How OmniRoute Works and Whether It Is Safe to Use

In this post

OmniRoute is one of the fastest-growing open-source projects of the year. It was created in February 2026 and today has more than 82,000 stars on GitHub and 250,000 monthly downloads on npm. Its promise is attractive: connect Claude Code, Cursor, Codex or any other tool to hundreds of AI providers through a single endpoint, with automatic fallback when one runs out of quota and more than 150 free tiers. The question is what lies behind it and whether it is worth installing.

What it is

OmniRoute is an AI gateway: a server you install on your own machine that sits between your tools and the model providers. It is free software under the MIT license, written in TypeScript on Next.js, and installed with npm install -g omniroute (OmniRoute, 2026a).

Once running, it opens a dashboard at http://localhost:20128 and an OpenAI-compatible API at http://localhost:20128/v1. Your tools stop talking to Anthropic, OpenAI or Google directly and talk to OmniRoute instead, which decides where to forward each request.

How it works

your toolClaude Code, Cursor, Cline, Codex or any OpenAI-compatible client

localhost:20128/v1OmniRoute picks the model, compresses the context and stores your credentials

1. 1 · Subscriptionterms of serviceClaude Code, Codex, Copilot, Antigravity (OAuth)
2. 2 · API keypay per useAnthropic, OpenAI, Google, Mistral…
3. 3 · Cheapvariable privacylow-cost providers
4. 4 · Freeprompt loggingfree tiers, keyless or with web cookies

Source: OmniRoute README (“tier cascade” diagram). Each tier's label sums up its main risk.

It rests on three pieces:

• Connections. You connect your provider accounts. Depending on the provider, OmniRoute stores an API key, an OAuth token obtained by signing in with your subscription (Claude Code, Codex, GitHub Copilot, Antigravity) or even the cookies of a ChatGPT, Gemini or Copilot web session (OmniRoute, 2026b).
• Combos. A combo is a chain of models. If you choose the auto model, OmniRoute builds the chain on its own and orders it by quality, cost, latency or available quota. There are 20 different routing strategies.
• Resilience and compression. When a provider fails, returns a rate limit or runs out of quota, the combo moves to the next one. The gateway also compresses tool outputs to spend fewer tokens.

The default order is the one in the diagram: first your subscription, then your API keys, then cheap providers and finally the free ones.

Is it safe?

The answer depends on what we mean by “safe.” There are four different risks, and it helps to separate them.

1. The software itself: a recent critical vulnerability

On September 3, 2026, CVE-2026-88062 was published, rated critical. The endpoint that registers custom agents accepted an arbitrary command and ran it to “detect the version” of the agent. With that, an attacker could execute code on the server with a single HTTP request (OmniRoute, 2026c).

The serious part is that authentication was not always required. It was enough for the instance to have login disabled (requireLogin=false), or to be a fresh install that had not yet been given a password. It affects all versions before 3.8.49.

A fixed vulnerability does not make a project unsafe, but it does say something about its attack surface. OmniRoute exposes more than 110 tools over MCP, runs processes, opens browsers with Playwright, has a MITM-style traffic inspection mode and ships new versions almost every week. That is a lot of code with high privileges on your machine.

2. Your credentials

OmniRoute stores the API keys and tokens for all your accounts in a SQLite database. Its documentation says it encrypts them with AES-256-GCM, but with one condition: if the STORAGE_ENCRYPTION_KEY variable is not defined, it enters “passthrough mode” and stores them in plain text (OmniRoute, 2026d). In the .env.example file that variable comes empty.

In other words, a single file can gather the keys to all your AI accounts. If it leaks, or if someone exploits a vulnerability like the one above, they take them all at once.

3. Your accounts and the terms of service

This is the most overlooked risk. Using your subscription's token in a third-party tool is not the same as using an API key.

Anthropic, for example, says so explicitly in the Claude Code documentation. OAuth authentication for the Free, Pro and Max plans is intended for ordinary use of Claude Code and Anthropic's own applications. Developers may not route requests through those plans' credentials, nor collect, store or broker Claude.ai session tokens, and Anthropic reserves the right to enforce these restrictions without notice (Anthropic, 2026). Since January 2026 it blocks, on the server side, subscription tokens used outside Claude Code.

OmniRoute also includes a “TLS stealth” feature: it imitates the TLS fingerprint (JA3 and JA4) of the official clients so that requests look as if they came from them (OmniRoute, 2026a). That feature only makes sense if the provider does not want to receive those requests. The web-cookie integrations are even more fragile, because they use your browser session as if you were typing on the page.

The project partly acknowledges this: it marks some providers with the tos: avoid tag and excludes them from automatic routing (OmniRoute, 2026e). But the responsibility stays with you. If the provider suspends your account, it is your account that you lose.

4. The privacy of your code

With the auto model, you do not decide where each request goes, the router does. If your subscription runs out of quota in the middle of a task, your code may end up with a free provider whose terms you never read. OmniRoute's free tiers guide makes this clear with an example: one of the free providers logs all requests for research purposes (OmniRoute, 2026e). For a personal project it may not matter. For a client's code or your company's, it does.

How to use it carefully

If you still decide to try it, these measures reduce the risk considerably:

1. Update. Use at least version 3.8.49, preferably the latest.
2. Set a password from the first launch and never disable requireLogin.
3. Don't expose it to the internet. Keep it listening only on localhost. If you need it on a server, put it behind a VPN, not an open port.
4. Define STORAGE_ENCRYPTION_KEY before connecting any account, for example with openssl rand -hex 32.
5. Prefer API keys to subscription tokens and web cookies. That way you respect the provider's terms and pay only for what you use.
6. Pin providers instead of using auto when you work with private code, and leave out the free tiers that log requests.
7. Isolate it. Running it in Docker limits what an attacker could reach if they find another vulnerability.

Conclusion

OmniRoute solves a real problem, managing many providers and usage limits from one place, and it does so with ambitious engineering. But “free” and “safe” are not the same thing. As a gateway with your own API keys, properly configured and never leaving your machine, it is a reasonable tool. As a way to squeeze subscriptions and web sessions beyond what their terms allow, the risk lies less in the code than in your accounts.

References

• Anthropic (2026). “Legal and compliance: Authentication and credential use.” Claude Code Docs. View online.
• OmniRoute (2026a). README, version 3.8.52. View online.
• OmniRoute (2026b). Provider Reference. View online.
• OmniRoute (2026c). “OmniRoute ACP Custom-Agent Remote Code Execution (RCE),” GHSA-hf57-cqmx-p4gr, CVE-2026-88062. View online.
• OmniRoute (2026d). Security Policy. View online.
• OmniRoute (2026e). Free Tiers Guide. View online.

Scripture quotations are from the ESV® Bible (The Holy Bible, English Standard Version®), copyright © 2001 by Crossway, a publishing ministry of Good News Publishers. Used by permission. All rights reserved.