the file changes while the question is open (Claude Code saves settings.json itself, for example on an "always allow", and a second setup may be waiting at its own prompt), nothing is written and the new content is kept. Run setup again to apply the change on top of it.
• A read-only file (no owner write permission) is refused, not replaced.
• A symlinked config file (a dotfiles link) stays a link: the file it points to is written, and the backup sits next to that file.
• Running it again with nothing to change writes nothing.
• For Claude Code, it tells you when a shell variable also sets one of these keys, because that one can win.

Options

| Option | Effect | |---|---| | --client claude\|codex\|all | which clients (default: the ones installed here) | | --yes, -y | write without asking (never replaces another base URL or provider) | | --dry-run | show the changes, write nothing | | --check | write nothing; exit 0 when every chosen client is configured, 2 when one is not | | --replace-base-url | replace a different base URL or provider | | --gateway URL | a gateway other than the hosted one (default: $CONTEXT_MODE_GATEWAY, else hosted). setup ignores a shell $ANTHROPIC_BASE_URL on purpose, so an address set somewhere else is never copied into a config file. |

Exit codes: 0 done (or nothing to do), 1 refused or failed, 2 --check found a client not configured, 3 a conflict was not confirmed. With several clients, the most serious one wins.

login, status, logout

They use the same credential as your coding agent: ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, CLAUDE_CODE_OAUTH_TOKEN, or your Claude Code login (macOS Keychain, or ~/.claude/.credentials.json). The credential is sent only to the gateway and is never written anywhere by this tool.

Gateway: $CONTEXT_MODE_GATEWAY, else $ANTHROPIC_BASE_URL, else the hosted gateway.