@larridin-ai/router

Connects your AI coding tools to your company's Larridin Router, so requests are routed, metered and governed by your company's model policy.

It sets up Claude Code (the terminal CLI and the VS Code / Cursor extension), Codex and opencode.

Setup

Ask a Larridin admin for your router key (it starts with larridin_router_), then run:

npx @larridin-ai/router connect --key <your key>

That lists the tools it finds and whether each is connected, then asks what to do, with Connect first: connect the tools that are not connected yet, or put this key on the ones that are. The key answers only the key question; add -y to connect every tool it finds with it, asking nothing:

npx @larridin-ai/router connect --key <your key> -y

The key stays in your shell history; to keep it out, use the hidden prompt instead:

npx @larridin-ai/router connect --new-key

Plain npx @larridin-ai/router walks you through the same steps. A key already on this machine is offered first, masked and named by the tool it came from, so you choose between it and a new one. Flags answer their own question and leave the rest alone.

It never prompts when there is no terminal to prompt on -- a pipe, a script, CI set -- and -y or --no-input makes it silent on a terminal too. For scripts, read the key from LARRIDIN_ROUTER_KEY, filled from a secret store:

export LARRIDIN_ROUTER_KEY="..."   # from your secret store
npx @larridin-ai/router connect -y
npx @larridin-ai/router connect -y --tools codex

Give the key one way: --key together with --new-key or with LARRIDIN_ROUTER_KEY is refused.

Then quit and reopen Claude Code. Sessions that are already open keep their old settings.

Check and undo

npx @larridin-ai/router status
npx @larridin-ai/router update
npx @larridin-ai/router disconnect

update refreshes the router files of every connected tool to this version and keeps your key.

disconnect lists the connected tools and asks before removing what connect added. With more than one connected, it first asks whether to disconnect all of them or one. It does not need your key. Without a terminal it removes nothing unless you pass --yes, so a script runs npx @larridin-ai/router disconnect --yes, with --tools to narrow it; --dry-run only lists.

One exception, for Codex: the [model_providers.larridin_router] entry is left in config.toml, because Codex refuses to open a session whose provider is missing from the config. The entry is kept without your router key: disconnect takes the key out of it, and an entry nothing points at changes nothing.

Codex and your existing sessions

Codex lists sessions for the provider that is currently active. After connecting, /resume shows sessions created through the router, and ones from before are hidden. Nothing is deleted, and disconnecting makes them visible again. After disconnecting, sessions created through the router are hidden instead, until you connect again. connect and disconnect both say this before they change anything.

A session resumed by id keeps the provider it was created with, so an older one continues on OpenAI rather than through the router. Sessions started after connecting use the router.

Copilot CLI

connect routes GitHub Copilot CLI through its own files, with no environment variables:

• ~/.copilot/providers.json (or $COPILOT_PROVIDERS_CONFIG) gains a larridin provider, which holds your router key, and your organization's Larridin models. Your own providers and models stay. The file is written owner-only (600), like every file that holds the key, and the key is never copied into a backup.
• ~/.copilot/settings.json gets model: larridin/<default> and the router statusline (run with bash, as Claude Code's is). The statusline refreshes every 30 seconds, since otherwise Copilot redraws it only on events; a refreshInterval you set on it is kept. If you had already chosen a default model, it is kept, and Copilot keeps using it, not the router, until you pick a "via Larridin" model in /model or pass --model larridin/<id>. connect and status both say so. A COPILOT_MODEL that names another provider overrides the file in the same way.
• Copilot is found by its own files (the config.json it writes on its first launch, providers.json, settings.json), not by the copilot command being installed.

Things to know:

• /modelforce works in Copilot too: connect adds its hook to ~/.copilot/settings.json and a modelforce skill (Copilot lets a typed /modelforce through only when one exists). A skill of your own by that name is left alone, and then /modelforce reaches it, not the router.
• GitHub. With no GitHub login, Copilot makes no GitHub connection under this setup (measured). Logged in to GitHub, it can still reach GitHub; COPILOT_OFFLINE=true stops that, along with GitHub MCP, code search and /delegate. connect does not set it.
• Your organization's policy. A managed forceLoginOrgs setting refuses bring-your-own-key, so Copilot will not use the router. connect and status report it when it is in Copilot's managed-settings file (/Library/Application Support/GitHubCopilot/managed-settings.json on macOS, /etc/github-copilot/managed-settings.json on Linux). Set by an MDM profile or the Windows registry, it cannot be seen from here.
• Disconnect removes the larridin provider and its models, the router's model and statusline, and nothing of yours. Copilot sessions started through Larridin cannot be resumed afterwards.
• The Copilot version. Requests tell the router your Copilot version as it was at the last connect or update (from copilot --version, else the installed package). Copilot updates itself, and until you run update after that, the router sees the older version. status shows the version sent.
• Running sessions. Copilot reads providers.json when a session starts. After connect or update replaces your router key or gateway, sessions already running keep the old ones until you restart them (the statusline and /modelforce follow the new file at once).
• A revoked key. status asks your Larridin deployment whether the installed key still works, and reports a rejected one as not connected.
• A moved Copilot home. With COPILOT_HOME or COPILOT_PROVIDERS_CONFIG set at connect, run status, update and disconnect with the same variable set; the Undo line connect prints carries it. Without COPILOT_PROVIDERS_CONFIG, status and disconnect say when the router's settings remain with no providers.json beside them. Without COPILOT_HOME, nothing of the moved home can be seen, so disconnect finds nothing to remove there.
• Hooks in a repository. Copilot also runs a repository's .claude/settings.json hooks: in its interactive mode, and with -p only in a folder you have trusted (or with COPILOT_ALLOW_ALL or GITHUB_COPILOT_PROMPT_MODE_REPO_HOOKS set). If you connected Claude Code there with --scope project or --scope local, its /modelforce hook runs under Copilot in that repository too; an ordinary prompt passes through it untouched. connect writes nothing for Copilot inside a repository.

Notes

• Nothing is written if your key is rejected or the router cannot be reached.
• Your settings file is backed up, with a timestamp, before the first change.
• The statusline shows the model you selected, the model the router served when it differs, this session's tokens and Claude Code's own cost estimate, and whether the session is pinned. It reads Claude Code's own transcript for that; nothing is sent anywhere.
• A setting that already belongs to something else, such as another proxy, is left alone and reported.
• Environment variables can stand in for the common flags, for example LARRIDIN_ROUTER_KEY.
• Needs Node.js 20 or newer.

Run npx @larridin-ai/router --help for the rest: where to write the settings (user, project or local), dry runs, and the optional plugin that adds a /modelforce command. For Codex, connect installs a $modelforce hook instead: $modelforce lists the models, $modelforce 2 pins one for the session, $modelforce auto clears it.