LLM CLI Gateway
NPM · LLM-CLI-GATEWAY
One MCP endpoint for Claude Code, Codex, Gemini, Grok and Mistral CLIs, with durable async jobs.
Available components
Last scanned (1 hour ago)
Scores higher than 72% of npm servers
Category AI and Machine Learning
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security80
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 51 of 130 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to verivus-oss/llm-cli-gateway). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 57 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability73
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 6187 tokens (~147/item across 42 items; 28 tools + 14 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage33
- 0% of tools have a non-trivial description (not blank, and not just the tool's name).Fail
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "session_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Stability: 0.97 → pass security
- 3 Nov 26 0
- Stability: pass → 0.97 functional
- 28 Oct 26 0
- Stability: 0.97 → pass security
- 27 Oct 26 0
- Stability: pass → 0.97 functional
- 24 Oct 26 −6
- CVE-2023-54404 affects this package: high ▼ security
- Known CVEs: pass → fail ▼ security
- 21 Oct 26 +1
- Stability: 0.97 → pass security
- 19 Oct 26 −1
- Stability: pass → 0.93 functional
- 17 Oct 26 +3
- Stability: 0.83 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/llm-cli-gateway@1.17.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | verivus-oss/llm-cli-gateway |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/verivus-oss/llm-cli-gateway/.github/workflows/npm-publish.yml@refs/tags/v1.17.1 |
| Rekor log index | 1672988373 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:c20f42a183baf3c2b523c2b02cb7a3a2ed182e762841c1046bc1d9bc60b1a45a75e4caaa7440eaa2295a1d48c97b0b81c61923de1a330f3ba198f2e54 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 130 packages
| Packages resolved | 130 |
|---|---|
| Deprecated | 1 |
| Stale | 50 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
approval_list ~27
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | Optional CLI filter |
| limit | integer | – | Max number of approval records |
No output schema declared.
No examples provided.
ask_model ~26
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| model | string | – | Provider to ask. |
| question | string | yes | Question for one provider. |
No output schema declared.
No examples provided.
claude_request ~1,118
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| addDir | array | – | Claude --add-dir: additional directories the CLI is allowed to read/write beyond the process cwd. Each entry is emitted as its own --add-dir instance. |
| agent | string | – | Claude --agent: dispatch to a named single sub-agent. |
| agents | object | – | Claude --agents: inline JSON map of agent name → { description, prompt, tools?, model? }. |
| allowedTools | array | – | Allowed tools (['Bash(git:*)','Edit','Write']) |
| appendSystemPrompt | string | – | Claude --append-system-prompt: append to the existing system prompt. |
| approvalPolicy | string | – | Approval policy override |
| approvalStrategy | string | – | Approval strategy |
| continueSession | boolean | – | Continue active session |
| correlationId | string | – | Request trace ID (auto if omitted) |
| createNewSession | boolean | – | Force new session |
| dangerouslySkipPermissions | boolean | – | DEPRECATED: prefer `permissionMode: "bypassPermissions"`. Maps to it when `permissionMode` is unset. |
| disallowedTools | array | – | Disallowed tools |
| effort | string | – | Claude --effort: low|medium|high|xhigh|max. |
| excludeDynamicSystemPromptSections | boolean | – | Claude --exclude-dynamic-system-prompt-sections: trim dynamic context blocks from the system prompt. |
| fallbackModel | string | – | Claude --fallback-model: model name to auto-fallback to when the default model is overloaded (effective only with --print, which the gateway always uses). |
| forceRefresh | boolean | – | Bypass dedup and force a fresh CLI run even if a recent identical request exists |
| forkSession | boolean | – | Claude --fork-session: branch from an existing session into a fresh fork. |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| jsonSchema | – | – | Claude --json-schema: JSON Schema literal (NOT a path) constraining structured output. Object values are JSON.stringify-d; string values are passed verbatim. Use with outputFormat='json'. |
| maxBudgetUsd | number | – | Claude --max-budget-usd: spend cap for this request in USD. |
| maxTurns | integer | – | Claude --max-turns: cap on agent loop iterations. |
| mcpServers | array | – | MCP servers exposed to Claude |
| model | string | – | Model name or alias (e.g. sonnet, claude-sonnet-4-5-20250929, latest) |
| optimizePrompt | boolean | – | Optimize prompt before execution |
| optimizeResponse | boolean | – | Optimize response output |
| outputFormat | string | – | Output format (text|json|stream-json). DEFAULT: stream-json — the gateway parses NDJSON usage events to extract input/output/cache_read/cache_creation tokens + cost + model, persists them to the flig… |
| permissionMode | string | – | Claude --permission-mode: default|acceptEdits|plan|auto|dontAsk|bypassPermissions. `default` is a no-op (no flag emitted). |
| prompt | string | – | Prompt text for Claude (mutually exclusive with promptParts) |
| promptParts | object | – | Cache-aware structured prompt: { system?, tools?, context?, task, cacheControl? }. Use for repeated calls that share a stable prefix — `system`/`tools`/`context` are the stable head; `task` is the vo… |
| sessionId | string | – | Session ID (uses active if omitted) |
| strictMcpConfig | boolean | – | Restrict Claude to provided MCP config only |
| systemPrompt | string | – | Claude --system-prompt: replace the system prompt entirely. |
| worktree | – | – | Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller… |
No output schema declared.
No examples provided.
cli_upgrade ~67
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | yes | CLI to upgrade |
| dryRun | boolean | – | When true, return the upgrade plan without running it |
| target | string | – | Package tag/version/target to install (default: latest) |
| timeoutMs | integer | – | Upgrade timeout in ms when dryRun=false |
No output schema declared.
No examples provided.
cli_versions ~30
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | CLI filter (claude|codex|gemini|grok|mistral) |
No output schema declared.
No examples provided.
codex_fork_session ~183
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| askForApproval | string | – | Codex --ask-for-approval: untrusted|on-request|never. |
| correlationId | string | – | Request trace ID (auto if omitted) |
| forkLast | boolean | – | Fork from the most recent Codex session. Mutually exclusive with `sessionId`. |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| model | string | – | Model name or alias (e.g. gpt-5.5, latest) |
| prompt | string | yes | Prompt text for the forked Codex session |
| sandboxMode | string | – | Codex --sandbox: read-only|workspace-write|danger-full-access. |
| sessionId | string | – | Codex session UUID to fork from. Mutually exclusive with `forkLast`. |
No output schema declared.
No examples provided.
codex_request ~1,014
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| addDir | array | – | Codex --add-dir <DIR>: additional writable workspace directories. Emitted once per entry on new sessions only; resume inherits the original session's writable-dir policy. |
| approvalPolicy | string | – | Approval policy override |
| approvalStrategy | string | – | Approval strategy |
| askForApproval | string | – | Codex --ask-for-approval: untrusted|on-request|never. |
| configOverrides | object | – | Codex -c key=value overrides. Keys: /^[a-zA-Z0-9._]+$/. Values: no CR/LF. |
| correlationId | string | – | Request trace ID (auto if omitted) |
| createNewSession | boolean | – | Force a fresh session (no resume) |
| dangerouslyBypassApprovalsAndSandbox | boolean | – | Run Codex without approvals/sandbox |
| ephemeral | boolean | – | Codex --ephemeral: do not persist the session to disk. |
| forceRefresh | boolean | – | Bypass dedup and force a fresh CLI run even if a recent identical request exists |
| fullAuto | boolean | – | DEPRECATED: prefer `sandboxMode` + `askForApproval`. Expands to `--sandbox workspace-write --ask-for-approval never`. |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| ignoreRules | boolean | – | Codex --ignore-rules: skip project rule files for this run. |
| ignoreUserConfig | boolean | – | Codex --ignore-user-config: ignore ~/.codex/config.toml for this run. |
| images | array | – | Codex -i <path>: image attachments. Each path must exist; missing paths fail fast. |
| mcpServers | array | – | MCP server names for approval tracking (Codex manages its own MCP config) |
| model | string | – | Model name or alias (e.g. gpt-5.4, latest) |
| optimizePrompt | boolean | – | Optimize prompt before execution |
| optimizeResponse | boolean | – | Optimize response output |
| outputFormat | string | – | Codex output format. `json` emits --json (JSONL events) so token usage and cost are parsed and reported in the flight recorder. `text` is the default. |
| outputSchema | – | – | Codex --output-schema. Pass a path (string) or an inline JSON Schema object; object is materialised to a 0o600 temp file under os.tmpdir() and deleted after the run. |
| profile | string | – | Codex --profile <name>: select a profile from ~/.codex/config.toml. |
| prompt | string | – | Prompt text for Codex (mutually exclusive with promptParts) |
| promptParts | object | – | Cache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking. |
| resumeLatest | boolean | – | Resume the most recent Codex session in the current cwd via `codex exec resume --last`. Ignored if sessionId is set. |
| sandboxMode | string | – | Codex --sandbox: read-only|workspace-write|danger-full-access. |
| search | boolean | – | Emit Codex --search to enable web search. |
| sessionId | string | – | Codex session UUID to resume via `codex exec resume <ID>`. Must be a real Codex session ID (from `~/.codex/sessions/` or the `codex resume` picker). Gateway-generated `gw-*` IDs are rejected. |
| useLegacyFullAutoFlag | boolean | – | Escape hatch: emit `--full-auto` directly instead of expanding (deprecated). |
| workingDir | string | – | Codex -C/--cd <DIR>: working root for this session. Emitted on new sessions only; resume inherits the original session's cwd via CODEX_RESUME_FILTERED_FLAGS. |
| worktree | – | – | Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller… |
No output schema declared.
No examples provided.
compare_answers ~30
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| answers | array | yes | Two or more answers to compare. |
| question | string | yes | Question the answers respond to. |
No output schema declared.
No examples provided.
consensus_check ~31
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| claim | string | yes | Claim to check across providers. |
| models | array | – | Providers to ask for agreement or disagreement. |
No output schema declared.
No examples provided.
gemini_request ~728
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| adminPolicyFiles | array | – | Admin policy file paths (--admin-policy <path>, one per file). Paths must exist. |
| allowedTools | array | – | Allowed tools (['Write','Edit','Bash']) |
| approvalMode | string | – | Approval: default|auto_edit|yolo|plan |
| approvalPolicy | string | – | Approval policy override |
| approvalStrategy | string | – | Approval strategy |
| attachments | array | – | Absolute file paths prepended as @<path> tokens to the prompt |
| correlationId | string | – | Request trace ID (auto if omitted) |
| createNewSession | boolean | – | Force new session |
| forceRefresh | boolean | – | Bypass dedup and force a fresh CLI run even if a recent identical request exists |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| includeDirs | array | – | Additional workspace directories |
| mcpServers | array | – | MCP server names passed to Gemini as --allowed-mcp-server-names |
| model | string | – | Model name or alias (e.g. gemini-3-pro-preview, gemini-2.5-flash, pro, flash, latest) |
| optimizePrompt | boolean | – | Optimize prompt before execution |
| optimizeResponse | boolean | – | Optimize response output |
| outputFormat | string | – | Gemini output format. `json` emits `-o json` (single JSON with usageMetadata). `stream-json` emits `-o stream-json` (NDJSON event stream — `init`/`message`/`result` lines, usage extracted from the te… |
| policyFiles | array | – | Policy file paths (--policy <path>, one per file). Paths must exist. |
| prompt | string | – | Prompt text for Gemini (mutually exclusive with promptParts) |
| promptParts | object | – | Cache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking. |
| resumeLatest | boolean | – | Resume latest session |
| sandbox | boolean | – | Run Gemini in sandbox mode (-s) |
| sessionId | string | – | Session ID or 'latest' |
| skipTrust | boolean | – | Emit `--skip-trust` so Gemini trusts the workspace for this session and skips the interactive trust prompt (Phase 4 slice γ). Required for headless runs in fresh workspaces. |
| worktree | – | – | Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller… |
No output schema declared.
No examples provided.
grok_request ~943
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| allow | array | – | Grok --allow <RULE>: permission allow rules. Each entry is emitted as its own --allow instance (per `grok --help`: "Repeat to add multiple rules"). |
| allowedTools | array | – | Allowed built-in tools (passed as --tools comma list) |
| alwaysApprove | boolean | – | Auto-approve all tool executions (--always-approve) |
| approvalPolicy | string | – | Approval policy override |
| approvalStrategy | string | – | Approval strategy |
| correlationId | string | – | Request trace ID (auto if omitted) |
| createNewSession | boolean | – | Force new session |
| deny | array | – | Grok --deny <RULE>: permission deny rules. Each entry is emitted as its own --deny instance (per `grok --help`: "Repeat to add multiple rules"). |
| disallowedTools | array | – | Disallowed built-in tools (passed as --disallowed-tools comma list) |
| effort | string | – | Grok effort level |
| forceRefresh | boolean | – | Bypass dedup and force a fresh CLI run even if a recent identical request exists |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| maxTurns | integer | – | Grok `--max-turns N`: cap on agent-loop iterations for cost / latency control (Phase 4 slice δ). Bounded to safe integers ≤ 10000. |
| mcpServers | array | – | MCP server names for approval tracking (Grok manages its own MCP config via `grok mcp`) |
| model | string | – | Model name or alias (e.g. grok-build, latest) |
| optimizePrompt | boolean | – | Optimize prompt before execution |
| optimizeResponse | boolean | – | Optimize response output |
| outputFormat | string | – | Output format (plain|json|streaming-json). Grok default is plain. |
| permissionMode | string | – | Grok permission mode |
| prompt | string | – | Prompt text for Grok (mutually exclusive with promptParts) |
| promptParts | object | – | Cache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking. |
| reasoningEffort | string | – | Reasoning effort for reasoning models |
| resumeLatest | boolean | – | Resume most recent Grok session in cwd (--continue) |
| rules | string | – | Grok --rules <RULES>: extra rules to append to the system prompt. Supports `@file` prefix per `grok --help` to load from a file; gateway passes the value verbatim and lets Grok parse the prefix. |
| sandbox | string | – | Grok --sandbox <PROFILE>: sandbox profile for filesystem and network access. Freeform per `grok --help` (no enum constraint on Grok 0.1.210); also settable via GROK_SANDBOX env var. Caller responsibi… |
| sessionId | string | – | Session ID (user-provided CLI handle for --resume) |
| systemPromptOverride | string | – | Grok --system-prompt-override <PROMPT>: replace the agent's system prompt entirely. Distinct from Claude's --system-prompt / --append-system-prompt (Grok has only one override flag, not a pair). |
| workingDir | string | – | Grok --cwd <DIR>: working directory for this invocation. Lets headless callers run Grok against a directory other than the gateway process's cwd. |
| worktree | – | – | Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller… |
No output schema declared.
No examples provided.
job_result ~45
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | Validation job ID. |
| maxChars | integer | – | Maximum result size. |
| provider | string | – | Provider that produced the job, used for normalized validation output. |
No output schema declared.
No examples provided.
job_status ~16
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| jobId | string | yes | Validation job ID. |
No output schema declared.
No examples provided.
list_available_models ~6
No description provided.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_models ~30
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | CLI filter (claude|codex|gemini|grok|mistral) |
No output schema declared.
No examples provided.
llm_process_health ~7
No description provided.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
mistral_request ~943
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| addDir | array | – | Vibe --add-dir <DIR>: additional writable workspace directories. Each entry is emitted as its own --add-dir instance (Vibe states this flag may be specified multiple times). |
| allowedTools | array | – | Allowlist of built-in tools — each emitted as a separate --enabled-tools <tool> flag |
| approvalPolicy | string | – | Approval policy override |
| approvalStrategy | string | – | Approval strategy |
| correlationId | string | – | Request trace ID (auto if omitted) |
| createNewSession | boolean | – | Force new session |
| disallowedTools | array | – | Accepted for caller parity; Vibe has no deny-list flag, so values are ignored (a warning is logged). |
| effort | string | – | Vibe effort level |
| forceRefresh | boolean | – | Bypass dedup and force a fresh CLI run even if a recent identical request exists |
| idleTimeoutMs | integer | – | Idle timeout in ms (min 30s, max 1h, omit=CLI default) |
| maxPrice | number | – | Vibe `--max-price DOLLARS`: interrupt the session when cumulative cost crosses this cap (programmatic mode only, Phase 4 slice δ). Bounded to finite values ≤ 10000 USD. |
| maxTokens | integer | – | Vibe `--max-tokens N`: cap cumulative prompt + completion tokens for the session (programmatic mode only). Bounded to safe integers ≤ 100000000. |
| maxTurns | integer | – | Vibe `--max-turns N`: cap the agent-loop iteration count (programmatic mode only, Phase 4 slice δ). Bounded to safe integers ≤ 10000. |
| mcpServers | array | – | MCP server names for approval tracking (Vibe manages its own MCP config via `vibe mcp`) |
| model | string | – | Model alias (e.g. mistral-medium-3.5, latest). Resolved alias is injected via VIBE_ACTIVE_MODEL env var; Vibe has no --model flag. |
| optimizePrompt | boolean | – | Optimize prompt before execution |
| optimizeResponse | boolean | – | Optimize response output |
| outputFormat | string | – | Output format for Vibe 2.x (text|json|streaming). Legacy aliases plain→text and stream-json→streaming are accepted. |
| permissionMode | string | – | Vibe agent mode (default|plan|accept-edits|auto-approve|chat|explore|lean). Defaults to auto-approve for programmatic use. |
| prompt | string | – | Prompt text for Mistral Vibe (mutually exclusive with promptParts) |
| promptParts | object | – | Cache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking. |
| reasoningEffort | string | – | Reasoning effort for reasoning models |
| resumeLatest | boolean | – | Resume most recent Vibe session in cwd (--continue) |
| sessionId | string | – | Session ID (user-provided CLI handle for --resume). Current Vibe defaults session logging on; doctor flags explicit [session_logging] enabled = false. |
| trust | boolean | – | Emit `--trust` so Vibe trusts the cwd for this invocation only (not persisted to trusted_folders.toml) and skips the interactive trust prompt (Phase 4 slice γ). |
| workingDir | string | – | Vibe --workdir <DIR>: change to this directory before running. Single value (Vibe accepts one --workdir per invocation). |
| worktree | – | – | Slice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller… |
No output schema declared.
No examples provided.
red_team_review ~47
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| content | string | yes | Plan, answer, or document to challenge. |
| models | array | – | Providers to ask for adversarial review. |
| riskLevel | string | – | How aggressively to review. |
No output schema declared.
No examples provided.
second_opinion ~42
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| answer | string | yes | Answer to review. |
| model | string | – | Provider to ask for the second opinion. |
| question | string | – | Original question, if available. |
No output schema declared.
No examples provided.
session_clear_all ~31
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | CLI filter (claude|codex|gemini|grok|mistral) |
No output schema declared.
No examples provided.
session_create ~52
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | yes | CLI type (claude|codex|gemini|grok|mistral) |
| description | string | – | Session description |
| setAsActive | boolean | – | Set as active session |
No output schema declared.
No examples provided.
session_delete ~15
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
No output schema declared.
No examples provided.
session_get ~15
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| sessionId | string | yes | Session ID |
No output schema declared.
No examples provided.
session_list ~30
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | CLI filter (claude|codex|gemini|grok|mistral) |
No output schema declared.
No examples provided.
session_set_active ~46
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | yes | CLI type (claude|codex|gemini|grok|mistral) |
| sessionId | string|null | yes | Session ID (null to clear) |
No output schema declared.
No examples provided.
synthesize_validation ~45
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| judgeModel | – | – | Provider to run the judge synthesis. |
| providerResults | array | yes | Terminal normalized provider results from job_result. |
| question | string | yes | Original request that was validated. |
No output schema declared.
No examples provided.
upstream_contracts ~51
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| cli | string | – | CLI filter (claude|codex|gemini|grok|mistral) |
| probeInstalled | boolean | – | When true, run local --help probes and compare advertised flags |
No output schema declared.
No examples provided.
validate_with_models ~63
No description provided.
| Name | Type | Req | Description |
|---|---|---|---|
| focus | string | – | What reviewers should pay attention to. |
| judgeModel | – | – | Optional provider to run an explicit judge synthesis job. |
| models | array | – | Providers to ask. Defaults to Claude and Codex. |
| question | string | yes | Question or content to validate. |
No output schema declared.
No examples provided.
How do I install the LLM CLI Gateway MCP server?
LLM CLI Gateway runs locally as an npm package, launched with npx -y llm-cli-gateway. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · llm-cli-gateway
claude mcp add verivus-oss-llm-cli-gateway -- npx -y llm-cli-gateway
What is the LLM CLI Gateway MCP server?
LLM CLI Gateway is an MCP server listed in the public MCP registry as io.github.verivus-oss/llm-cli-gateway. One MCP endpoint for Claude Code, Codex, Gemini, Grok and Mistral CLIs, with durable async jobs. This page covers its npm package (llm-cli-gateway).
Is the LLM CLI Gateway MCP server safe to use?
LLM CLI Gateway scores 82 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the LLM CLI Gateway MCP server expose?
LLM CLI Gateway exposes 28 tools: validate_with_models, second_opinion, compare_answers, red_team_review, consensus_check, and 23 more. Their descriptions and schemas cost roughly 5,681 tokens of context every time the server is loaded.
Is the LLM CLI Gateway MCP server still maintained?
LLM CLI Gateway is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the LLM CLI Gateway MCP server under?
LLM CLI Gateway declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.