One local endpoint can hold every provider credential
9Router listens on an OpenAI-compatible endpoint, normally http://localhost:20128/v1, and sends requests to a selected model provider. Its dashboard connects OAuth subscriptions and API-key accounts, tracks quotas, rotates accounts, and orders fallbacks. Coding tools such as Claude Code, Codex, Cursor, OpenCode, and Cline then use the router's local API key instead of direct provider settings.
That arrangement is convenient and security sensitive. A compromise of the router, its database, browser session, backup, or host can expose several provider relationships at once. The README explains connection steps and multi-account behavior, but operators still need to restrict the listening address, protect local storage, control dashboard access, redact logs, and decide which subscription uses are acceptable under each provider's terms.
What happened when we ran it
Our sandbox installed 871 npm packages in 182 seconds and occupied 675 MB. The production build succeeded in 124 seconds. The package exposed no test script or target, so tests were skipped. That absence is notable because our scan found a tests directory, a Dockerfile, a Compose file, and 2 CI workflow files.
Npm audit reported 2 known vulnerabilities, both moderate, with 0 critical, 0 high, and 0 low findings. The checkout at commit 699edac held 1,481 files, about 164,019 lines of source, and occupied 11.2 MB before dependencies. We used an unprivileged Debian container with 3 CPUs and 8 GB of RAM.
The lab did not connect a provider account, send a model request, or measure the advertised 20 to 40 percent token reduction. It also did not exercise OAuth refresh, budget exhaustion, round-robin accounts, or fallback. A successful 124-second Next.js build confirms that the source compiled in our environment. It does not validate the routing semantics that decide whether an agent receives the right tool calls and images.
Token compression changes the request itself
The RTK token saver compresses tool-result content before forwarding it. Large git diffs, searches, and directory listings can consume a sizable context window, so removing redundant output may save money and preserve room for later turns. The README also documents a request header that bypasses token saving, which is important when exact tool output matters more than cost.
The advertised percentage is a project claim, not our benchmark. Savings depend on tool output, model tokenizer, compression mode, and how much discarded text the agent later needs. Test it with recorded tasks and compare task completion, retries, token counts, and diffs. A smaller prompt that causes another repository search may cost more overall and can produce a worse change.
Format translation is the highest-risk feature
9Router translates between OpenAI and Claude request shapes so one client can reach many providers. That includes messages, tool calls, reasoning controls, images, model names, and streamed responses. Small mismatches can be hard to spot because the HTTP request succeeds while a field is dropped or transformed. Automatic fallback adds another variable by moving a turn to a different model family.
Current issue activity gives concrete examples. Issue 3568 says a Qwen vision route drops an image and forces a non-vision fallback. Issue 3572 reports a provider rejecting the xhigh reasoning value. Issue 3571 says a safety guard can skip Codex Responses agentic turns. These reports do not cover every route, but they justify an acceptance suite for the exact client, provider, model, and tools a team plans to use.
Source setup is heavier than the global package pitch
The quick route is a global npm install followed by opening the dashboard. Source development copies .env.example, installs dependencies, sets port 20128 and NEXT_PUBLIC_BASE_URL, then runs the Next.js development or production command. Docker images and Compose offer another route. The repository package is described as private, so source and container execution follow different packaging assumptions from the public 9router command.
A long README covers more than 40 providers, more than 100 models, and many coding clients. It is written primarily in English and links translations for Portuguese, Vietnamese, Chinese, Japanese, Russian, Thai, Persian, Indonesian, Spanish, and French. Coverage is broad, but provider authentication details can change faster than a central guide. Validate the current flow before distributing team instructions.
Active issues continue after the July release
Release v0.5.35 was published July 16, 2026 with video generation, Copilot Claude routing, quota controls, translator changes, and fixes. GitHub's repository pushed_at value was August 14, while issues and pull requests were updated on August 27. The project had 26,427 stars and 1,828 combined open issues and pull requests. The issue activity prevents a stale-release claim, and the large queue still deserves triage review.
9Router solves a genuine power-user problem, but it occupies a privileged point between an agent and every model it calls. Our clean build makes a local trial reasonable. The missing test target, 2 moderate audit findings, and live translation reports mean that trial should use expendable credentials and recorded tasks before the proxy is trusted with paid accounts or production code.