Casbin Gateway Adds Local Security and Routing for AI Coding Agents

Summary

Casbin Gateway is an open-source desktop and local web gateway for AI coding agents running on a developer’s machine. Built with a Go backend and React frontend, it can discover agents such as Claude Code, Codex CLI, Cursor, Gemini CLI, and opencode, then show their providers, accounts, versions, sessions, skills, MCP servers, prompts, activity, and usage. It provides one endpoint in front of model vendors, supports OpenAI-, Anthropic-, and Gemini-compatible client formats, and translates among the supported wire formats, including streaming responses. Providers can use a stored API key or forward an agent’s existing subscription login; the gateway can also write the relevant agent configuration or expose an environment snippet. Casbin policies control which models, providers, terminal functions, and MCP tools each agent may use, with roughly forty switches per agent and optional custom policy lines. The gateway records relayed requests, including prompts, messages, tool schemas, token counts, and costs, while a separate usage view reads local agent transcripts to include traffic that bypassed the gateway. Recording can be disabled or limited to metadata, and stored bodies are sanitized and size-limited. Its Authenticity feature probes providers with configurable test cases to compare requested and returned models, inspect API behavior, tool schemas, streaming events, caching, billing, and vendor headers, then assigns a score and grade; probes consume provider credit. The project also supports importing providers, MCP servers, prompts, and skills from links, installing and rolling back agents, and running in Docker or Podman, although containers cannot inspect host-installed agents. It binds to localhost by default because the UI signs in locally and stored relay credentials could expose model access; network use requires changing the bind address, setting an admin password, and sending a relay token. The repository is licensed under Apache-2.0 and publishes nightly builds, while source development requires Go 1.25+, Node.js, and Yarn.