Secure local control plane for AI coding agents across supported MCP clients, with workspace-scoped remote access, approval gates, durable jobs
Llm Cli Gateway MCP server exists for a simple reason — assistants are far more useful when they can act on Llm Cli Gateway directly instead of describing what you should do. Secure local control plane for AI coding agents across supported MCP clients, with workspace-scoped remote access, approval gates, durable jobs, sessions, and audit receipts.
llm-cli-gateway lets supported MCP clients operate Claude Code, Codex, Gemini/Antigravity, Grok Build, Mistral Vibe, Cognition Devin, Cursor Agent, and configured HTTP API providers through one user-owned gateway while preserving native CLI sessions, local credentials, durable async jobs, validation receipts, and review workflows.
Once Llm Cli Gateway is connected, these are the calls the assistant has available:
Machine — readable diagnostics: npm run doctorCross — validation tools: review_changes, validate_with_models, second_opinion, compare_answers, red_team_review, consensus_check, ask_modelMulti — LLM Orchestration**: Unified interface for Claude Code, Codex, Gemini, Grok, Mistral (Vibe), Devin, and Cursor Agent CLIsGateway — owned worktrees**: Run supported sync or async provider requests inside a managed git worktree with the local file-backed session managerHost — protection backpressure**: bounded HTTP session lifecycle (max sessions + idle reaper), global and per-provider job-execution limits with a boundedLong — Running Jobs**: Non-time-bound async execution via *_request_async + polling toolsSupply — chain hardening**: a dedicated .github/workflows/security.yml runs actionlint, zizmor, shellcheck, typos, osv-scanner, gitleaks, and lychee on everyCLI — Prefix disciplineclaude — yescodex — yesgemini — yesgrok — yesYou will need 3 environment variables: LLM_GATEWAY_SKILLS_PATH, LLM_GATEWAY_AUTH_TOKEN, RVWR_GATEWAY_BUNDLE_URL. The server will not start without them, which is usually why the tools fail to appear on a first run. Keep credentials in your client's env block or a secrets manager rather than in a file you might commit.
Being a remote server, there is no local install. You register the endpoint with your client, authorise it once, and the tools appear.
Among the developer tooling options, the useful question is rarely "what can it do" but "what does it cost you to run" — permissions, credentials, and how much of your context its toolset consumes. Llm Cli Gateway's toolset — Machine, Cross, Multi and 11 more — is a fair guide to whether it matches your workflow. It is maintained by verivus-oss; worth a glance at recent repository activity before you build anything load-bearing on it.
SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.
| Tool | What it does |
|---|---|
| Machine | readable diagnostics: npm run doctor |
| Cross | validation tools: review_changes, validate_with_models, second_opinion, compare_answers, red_team_review, consensus_check, ask_model, synthesize_validation, job_status, job_result, and validation_receipt (plus the valida |
| Multi | LLM Orchestration**: Unified interface for Claude Code, Codex, Gemini, Grok, Mistral (Vibe), Devin, and Cursor Agent CLIs |
| Gateway | owned worktrees**: Run supported sync or async provider requests inside a managed git worktree with the local file-backed session manager. Same-session reuse requires same-host durable ownership plus a matching live Git |
| Host | protection backpressure**: bounded HTTP session lifecycle (max sessions + idle reaper), global and per-provider job-execution limits with a bounded FIFO queue, and a configurable per-job output cap (default 50MB). See [H |
| Long | Running Jobs**: Non-time-bound async execution via *_request_async + polling tools |
| Supply | chain hardening**: a dedicated .github/workflows/security.yml runs actionlint, zizmor, shellcheck, typos, osv-scanner, gitleaks, and lychee on every push and PR (see SECURITY.md for the threat model) |
| CLI | Prefix discipline |
| claude | yes |
| codex | yes |
| gemini | yes |
| grok | yes |
| mistral | yes |
| devin | no |
{
"mcpServers": {
"llm-cli-gateway": {
"command": "npx",
"args": ["-y", "llm-cli-gateway"],
"env": {
"LLM_GATEWAY_SKILLS_PATH": "your-value",
"LLM_GATEWAY_AUTH_TOKEN": "your-value",
"RVWR_GATEWAY_BUNDLE_URL": "your-value"
}
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
| Variable | Description | Required |
|---|---|---|
| LLM_GATEWAY_SKILLS_PATH | Filesystem location the server is allowed to use. | Optional |
| LLM_GATEWAY_AUTH_TOKEN | Credential the server authenticates with. | Yes |
| RVWR_GATEWAY_BUNDLE_URL | Endpoint or connection string the server talks to. | Yes |
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.