More than 40 providers feed one local endpoint
9Router documents more than 40 providers behind a local OpenAI-compatible address used by Claude Code, Codex, Cursor, Cline, and other coding clients. It translates between OpenAI, Anthropic, Gemini, and several provider-specific formats. A combo can try a subscription first, move to a cheaper API, and then use a free tier. The dashboard also tracks quotas, rotates multiple accounts, records usage, and can compress tool results before forwarding a request.
That scope makes 9Router much larger than a small proxy. Our measured checkout contained 1,506 files, about 168,992 lines of source, and occupied 11.3 MB before installation. It includes a Next.js dashboard, a custom server, SQLite state, OAuth flows, API-key handling, format translators, fallback policy, MCP plugin routes, Docker assets, and cloud-sync hooks. Each part may be reasonable alone, but together they make this a credential-holding application that deserves the same review as any internal gateway.
What happened when we ran it
Our sandbox installed 871 npm packages in 99 seconds and used 680 MB on disk. The production build then succeeded in 80 seconds. Npm audit reported 2 known vulnerabilities, both moderate, with 0 critical, 0 high, and 0 low findings. Those results came from commit 90b52e0 in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node.js 22, and no secrets.
The repository exposed no test script or target to our harness, so we skipped tests. That gap matters because the same checkout had a tests directory, 2 CI workflow files, a Dockerfile, and a Compose file. We did not connect a provider, send model traffic, or measure token compression. The 99-second install and 80-second build prove that this revision installed and compiled in our box; they do not prove that every translated tool call survives a fallback.
Two open Claude Code reports show the fallback boundary
Open issues 3692 and 3690 describe specific Claude Code failures in version 0.5.59. Issue 3692 says a fallback to a non-Anthropic provider can stamp the upstream model name into the response, which then prevents Claude Code from restoring that session normally. Issue 3690 reports that the client's [1m] model suffix is rejected as an invalid model format. Both concern the translation layer that makes 9Router useful, rather than an optional dashboard detail.
A codebase of roughly 168,992 source lines can support many integrations, yet size also gives provider changes more places to land. The safe adoption test is a recorded task set covering streaming, images, tool calls, reasoning settings, retries, and session resume for each client-provider pair you intend to use. Automatic fallback is valuable only when the replacement route preserves the request and response details the client needs. A successful HTTP response can still carry the wrong model identity or omit a field.
Three permissive defaults turn a VPS install into a hardening job
The README lists INITIAL_PASSWORD=123456, REQUIRE_API_KEY=false, and AUTH_COOKIE_SECURE=false as defaults, while its VPS example binds the server to 0.0.0.0. It does tell operators to set secrets, and the dashboard blocks some remote use of the default password. Even so, a copied deployment can hold OAuth refresh tokens, API keys, provider usage data, and local routing policy. Keep it on loopback until TLS, authentication, backups, and log handling are deliberate.
Open pull requests 3497, 3498, 3502, and 3503 address SSRF checks, MCP endpoint authentication, provider-data access, and operational control routes. They were still unmerged when fetched on September 1, 2026. Our npm audit's 2 moderate findings cover installed package advisories, not these application-level reports. Do not combine those signals into one vulnerability count. Review the chosen commit and the status of each patch before exposing a port or importing valuable credentials.
Free routes have quotas, expiring credits, and changing model lists
The free story needs a careful read. The README describes Kiro as roughly 50 credits per month, says OpenCode's free model list can change without notice, and limits the cited Vertex credit to new accounts for 90 days. A later Kiro setup block calls usage unlimited, which conflicts with the earlier cap. 9Router can move between available routes, but it cannot guarantee that another company's free allowance, model catalog, or OAuth policy will remain available.
Running the switchboard also has a local cost before any model answers. Our install added 871 packages and 680 MB to an 11.3 MB checkout. SQLite keeps provider connections, combos, aliases, keys, settings, and usage history in the data directory, so backup and file permissions matter. Full request logging is optional and should stay off unless you need it, because prompts, tool output, and provider responses can contain repository data that does not belong in a long-lived log.
1,027 open issues make current activity a mixed signal
GitHub showed 26,865 stars, 1,027 open issues, and 864 open pull requests on September 1, 2026. The last push was August 29, and new issues arrived on September 1, so the project is plainly active. Its latest GitHub release was v0.5.35 on July 16, while the measured source package identified itself as v0.5.59. The older release tag is no abandonment signal, though the enormous queue makes it harder to tell which reports have maintainer attention.
A personal gateway is the sensible starting point. The 80-second successful build makes a trial easy enough, but the missing test target leaves our run without regression evidence for a system that rewrites model traffic. Use expendable credentials, pin the revision, keep the listener private, and replay real coding tasks before moving a paid account behind it. If you only use one API provider, 871 packages and a 680 MB install buy more control surface than most people need.