Two problems get solved together. The first is durability: a long provider run becomes a job you can poll, cancel and collect after a restart, instead of something a dropped connection destroys. The second is corroboration — the same question put to several CLIs independently, judged, and ending in a hashed receipt of what was asked and what came back. The design deliberately leaves credentials and sessions where they already live, inside each provider's own CLI, and scopes anything remote to a workspace you registered on purpose.
A single-user control plane for local coding-agent CLIs. It runs each provider's own CLI, keeping its native sessions and local credentials in place, exposes them as synchronous or durable asynchronous jobs that survive a disconnect, and adds cross-model validation with hashed receipts.
- One tool per provider and an async twin for each — claude_request, codex_request, gemini_request through the Antigravity CLI, grok_request, devin_request, cursor_request and mistral_request, alongside their _async forms that return a job
- Durable jobs: llm_job_status, llm_job_watch for bounded progress, llm_job_result for captured output, llm_job_cancel, and llm_request_result to read back any persisted request from the flight record after a restart
- Cross-model validation as a first-class operation — validate_with_models asks two or more CLIs independently, consensus_check asks whether they agree with a claim, second_opinion has one review an answer, red_team_review attacks a plan for failure modes, and synthesize_validation runs an explicit judge over the results
- validation_receipt returns the canonically hashed immutable receipt of a finished cross-model validation, and compare_answers summarises agreement and difference locally without spending a provider call
- review_changes captures one complete immutable Git evidence artifact and fences it as untrusted before any model reads it
- Workspaces registered by alias so remote calls are scoped to a folder rather than the filesystem — created fresh, or registered from an existing Git repository
- A Personal Agent Config baseline initialised, published, synchronised, verified and atomically activated, with rollback to a retained release and explain_effective_config for which release is in force and why
- Provider administration split by risk: provider_admin_list enumerates the operations, provider_admin_run executes the read-only ones, and provider_admin_mutate the ones that change state such as adding an MCP server or logging in
- Introspection of the CLIs themselves — installed versions and login status, models and aliases per provider, declared subcommand contracts, and provider_subcommand_drift probing the real --help surfaces for divergence from those contracts
- Gateway sessions created, listed, made active, inspected and deleted, with approval_list showing the approval decisions the gateway recorded
Published as llm-cli-gateway, installed globally or launched over stdio with npx. It drives the provider CLIs rather than their APIs, so each provider you intend to use must be installed and logged in locally — cli_versions reports which are present and authenticated. Credentials stay inside those CLIs; the gateway does not hold them. HTTP transport with bearer-token auth is available for a remote client, where every request must resolve to a registered workspace alias before a provider runs, and unrestricted local filesystem access belongs to the stdio path only.
One command — npm install -g llm-cli-gateway