approval_list
List recent MCP-managed approval decisions recorded by the gateway (approvalStrategy: mcp_managed).
LABSCO SUMMARY
Local coding agents operated from one client, with both the disconnects and the disagreements handled.
Two problems get solved together. The first is durability: a long provider run becomes a job you can poll, cancel and collect after a restart, instead of something a dropped connection destroys. The second is corroboration — the same question put to several CLIs independently, judged, and ending in a hashed receipt of what was asked and what came back. The design deliberately leaves credentials and sessions where they already live, inside each provider's own CLI, and scopes anything remote to a workspace you registered on purpose.
What it is
A single-user control plane for local coding-agent CLIs. It runs each provider's own CLI, keeping its native sessions and local credentials in place, exposes them as synchronous or durable asynchronous jobs that survive a disconnect, and adds cross-model validation with hashed receipts.
What you get
- One tool per provider and an async twin for each — claude_request, codex_request, gemini_request through the Antigravity CLI, grok_request, devin_request, cursor_request and mistral_request, alongside their _async forms that return a job
- Durable jobs: llm_job_status, llm_job_watch for bounded progress, llm_job_result for captured output, llm_job_cancel, and llm_request_result to read back any persisted request from the flight record after a restart
- Cross-model validation as a first-class operation — validate_with_models asks two or more CLIs independently, consensus_check asks whether they agree with a claim, second_opinion has one review an answer, red_team_review attacks a plan for failure modes, and synthesize_validation runs an explicit judge over the results
- validation_receipt returns the canonically hashed immutable receipt of a finished cross-model validation, and compare_answers summarises agreement and difference locally without spending a provider call
- review_changes captures one complete immutable Git evidence artifact and fences it as untrusted before any model reads it
- Workspaces registered by alias so remote calls are scoped to a folder rather than the filesystem — created fresh, or registered from an existing Git repository
- A Personal Agent Config baseline initialised, published, synchronised, verified and atomically activated, with rollback to a retained release and explain_effective_config for which release is in force and why
- Provider administration split by risk: provider_admin_list enumerates the operations, provider_admin_run executes the read-only ones, and provider_admin_mutate the ones that change state such as adding an MCP server or logging in
- Introspection of the CLIs themselves — installed versions and login status, models and aliases per provider, declared subcommand contracts, and provider_subcommand_drift probing the real --help surfaces for divergence from those contracts
- Gateway sessions created, listed, made active, inspected and deleted, with approval_list showing the approval decisions the gateway recorded
Requirements
Published as llm-cli-gateway, installed globally or launched over stdio with npx. It drives the provider CLIs rather than their APIs, so each provider you intend to use must be installed and logged in locally — cli_versions reports which are present and authenticated. Credentials stay inside those CLIs; the gateway does not hold them. HTTP transport with bearer-token auth is available for a remote client, where every request must resolve to a registered workspace alias before a provider runs, and unrestricted local filesystem access belongs to the stdio path only.
Setup effort
One command — npm install -g llm-cli-gateway
USE CASES
01
Delegating a long task without holding the connection open
Start the provider request as a durable job, poll its status, and collect the output later — a restart in between does not lose it.
02
Getting independent verdicts before acting on one
Two or more CLIs answer the same question without seeing each other, a judge model synthesises the results, and the receipt records what happened.
03
Stress-testing a plan before committing to it
A red-team pass looks for failure modes, and a consensus check says whether the providers actually agree with the claim underneath it.
04
Reviewing a diff with evidence you can keep
The Git artifact is captured immutably and fenced as untrusted input, then a provider reviews it and a second opinion checks that review.
05
Scoping what a remote client is allowed to touch
Register the repository as a workspace alias; remote HTTP calls have to name one before any provider executes.
06
Finding out which CLIs are actually usable right now
Installed versions and login status, the models each provider exposes, and the capabilities discovered for each one.
63 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
ask_model
Ask one provider CLI a question through the simplified validation surface (starts a validation job).
claude_request
Run a Claude Code CLI request synchronously (when async jobs are enabled, auto-defers to a pollable job past the sync deadline; otherwise runs to completion). Requires exactly one of prompt or promptParts.
claude_request_async
Start a Claude Code CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
cli_upgrade
Plan (dryRun, default true) or execute an upgrade for one provider CLI using its native update mechanism.
cli_versions
Report installed provider CLI versions, availability, and login status for all registered CLI providers (claude|codex|gemini|grok|mistral|devin|cursor) or one.
codex_fork_session
Fork an existing Codex session into a new branch (codex fork <ID|--last>) without mutating the original. This prompt remains argv-bound and rejects oversized UTF-8 input as non-retryable input_too_large.
codex_request
Run an OpenAI Codex CLI request synchronously (when async jobs are enabled, auto-defers to a pollable job past the sync deadline; otherwise runs to completion). Requires exactly one of prompt or promptParts.
codex_request_async
Start an OpenAI Codex CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
compare_answers
Summarize agreement/differences between caller-provided answers LOCALLY — does not call any provider.
config_ack_stale
Acknowledge the current stale Personal Agent Config release for at most 24 hours.
config_init
Initialize or clone the local Personal Agent Config baseline. This never activates a release by itself.
config_publish
Push the clean local Personal Agent Config baseline to its configured Git upstream without force-pushing.
config_recover_kit_attempt
Fence and release one exact unadmitted durable Kit attempt after the previous gateway process has been stopped. Copy the execution and attempt identity from local session_get output. This action is local-only and cannot recover an existing durable job.
config_rollback
Atomically activate an already verified retained Personal Agent Config release.
config_status
Show Personal Agent Config state without exposing baseline paths or local machine binding values.
config_sync
Synchronize, verify, compile, and atomically activate a Personal Agent Config release. It never pushes.
consensus_check
Ask provider CLIs whether they agree or disagree with a claim (starts validation jobs).
cursor_request
Run a Cursor Agent request synchronously (auto-defers to a pollable job past the sync deadline when async jobs are enabled; otherwise runs to completion). Default cli uses headless print mode (cursor-agent --print); gated acp uses native cursor-agent acp and accepts prompt, model, a gateway ACP session, and a registered workspace alias.
cursor_request_async
Start a Cursor Agent CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
devin_request
Run a Cognition Devin CLI request synchronously (auto-defers to a pollable job past the sync deadline when async jobs are enabled; otherwise runs to completion). Headless print mode (devin -p).
devin_request_async
Start a Cognition Devin CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
explain_effective_config
Explain the selected Personal Agent Config release and context provenance without returning local paths or instruction text.
gemini_request
Run a Google Antigravity CLI (agy) request through the Gemini-compatible gateway tool synchronously (when async jobs are enabled, auto-defers to a pollable job past the sync deadline; otherwise runs to completion). Requires exactly one of prompt or promptParts.
gemini_request_async
Start a Google Antigravity CLI (agy) request as a durable background job through the Gemini-compatible gateway tool. Poll with llm_job_status, collect with llm_job_result.
grok_request
Run an xAI Grok CLI request synchronously (when async jobs are enabled, auto-defers to a pollable job past the sync deadline; otherwise runs to completion). Requires exactly one of prompt or promptParts.
grok_request_async
Start an xAI Grok CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
job_result
Collect a VALIDATION job's normalized provider output — distinct from llm_job_result, which returns raw provider request job output.
job_status
Check a VALIDATION job's status (jobs started by validate_with_models/ask_model/etc.) — distinct from llm_job_status, which tracks provider request jobs.
list_available_models
List models and capabilities for every available provider CLI (takes no arguments; complements per-provider list_models).
list_models
List models, aliases, and defaults for one provider (claude|codex|gemini|grok|mistral|devin|cursor, or an enabled API provider name), or omit cli to list all providers. API providers are returned under an apiProviders array.
llm_job_cancel
Cancel a running gateway async or deferred-sync job by jobId.
llm_job_result
Retrieve captured stdout/stderr for a gateway async or deferred-sync job by jobId. Use rawOutput:true with independent stream offsets for resumable pages.
llm_job_status
Check lifecycle status and bounded privacy-safe normalized progress for a gateway async or deferred-sync job by jobId.
llm_job_watch
Wait briefly for privacy-safe normalized progress on an owned async job. When the MCP request carries a progress token, notifications are emitted only while this watch request remains active.
llm_process_health
Report gateway process health: async-job manager state plus the resolved persistence configuration and paths.
llm_request_result
Read back any persisted request (sync or async) from the flight recorder by correlationId, including prompt and response.
mistral_request
Run a Mistral Vibe CLI request synchronously (when async jobs are enabled, auto-defers to a pollable job past the sync deadline; otherwise runs to completion). Requires exactly one of prompt or promptParts. Defaults to --agent accept-edits (auto-accepts file edits; dangerous ops such as shell stay gated).
mistral_request_async
Start a Mistral Vibe CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.
provider_admin_list
List provider CLI admin operations (auth status, model list, mcp list, plugin list, doctor, etc.) available on the installed CLIs, projected from runtime discovery. Read-only.
provider_admin_mutate
Execute a MUTATING provider CLI admin operation (mcp add/remove, login/logout, plugin install/remove, session delete/archive, ...). Disabled unless [admin] allow_mutating_cli_admin_ops=true; routed through approval and audited.
provider_admin_run
Execute a READ-ONLY provider CLI admin operation (from provider_admin_list) and return redacted output. Rejects mutating operations.
provider_subcommand_contract
Return the detailed read-only contract for exactly one declared provider CLI subcommand.
provider_subcommand_drift
Probe declared provider subcommand --help surfaces and return compact drift rows without raw help output.
provider_subcommands_list
Return a compact, filterable read-only catalog of declared provider CLI subcommands without flags or raw help.
provider_tool_capabilities
Report provider tool/feature capabilities and discovered local skill/tool integrations for claude|codex|gemini|grok|mistral|devin|cursor|grok_api, or an enabled API provider name.
red_team_review
Challenge a plan, answer, or document for risks and failure modes via provider CLIs (starts validation jobs).
review_changes
Capture one complete, immutable Git evidence artifact, fence it as untrusted data, and start independent read-only provider reviews. Includes committed, staged, unstaged, and untracked changes without truncation.
second_opinion
Ask one provider CLI to review an answer (starts a validation job; poll job_status, collect job_result).
session_clear_all
Delete all gateway session records, optionally scoped to one provider.
session_create
Create a gateway session record for a provider. NOTE: this is gateway bookkeeping (a plain UUID), not a provider-native session; Codex resume needs a real Codex UUID.
session_delete
Delete a gateway session record by ID (also removes any gateway-owned worktree attached to it).
session_get
Get one gateway session record by session ID, including recent request history when available.
session_list
List gateway session records and the active session per provider, optionally filtered by provider.
session_set_active
Set or clear the active session for a provider; the active session is used when a request omits sessionId.
synthesize_validation
Run an explicit judge model over validation results. General validation uses caller-supplied terminal results; review_changes rebuilds its question and results from the owned durable run.
upstream_contracts
Return the gateway's declared provider CLI contracts; with probeInstalled true, diff against installed --help surfaces to detect flag drift.
validate_with_models
Ask two or more provider CLIs to independently validate a question. Starts validation jobs — poll with job_status, collect with job_result (not llm_job_*).
validation_receipt
Retrieve the canonically hashed immutable receipt of a terminal cross-LLM validation run by validationId. Returns minted | pending | expired_unminted (no receipt exists and none can be minted) | verification_failed (a stored receipt does not verify against its run) | not_found (own-or-not-found).
workspace_create
Create a remote HTTP/OAuth workspace alias by creating a new local folder or git repo under a configured allowed root. Not for stdio/local provider path access. Requires LLM_GATEWAY_WORKSPACE_ADMIN=1 and OAuth scope workspace:admin.
workspace_get
Inspect a registered remote HTTP/OAuth workspace alias. Does not list files. Not needed for stdio/local provider calls; do not use workspace_* tools to fix local path access.
workspace_list
List registered workspace aliases for remote HTTP/OAuth provider calls. Does not browse files. Stdio/local callers should not use workspace_* tools to fix provider path access; pass local workingDir/addDir/includeDirs directly.
workspace_register_existing_repo
Register an existing local Git repo as a remote HTTP/OAuth workspace alias. Not for stdio/local provider path access. Requires LLM_GATEWAY_WORKSPACE_ADMIN=1 and OAuth scope workspace:admin.
BEFORE YOU INSTALL
What to know first
Tools you get
63 tools when we connected.
CONTEXT COST
Heavy Standing cost
Rated by the size of the 63 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npm install -g llm-cli-gatewayMCP Clients
Any MCP client — npx
ANY MCP CLIENT — NPX · JSON
{
"mcpServers": {
"llm-gateway": {
"command": "npx",
"args": [
"-y",
"llm-cli-gateway"
]
}
}
}Any MCP client — local build
ANY MCP CLIENT — LOCAL BUILD · TERMINAL
git clone https://github.com/verivus-oss/llm-cli-gateway.git
cd llm-cli-gateway
npm install
npm run buildThen add the built entry point to your client:
ANY MCP CLIENT — LOCAL BUILD · JSON
{
"mcpServers": {
"llm-cli-gateway": {
"command": "node",
"args": [
"<YOUR_PATH_TO_LLM_CLI_GATEWAY>/dist/index.js"
]
}
}
}
