Everyapi Ai

> 🌐 English · [简体中文](translations/README.zh-CN.md) · [日本語](translations/README.ja.md) · [한국어](translations/README.ko.md) · [Español](translations/README.es.md) · [Deutsch](translations/README.de.md) · [Français](translations/README.fr.md)

everyapi CLI

Buyer-onboarding CLI for the EveryAPI AI API gateway. Launch supported coding agents through one audited registry in under a minute.

Status: core flows shipped — buyer onboarding, seller commands (plain-key + OAuth across three providers), sanitizer proxy, QR sign-in main path, and anti-phishing layers are all in place. The only unimplemented items are OS-level code signing and a platform keychain backend (see "What this binary does NOT include yet" at the end).

Installation

macOS (Homebrew):

brew tap everyapi-ai/tap && brew install everyapi

Later upgrades — brew update first (without it, brew upgrade everyapi uses the cached formula and reports "already installed" even when a newer release exists):

brew update && brew upgrade everyapi

Linux / macOS (install script):

curl -fsSL https://dl.everyapi.ai/install.sh | bash

The script auto-detects OS + arch, downloads the matching everyapi_{os}_{arch}.tar.gz, verifies the SHA256, and installs to ~/.local/bin (or /usr/local/bin when run as root). If cosign is installed it also verifies the keyless signature — pass --require-signature to make that step mandatory (recommended for CI / supply-chain-sensitive setups).

One command, worldwide: the script picks its download source at runtime — GitHub Releases where reachable, and a mainland-China mirror when GitHub is slow or blocked — so the same line installs from inside China as well as overseas. Set EVERYAPI_DOWNLOAD_BASE to force a specific mirror.

Common flags:

curl -fsSL https://dl.everyapi.ai/install.sh | bash -s -- --version v0.2.2     # pin a version
curl -fsSL https://dl.everyapi.ai/install.sh | bash -s -- --prefix /usr/local  # custom prefix
curl -fsSL https://dl.everyapi.ai/install.sh | bash -s -- --require-signature  # fail if cosign verify fails
curl -fsSL https://dl.everyapi.ai/install.sh | bash -s -- --force              # reinstall the same version

To upgrade later, re-run the same command. The script resolves the latest release tag and replaces the binary in place when a newer one exists; if the installed binary is already at the resolved target version, it exits with already at vX.Y.Z — nothing to do (safe to put in setup scripts / dotfiles). Pass --force to reinstall on top (useful for verifying integrity or recovering a damaged file). The script is also published in this repo at [install.sh](install.sh) if you'd rather download + read it first.

Go users (go install):

go install github.com/everyapi-ai/everyapi-ai/v3@latest

Windows (PowerShell):

irm https://dl.everyapi.ai/install.ps1 | iex

Same flow as the shell script — resolves the latest tag, downloads everyapi_windows_amd64.zip + SHA256SUMS, verifies the hash (and the cosign signature when cosign is on PATH), installs everyapi.exe into %LOCALAPPDATA%\everyapi\bin, and adds it to your User PATH. To pin a version or pass other options, materialize the script first: & ([scriptblock]::Create((irm https://dl.everyapi.ai/install.ps1))) -Version v0.2.2. It's also published in this repo at [install.ps1](install.ps1).

Windows (manual): grab everyapi_windows_amd64.zip (or any other artifact) from the Releases page and verify against SHA256SUMS before placing the binary on %PATH%.

Commands

| Command | Purpose | |---|---| | everyapi auth login | Sign in to EveryAPI on this device | | everyapi auth logout | Clear local credentials | | everyapi auth status | Show balance, usage, quota | | everyapi wallet topup | Open the topup page (with anti-phishing phrase check) | | everyapi use | Set env and exec into a third-party CLI (pointed at EveryAPI) | | everyapi seller | Marketplace seller commands (list / withdraw / add-key / setup) | | everyapi edge | One-command deploy for the BYO-GPU supplier agent (register / start / status / logs / models / stop / update / remove) | | everyapi mcp | Run as an MCP server (stdin/stdout JSON-RPC) | | everyapi update | Check for new versions and print the upgrade command for your install method | | everyapi version | Show build version | | everyapi help | Help |

everyapi use — exec into a third-party CLI (pointed at the EveryAPI gateway)

The main reason to install this CLI. It configures and launches supported coding clients through EveryAPI. Native integrations (antigravity, librefang) keep their own authentication path and never receive a copied relay key.

everyapi use claude         # Claude Code → EveryAPI
everyapi use codex          # OpenAI Codex CLI → EveryAPI
everyapi use opencode       # OpenCode → process-scoped EveryAPI provider
everyapi use gemini         # Google Gemini CLI → EveryAPI
everyapi use antigravity    # Antigravity (native Google auth and routing)
everyapi use aider          # Aider → EveryAPI (pick a model)
everyapi use goose          # Goose CLI → EveryAPI (pick a model)
everyapi use crush          # Crush CLI → isolated EveryAPI catalog
everyapi use cline          # Cline CLI → lifecycle-bound provider settings
everyapi use openclaw       # OpenClaw local TUI → isolated EveryAPI catalog
everyapi use continue       # Continue CLI → isolated assistant config
everyapi use kilo           # Kilo Code CLI → process-scoped provider config
everyapi use pi             # Pi coding agent → isolated models catalog
everyapi use vibe           # Mistral Vibe → isolated generic provider
everyapi use copilot        # GitHub Copilot CLI → official process-scoped BYOK
everyapi use droid          # Factory Droid → isolated runtime settings
everyapi use openhands      # OpenHands CLI → explicit process-only env override
everyapi use forge          # ForgeCode → isolated OpenAI-compatible session
everyapi use llxprt         # LLxprt Code → isolated homes + pinned runtime flags
everyapi use grok           # xAI Grok Build → EveryAPI
everyapi use qwen-code      # Alibaba Qwen Code → EveryAPI (pick a model)
everyapi use kimi-code      # Moonshot Kimi Code → EveryAPI (pick a model)
everyapi use hermes         # Nous Research Hermes Agent → EveryAPI (pick a model)
everyapi use librefang      # LibreFang start (native EveryAPI credential process)
everyapi use hermes --model gpt-5.1   # pin the model, skip the picker
everyapi use claude                    # transparent by default: stays on api.anthropic.com
everyapi use codex                     # stays on api.openai.com
everyapi use antigravity               # stays on Google's official origin
everyapi use claude --transparent=false  # opt out: inject the gateway Base URL + relay key
everyapi use                # no arg → interactive picker over installed tools

Each tool uses different conventions; the CLI remembers them:

| Tool | How it's pointed at EveryAPI | |---|---| | claude | env: ANTHROPIC_BASE_URL, ANTHROPIC_AUTH_TOKEN; live compatible models through gateway discovery | | codex | env: OPENAI_API_KEY + generated CODEX_HOME/config.toml and key-scoped model catalog (codex routes via config, not OPENAI_BASE_URL) | | gemini | env: GEMINI_API_KEY, GOOGLE_GEMINI_BASE_URL, GEMINI_MODEL; isolated auth-mode settings overlay | | antigravity | native Antigravity launcher (agy) | | aider | OpenAI-compatible env plus openai/ LiteLLM model namespace | | goose | GOOSE_PROVIDER=openai, GOOSE_MODEL, OPENAI_API_KEY, OPENAI_BASE_URL | | crush | process-scoped CRUSH_GLOBAL_CONFIG; key referenced from env, live model catalog generated | | cline | lifecycle-bound CLINE_PROVIDER_SETTINGS_PATH removed after exit | | openclaw | local embedded TUI with process-scoped config and env-backed SecretRef | | continue | lifecycle-bound CONTINUE_GLOBAL_DIR/config.yaml; env-backed Continue secret reference | | kilo | process-scoped KILO_CONFIG_CONTENT; OpenCode-compatible provider with env-backed key | | pi | isolated PI_CODING_AGENT_DIR containing models.json and selected-model settings | | vibe | isolated VIBE_HOME/config.toml; generic provider with api_key_env_var | | copilot | official COPILOT_PROVIDER_* BYOK environment; wire API follows the selected model capability | | droid | official --settings runtime-only file with one custom:EveryAPI-0 model and env-backed key | | openhands | --override-with-envs plus process-only LLM_API_KEY, LLM_BASE_URL, and LLM_MODEL | | forge | isolated FORGE_CONFIG; OpenAI-compatible provider/model pinned in config and process env | | llxprt | isolated application homes plus reserved --provider openai, --baseurl, and --model runtime flags | | grok | env: XAI_API_KEY, GROK_MODELS_BASE_URL; isolated GROK_HOME; filtered live model discovery | | qwen-code | env: OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_MODEL; process-scoped QWEN_HOME user settings and pinned --auth-type=openai | | kimi-code | env: KIMI_MODEL_API_KEY, KIMI_MODEL_BASE_URL, KIMI_MODEL_PROVIDER_TYPE, KIMI_MODEL_NAME; isolated KIMI_CODE_HOME with generated model aliases | | hermes | generated HERMES_HOME/config.yaml (named custom provider, base_url, inline api_key); filtered live model discovery | | librefang | native librefang start, which detaches the daemon and returns the terminal (librefang stop ends it); LibreFang resolves the current EveryAPI credential per request |

No more looking up which variable name each tool reads, whether you need to append /v1, or which auth-header style applies.

relay key selection: With no --group, a launch resolves the account's auto-group key — the one key that routes across every group you can reach — and caches it in credentials.json. An account without an auto key (or one whose tier may no longer use that group) falls back to its newest enabled key. Run everyapi token switch to pin a different key as the default, or pass --group for a one-off launch through another pool; a group override is never written to that cache. Which key you are on decides the catalog below: a key pinned to one group only ever sees that group's models.

A key already cached from an earlier launch keeps being used — that lookup is deliberately offline, so it never re-picks on its own. If /model shows one group's models, run everyapi token switch and choose Auto once.

model selection: At launch, EveryAPI fetches the live catalog available to the selected relay key/group, removes incompatible media/embedding protocols, and injects the resulting snapshot into every routed client's native selector. Use /model in Claude Code, Codex, Qwen Code, or Kimi Code; use Grok's /model/models entry or hermes model for Hermes. Non-Claude model IDs are represented internally with Claude-compatible aliases but are displayed and sent upstream under their real IDs.

Tools with a ModelEnv contract (Gemini, Aider, Goose, Crush, Cline, OpenClaw, Continue, Kilo, Pi, Vibe, GitHub Copilot CLI, Factory Droid, OpenHands, ForgeCode, LLxprt, Hermes, Qwen Code, and Kimi Code) open EveryAPI's picker; pass --model to skip it. In a non-interactive run EveryAPI deterministically uses the first compatible model. Plain claude/codex/grok still own their boot-model behavior. antigravity launches native agy with Google authentication and librefang uses its first-party EveryAPI credential process.

Provider names are not CLI names: use qwen-code or kimi-code for those vendors' official clients, and select provider models from a supported client's live model catalog.

hermes config isolation: everyapi use hermes redirects HERMES_HOME to a process-scoped directory under ~/.config/everyapi/sessions; its credential-bearing config and live proxy URL are removed at exit and cannot collide with another key/group. Only the last selected model ID is retained as a safe preference. Your personal ~/.hermes remains untouched. The generated config registers EveryAPI as a named custom provider so hermes model can discover and switch models without falling back to OpenRouter. Bare hermes opens the interactive chat; pass everyapi use hermes -- --tui for the terminal UI.

grok config isolation: everyapi use grok redirects GROK_HOME to ~/.config/everyapi/grok-home. This prevents a cached xAI browser session from overriding the EveryAPI relay key and keeps EveryAPI-routed sessions separate from plain grok. Pass Grok-specific flags after --, for example everyapi use grok -- --model grok-4.5.

Qwen/Kimi config isolation: each routed launch receives a process-scoped home under ~/.config/everyapi/sessions, removed when the child exits, so concurrent keys/groups cannot overwrite one another's catalog or loopback URL. Qwen's real system settings remain untouched and retain administrator precedence. If administrator or workspace settings define modelProviders.openai (and would hide the live EveryAPI catalog), launch stops with an actionable conflict instead of silently showing stale/incompatible models.

> ⚠️ Subprocess env safety note: the env vars above contain your relay API key. Third-party CLIs in debug / verbose mode may log env — before running everyapi use, make sure the debug flag you turn on does not leak *_TOKEN / *_API_KEY. Before sharing debug logs, run sed -i 's/sk-everyapi-[A-Za-z0-9]*/REDACTED/g'.

Transparent connector (default)

Transparent mode keeps supported clients on their vendor's official API origin instead of setting a third-party Base URL. It is the default for every tool that supports it; pass --transparent=false to opt out. The CLI starts an ephemeral HTTP CONNECT proxy on a random loopback port, creates a per-run CA whose private key stays in memory, and gives the child only the proxy URL, public CA bundle, and a non-secret placeholder credential. Registered model routes are decrypted locally and relayed to EveryAPI with the real relay key; other HTTPS hosts use raw CONNECT passthrough. An unknown path beneath a protected model prefix is blocked, and a relay failure never falls back to the vendor.

Verified against Claude Code and Codex CLI, which are the tools it defaults on for. Native Antigravity and LibreFang bypass the connector; the other registered tools use their documented injected/configured path, so an explicit unsupported --transparent fails loudly.

--sanitize composes with transparent mode rather than conflicting with it: the connector relays through the sanitizer (child → connector → sanitizer → gateway), so masking and the Claude recovery response guard apply on either launch path.

If ALL_PROXY is your only proxy variable, transparent mode is declined and the launch falls back to the injected path — Go's proxy resolution never reads ALL_PROXY, so the connector could not honor it. Set HTTPS_PROXY (socks5 included; net/http dials it natively) to keep transparent mode on.

This mode is experimental and intentionally process-scoped:

• the intercepted client side currently uses HTTP/1.1 and supports normal JSON/SSE requests (HTTP/2 gateway responses are translated to HTTP/1.1); client-side HTTP/2, HTTP/3/QUIC, WebSocket, certificate-pinned clients, and clients that ignore HTTPS_PROXY are not covered;
• Codex's built-in OpenAI provider probes the Responses WebSocket once; Connector returns HTTP 426 so Codex immediately falls back to HTTPS/SSE without consuming its retry budget. Codex may still print that single failed-probe log line;
• Claude Code still treats the non-secret placeholder as API-key authentication, so claude.ai connectors are disabled even though ANTHROPIC_BASE_URL is abse

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: everyapi-ai
• Source: everyapi-ai/everyapi-ai
• License: MIT
• Homepage: https://everyapi.ai

Install and usage instructions live in the source repository linked above.