Unauth

A local-first AI gateway that routes requests across many LLM providers behind one OpenAI-compatible endpoint. This is a Rust port of OmniRoute — no telemetry, keys encrypted at rest, runs on 127.0.0.1.

Features

• OpenAI-compatible surface — POST /v1/chat/completions (JSON + SSE streaming) and GET /v1/models, so Claude Code, Codex, Cursor, and other OpenAI-compatible clients can point at it directly.
• Multiple wire formats — OpenAI-compatible, Anthropic Messages, and web-cookie executors for Deep Hat (app.deephat.ai) and Qwen Studio (chat.qwen.ai).
• Routing + resilience — 19 routing strategies, circuit breakers, cooldowns, per-model lockouts, automatic fallback across provider tiers.
• Quota + usage — per-window token/cost limits, usage call-log recording.
• Compression — lossless context compression (whitespace cleanup, dedup, CCR).
• Management API — /api/status, /api/connections, /api/combos, /api/models.
• MCP server — unauth --mcp exposes 4 tools over stdio JSON-RPC 2.0.
• WAF bypass for Qwen — optional browser-assisted proxy (tools/waf-proxy.mjs) routes through a logged-in Chromium to pass Alibaba's baxia WAF.

Quick start

# build + test
cargo build --workspace
cargo test --workspace

# scaffold a starter config, then edit it
./target/debug/unauth init
$EDITOR unauth.json

# run the gateway
./target/debug/unauth --config unauth.json

Then talk to it:

curl -H "Authorization: Bearer sk-change-me" http://127.0.0.1:20128/v1/models

Documentation

• RUNBOOK.md — getting started, make targets, config, curl examples, MCP, web-cookie providers, WAF proxy setup, troubleshooting.
• PROVIDERS.md — provider portability matrix, wire-format details, WAF proxy.
• Makefile — make build, make test, make serve, make proxy, make serve-qwen, make fmt, make clippy.

Project layout

crates/
  core/       pure domain: config, types, routing, resilience, compression, combos
  db/         SQLite (sqlx) schema + repositories
  providers/  executors: OpenAI-compat, Anthropic, DeepHat, QwenWeb (+ registry)
  server/     axum HTTP surface: /v1 + /api, authz, gateway orchestration
  mcp/        MCP server over stdio (JSON-RPC 2.0)
  cli/        unauth binary (serve / mcp / init / export / import)
tools/
  waf-proxy.mjs   browser-assisted WAF proxy (Node, zero deps)

License

MIT