Introducing kRouter — a hardened AI router by Kodelyth

Updated October 2026 for v0.5.163. New in this version: the current provider count, the free tiers that have closed since launch (Qwen, iFlow and Gemini CLI's unpaid tier), how Zenith scores accounts today, and the releases after v0.5.81. The rest of the launch post is kept as written, with claims that went further than the code toned down.

The AI coding stack got really weird in the last twelve months. Every IDE wants a subscription. Every model provider wants a separate key. Every "agentic" workflow somehow ends up eating tokens twice for the same task. We watched our team's LLM bill keep climbing, and very little of it bought us more code shipped.

So we built kRouter -- an MIT-licensed, self-hosted router that sits between your IDE and every provider you already pay for. One local endpoint, every model, a bill you can predict.

What kRouter does in one paragraph

You install kRouter on your laptop or a server. It listens on localhost:20128 and speaks OpenAI Chat Completions, Responses and Anthropic Messages under /v1, plus the Gemini and Ollama formats. You point Claude Code, Codex, Cline, OpenCode -- any client that takes a base URL -- at it. IDEs that cannot change their endpoint (Antigravity, GitHub Copilot, Kiro IDE, Claude Desktop) go through its MITM mode instead, and Cursor needs a tunnel because it ignores a localhost base URL. Behind the endpoint you decide the order: a combo that spends your subscription quota first, then a cheap plan, then a free provider. When one account is rate-limited or out of quota, kRouter moves to the next account, then to the next model in the combo, so the request usually completes instead of failing back to your IDE.

95+ providers across five auth tiers

The built-in catalog has 95+ providers, grouped by how you connect them:

• Subscriptions (OAuth): Claude Code, OpenAI Codex, GitHub Copilot, Antigravity, Grok CLI, Cursor (imported token) and a few more. You already pay for these, so a combo can spend their quota first. kRouter shows a risk notice before you connect several of them: those sessions are not licensed for proxy use, and the provider can restrict the account.
• API keys: about 70 providers, including OpenAI, Anthropic, DeepSeek, xAI, GLM Coding (Z.ai), Kimi, MiniMax and OpenCode Go, plus the search, voice and image services. Flat-rate coding plans make the cheapest overflow tier now: OpenCode Go is $10 a month, and Z.ai's GLM Coding Plan starts at $18.
• Free credits: OpenRouter, NVIDIA NIM, Gemini (AI Studio key), Cloudflare Workers AI, Vertex AI, Ollama Cloud and others with a free allowance.
• Free: OpenCode Free and MiMo Code Free need no account at all. Kiro's free plan includes 50 credits a month. Qoder and CodeBuddy CN sit here too.
• Browser cookie: Grok Web and Perplexity Web.

Three free routes from the original launch list are gone. Alibaba discontinued Qwen Code's free OAuth tier on April 15, 2026, and kRouter hides Qwen and iFlow. Google replaced Gemini CLI with Antigravity CLI for unpaid and Google One users on June 18, 2026, so do not plan on kRouter's Gemini CLI entry as a free route (what still works for free).

You can also add any OpenAI- or Anthropic-compatible endpoint as a custom provider.

Why a fork instead of joining 9router?

kRouter is forked from decolua/9router -- credit where it is due. We needed harder edges:

• Antigravity verify-account ban fix. Bootstrap was sending string OAuth enums while the live API expected numeric ones, and Google's anti-abuse layer flagged accounts on the first call. We fixed it with byte-exact parity (v0.5.46).
• MITM stream recovery. Kiro showed cryptic Truncated event message received errors when an EventStream frame header overflowed; the encoder now bounds-checks every frame. Separately, Google's load balancer dropping stale HTTP/2 streams used to cascade into socket hang up; the proxy now retries on a fresh HTTP/2 session before it falls back to HTTP/1.1 (v0.5.73).
• Atomic backoff under concurrency. Cooldown increments raced under high traffic and stalled exponential backoff. Moving the read-modify-write into a SQLite transaction fixed it.
• Per-IP brute-force lockout, SSRF guards, timing-safe token compare. All the boring security details that make a router safe to expose over Tailscale.

That security work did not stop at launch. Releases v0.5.135 to v0.5.162 closed a remote auth bypass through a spoofed Host header, remote login with the default password, seven more SSRF holes, an unauthenticated remote code execution on Windows hosts (fixed by a Next.js update), and example secrets from the docs that used to work. The security docs cover the current defaults.

The full diff against upstream is on /compare.

The features that actually save money

Three things change your bill the most:

1. RTK Token Saver. On by default. It finds tool output in requests -- git diff, ls, tree, grep, logs, build output -- and compresses it before the request leaves your machine. The README puts the saving at 20-40% of input tokens on requests that carry tool output; that is the project's claim, not a published benchmark.
2. Caveman Mode. Off by default. An optional system prompt that makes the model answer tersely, at lite, full or ultra strength. The dashboard quotes "~65% fewer output tokens (up to 87%)"; treat that as the feature's claim too. Ponytail, its code-only sibling, cannot run at the same time.
3. Fallback combos. You list models in order -- subscription, then cheap, then free -- and kRouter walks the list when an entry fails or runs out. Entries whose provider reports remaining quota can move ahead when they have more left. See the combos docs.

The Usage page charts tokens and estimated cost per request, so you can see where the spend actually goes.

Zenith Score Engine (v0.5.75)

Since v0.5.75, kRouter ranks a provider's accounts with the Zenith Score Engine before each request, and since v0.5.77 it is the default. The score today has three parts:

• Health -- 0 to 1000, built from the account's success rate and penalized by latency.
• Quota headroom -- an account with less than 30% of its quota left has its score scaled down in proportion, to a floor of one tenth.
• Priority -- each point of priority you set on a connection adds 10.

The highest score wins. The strategy picker still labels the default "Fill First", but that setting runs Zenith. Accounts near their ceiling drop down the ranking on their own, so fewer requests land on an account that is about to answer with a 429.

HealthCache RAM Layer (v0.5.69)

Before v0.5.69, locking a rate-limited account and finding the next one meant synchronous SQLite writes and reads inside the routing loop. With five dead accounts that was ten disk hits and about 50ms of overhead per failure. The HealthCache RAM layer keeps connections and their locks in memory: a 429 locks the account in RAM, the next account is picked in under a millisecond, and the SQLite write happens in the background.

What changed since launch (v0.5.45 -- v0.5.81)

The router shipped 36 point releases in that window. Key highlights:

Since then (v0.5.82 -- v0.5.163)

The full history is on /changelog.

What you actually get out of the box

• One local server on port 20128 for OpenAI Chat Completions, Responses, Anthropic Messages, Gemini and Ollama clients
• 95+ providers across OAuth, API-key, free-credit, free and browser-cookie tiers, plus any compatible endpoint you add
• Zenith scoring on health, latency, quota and priority
• HealthCache RAM layer for in-memory failover
• Format translation between OpenAI, Claude, Gemini, Cursor, Kiro and Vertex shapes
• RTK on by default; Caveman, Ponytail, Headroom, PXPIPE and a response cache when you opt in
• Live quota and reset countdowns for providers that report them, including Claude, Codex, Copilot, Kiro and Antigravity
• MITM mode for Antigravity, GitHub Copilot, Kiro IDE and Claude Desktop (not inside Docker)
• 8 agent skill files for AI coding agents
• Embeddings, image, TTS, STT, web search and web fetch endpoints, plus video through xAI
• MIT licensed and self-hosted: there is no kRouter-hosted service in the path, so requests go from your machine to the providers you connect

Install in 30 seconds

npm install -g @sifxprime/krouter
krouter -t

Open http://localhost:20128/dashboard, connect a provider -- OpenCode Free and MiMo Code Free need no account, so they are the quickest first step -- and point your IDE at the endpoint.

For Docker, generate a dashboard password first. The default password only works from the machine kRouter runs on, and inside Docker even your own browser counts as remote:

KROUTER_PASSWORD="$(openssl rand -base64 18)" && echo "Dashboard password: $KROUTER_PASSWORD"
docker run -d -p 20128:20128 \
  -e INITIAL_PASSWORD="${KROUTER_PASSWORD:?run the line above first}" \
  -v "$HOME/.krouter:/app/data" --name krouter sifxprime/krouter:latest

Source builds and VPS deploys are on the /install page and in the deploy docs.

Where this is going

kRouter is one piece of a larger thesis: AI coding is going to be cheap because the unit economics of the underlying providers are cheap. The friction is everywhere else -- fragmented APIs, surprise rate limits, vendor lock-in to IDEs. We are building toward a stack where you pick the best model for each request and the bill stays predictable.

Star the repo, install the tool, and send us a PR if something does not work. Release notes are on /changelog.

-- The Kodelyth team

Common questions

Is kRouter free?

Yes. kRouter is MIT-licensed and self-hosted, with no paid tier of its own. You pay only the providers you connect, and some of those are free.

How many providers does kRouter support?

95+ in the built-in catalog, across subscription (OAuth), API-key, free-credit, free and browser-cookie providers. You can add any OpenAI- or Anthropic-compatible endpoint as a custom provider on top of that.

Does kRouter pick the cheapest provider automatically?

Not by price. You set the order in a combo and kRouter walks it, moving on when an entry fails or runs out of quota. Within one provider, Zenith picks the account with the best mix of success rate, latency and remaining quota.

Is kRouter a hosted service?

No. It runs on your laptop, a server or in Docker and listens on port 20128. The CLI binds to 0.0.0.0 by default, so start it with --host 127.0.0.1 if it should only be reachable from the same machine.