AnthXrouter

Local-first LLM router with workspace-scoped auth, encrypted provider secrets, and OpenAI-compatible inference endpoints.

Global install (recommended)

npm install -g anthxrouter
anth

Alias:

anthxrouter

Update to the latest version

npm update -g anthxrouter

Or reinstall explicitly:

npm install -g anthxrouter@latest

Your settings, providers, and vault key stay in the user data directory across updates:

• Windows: %USERPROFILE%\.anthxrouter
• macOS / Linux: ~/.anthxrouter

CLI options

anth --help          # show commands
anth --version       # show installed version
anth --background    # start server in background and exit
anth --open          # start server and open Web UI
anth --update        # show npm update instructions

Default port: 21228. If the port is taken by another app, AnthXrouter scans the next available port automatically.

System tray (Windows)

Choose Hide to System Tray in the CLI menu — the AnthXrouter logo appears in the Windows notification area (near the clock). Right-click to open the dashboard or quit.

Quick Start (Development)

npm install
npm run dev          # runs both Vite client + tsx-watched server

Production / Deployment

Important: The server must be built before starting in production mode.

npm run build:server   # compiles TypeScript → dist-server/
npm start              # runs the compiled server (node dist-server/bootstrap/index.js)

Safety Guards

1. Prestart hook — npm start automatically triggers npm run build:server first.
2. Runtime integrity check — On server boot, the application verifies that the compiled vault module contains the key-drift detection logic. If the check fails (stale build), the process exits with a clear fatal error.
3. Production bind guard — Binding beyond loopback requires ALLOW_REMOTE_BIND=true and SETUP_SECRET.

Key Security Features

• Three-plane authentication (workspace, session, CLI API key)
• AES-256-GCM envelope encryption for provider secrets with on-disk key fingerprinting and runtime drift detection
• Rate limiting + progressive lockout on auth endpoints
• SSRF protection on outbound provider requests
• Workspace-scoped data isolation (all records keyed by X-Workspace-Id)
• Password never required for inference (CLI keys are separate)
• /v1/chat/completions forwards to configured providers (OpenAI-compatible and Anthropic)

Project Structure (high level)

server/
  bootstrap/          # app factory + startup
  application/        # services (auth, providers, cli-keys, router)
  http/               # routes + middleware
  infrastructure/     # crypto, db (json file store), repositories
src/
  features/           # React features (auth, provider, combo, endpoint, usage)
  shared/             # api client, i18n, storage, styles
cli/
  menu.mjs            # interactive launcher
  server.mjs          # process management

Environment Variables

See .env.example. All integer variables are parsed safely (empty or invalid values fall back to documented defaults).

| Variable | Default (prod CLI) | Notes | |----------|-------------------|-------| | PORT | 21228 | API + Web UI port | | HOST | 127.0.0.1 | Loopback only unless ALLOW_REMOTE_BIND=true | | ANTHXROUTER_DATA_DIR | ~/.anthxrouter | Store + vault key location | | SETUP_SECRET | — | Required for remote initial password setup |

License

MIT