Claudexor

Website

Claudexor is a local-first control plane for the AI coding agents you already pay for. It runs Codex CLI, Claude Code, Cursor CLI, OpenCode, Antigravity CLI, and raw API adapters behind one typed interface: a chat of turns where read-only questions resume the vendor's own native session, write turns land as inspectable patches or complete file manifests, races pit harnesses against each other with cross-family review, and every claim — cost, quota, web evidence, auth route — is a typed fact you can audit, never a vibe.

Compared to driving a bare Codex or Claude Code session, Claudexor adds the layer the vendors do not ship: best-of-N races with independent reviewers and arbitration; honest budget/quota accounting (unknown cost is never $0); deterministic gates and protected paths; and — since 2.1 — credential profiles: named Antigravity/Claude/Codex/Cursor subscription bindings side by side, each with Claudexor-scoped state and platform-declared credential custody. Live subscription-quota tracking — and the opt-in policy that rotates a spent account out of the way on typed vendor limits — covers the harnesses with a vendor usage source (Antigravity, Claude, and Codex); Cursor has none yet. Everything runs on your machine, files are the source of truth, and there is no telemetry.

Current status: v3.13.0. See "Stability at 2.0" below for what is a stable contract and what remains experimental; retired verbs and mode ids hard-error with the new spelling instead of silently aliasing.

Claudexor also runs as the exact-pinned delegated execution layer inside Ouroboros, a persistent self-developing agent. Ouroboros owns its tasks, memory, review, and final integration. Claudexor runs the connected coding harnesses and returns durable execution evidence. See Ouroboros in action.

Embedding callers can also make a single model request through a managed Codex subscription, using the same account as Agents. The caller supplies its own system prompt and tools and executes those tools itself. This is a typed engine operation, not a public OpenAI-compatible server or a second agent loop. Model catalogs and context limits are account-specific; subscription access does not guarantee zero incremental charges or enable provider-paid credits. See model operations for the transport, retention and unsupported-parameter contract.

Thanks to Praxis Relay and CLIProxyAPI for prior work exploring subscription-backed model transports. They informed this design; neither runs as an embedded relay or owns credentials in this integration.

If you use Claudexor — or you are an agent whose human does — a star is the one-click way to say it works.

• Prerequisites
• Install
• Remote SSH
• Quickstart
• Modes
• Accounts And Quota
• Web, Budgets, And Gates
• Routing, Auth, And Secrets
• Daemon And Control API
• Artifact Layout
• Integrations
• Architecture
• Development
• Stability at 2.0
• For External Agents
• Privacy
• Uninstall / where your data lives

Prerequisites

• Node.js >= 20.19 (the daemon, CLI, and every surface run on Node)
• pnpm (via corepack: corepack enable pnpm)
• Git for Git-backed worktrees, candidate envelopes, and source-control delivery. Explicit directory execution supports direct work and selected-input copies without Git; Doctor reports Git availability, and the app's Workspace Git check explains whether a Git-backed shape is admitted.
• At least one logged-in vendor CLI — codex, claude, cursor-agent, opencode, or agy (Antigravity, for a Gemini subscription) — OR a provider API key (adapters accept OPENAI_API_KEY, ANTHROPIC_API_KEY, ... as fallbacks; the raw-API route needs only a key). Log in through Claudexor, not the bare vendor CLI — see Install And Login
• macOS for the desktop app; the CLI/daemon also run on Linux

Install

CLI + daemon from npm (installs the claudexor and claudexord bins):

npm install -g claudexor
claudexor doctor

You can also build from source — see Quickstart below.

On a Mac, the app is the easiest way in — it ships as a signed and notarized DMG, so it installs like any ordinary Mac app, with no Gatekeeper warnings:

1. Download Claudexor-<version>.dmg from Releases.
2. Drag Claudexor.app into Applications.
3. Open it. The app starts its bundled Claudexor engine, then onboarding checks the external Git and harness route needed by the work you select.

The app bundles its own daemon runtime and starts it on launch; installing the Claudexor CLI is only needed for terminal use. Git and vendor harnesses remain separate capabilities checked before a run starts. (The v1.0.0 DMG was unsigned — if you kept it, either upgrade or approve it via System Settings → Privacy & Security → Open Anyway.)

Host integrations may install one vendor CLI into Claudexor's managed local toolchain with claudexor harness install <harness> --target local --yes --json; a host may bind that explicit unattended authorization to the user's Connect action. Exact npm pins install under ~/.claudexor/node; Cursor remains unpinned, so the JSON receipt records the downloaded installer's SHA-256 and byte length. Every successful executed receipt also records the absolute installed launcher and its verified version; a zero-exit installer without that postcondition is a typed failure. Omitting --target preserves the disclosed remote-host flow, its prefix and its exit-code contract; the install lease and the post-install proof are part of the unattended local contract and do not apply there.

Remote SSH

The macOS app can run a thread on a Linux or macOS SSH host while keeping the UI local. In Settings → Connections, pick a concrete alias from ~/.ssh/config or create one in-app — the form appends a plain Host block to ~/.ssh/config (after a timestamped backup), never a key or password. Connect it, then choose a saved folder or Browse on <host>… from the project picker. The thread is permanently bound to that host and folder; changing either creates a new draft.

Claudexor uses the system /usr/bin/ssh, so existing keys, ssh-agent, known_hosts, MFA and ProxyJump remain OpenSSH's responsibility. On first connection the app verifies and installs a signed, no-sudo runtime under ~/.claudexor/remote/, then reaches its loopback-only control API through an SSH local forward. Vendor CLIs and their credentials remain on the server and with the vendors. Claudexor can install a harness CLI on the host for you through a disclosed, exact-pinned flow — claudexor harness install, or Settings → Harnesses for a connected host: Claude, Codex, and OpenCode install one exact pinned npm version, while the Cursor and Antigravity vendor scripts are downloaded in full and run in the visible terminal where you watch them; nothing executes before the exact package/version/destination install recipe is disclosed and confirmed. An embedding host may instead pass --target local --yes, which installs into the managed toolchain root and must prove the launcher it installed before reporting success. (Installing them on the host yourself works too.) Then sign in from the app, which runs each vendor's own login in an embedded SSH terminal (Codex uses device auth). Remote threads include an embedded SSH terminal and an explicit-port preview tunnel.

Updates

v3.8.0, v3.9.0 and v3.9.7 release exceptions. These owner-authorized releases omit the three custom Ed25519 documents rather than publishing unsigned substitutes. Existing app installs therefore cannot take the in-place engine update to those versions, and the app cannot perform a first-time remote bootstrap from those releases. A fresh signed/notarized DMG, npm packages, and reviewed exact-pin embedders remain usable; normal releases keep the signed-manifest path below fail-closed (the client verifiers themselves stay fail-closed for the waived versions too).

• macOS app — each release publishes a claudexor-runtime-<version>.tar.gz closure (the bundled daemon and CLI, setup-login runner, Browser MCP, and native process-identity helper; Node, UI, and icons stay outside it) plus a signed runtime-manifest.json describing it. On foreground and from the bottom-left update chip / Check for Updates, the app reads that manifest and, if a newer runtime is offered, surfaces "Update available → vX.Y.Z". One click installs it in place, no new DMG: the app downloads the closure, verifies its SHA-256 against the signed manifest, unpacks it under ~/.claudexor/runtime/versions/<version>/, probe-starts it, waits until the engine is idle (it never interrupts running jobs), stops the daemon, swaps the active pointer atomically, relaunches, and re-checks the version — rolling back to the last-known-good runtime on any failure. The manifest is signed by a dedicated offline key the app pins; an unsigned, unknown-key, tampered, or downgraded manifest is refused. Node stays app-owned, so a Node bump still ships a new signed DMG. There is no background update timer; the check runs only when you open the app or click Check for Updates. The manifest's minAppVersion floor means an app that is too old is told to update the app itself rather than offered an incompatible engine.
• embedded hosts — the same signed manifest and the same Node-free closure may be exact-pinned by a host that owns its Claudexor daemon lifecycle. The archive contains only ordinary directories/files (internal package links are materialized), so its format needs no POSIX symlink support. The host supplies the exact full Node toolchain proven by its reviewed pin, launches claudexord.bundle.cjs, invokes operational commands through the adjace