OmniRoute

Verify before installing

Socket.dev blocked the omniroute npm package at v3.8.5 in May 2026, flagging possible malware, obfuscated code and install scripts. No malware was confirmed, and the maintainer fixed two real vulnerabilities in v3.8.6. The repo now carries a socket.yml. I treat this as unresolved. If I run it, it goes in a container and never on my main machine. My source for the Socket.dev history is a third-party review site, so confirm it at Socket.dev before acting either way.

Verdict. The engineering is deep and the marketing is aggressive. Discount each separately. The compression pipeline is the part I’d study, whether or not I ever run the gateway.

what it is

A self-hosted gateway that puts one OpenAI-compatible endpoint in front of about 350 providers, fails over between them (weighted heavily toward free tiers), and compresses tokens in transit.

It runs a local server on localhost:20128 exposing /v1 in OpenAI, Claude, Gemini and Responses dialects. Point Claude Code, Cursor, Cline or Codex at it and a router cascades each request through four tiers (subscription, API key, cheap, free) with circuit breakers, key cooldown and model lockout. Every request also passes through a 12-engine compression pipeline, with code, URLs and JSON kept byte-perfect.

It ships as an npm package, Docker image, Electron app, PWA, Android build, Next.js dashboard, an 80+ command CLI, an MCP server with 110 tools, and an A2A endpoint.

what I found

Stars	53,834 (7,364 forks), GitHub API, 2026-08-23
Commits	7,480 on the default branch, about 417 contributors
Size	15,089 files, about 428 MB
Tests	5,614 test paths. Vitest, Playwright, Stryker mutation testing, promptfoo, SonarQube, gitleaks
Default branch	release/v3.8.50, not main

• The README claims 78 to 95% compression on mixed prompts and tool logs. If that’s even roughly true, it changes the cost of agent runs.
• The README is about 115 KB of banners, badges, sponsor tables and community links.
• Sponsor links carry affiliate tags.
• The README says 450+ contributors. The API says 417.
• The headline figures (about 1.51B free tokens a month, “25,000+ tests,” about 89% average compression) are self-published.
• It uses wreq-js for TLS fingerprint impersonation. That’s a provider terms-of-service question before it’s a technical one, and the README itself flags 15 providers as questionable “for the user to judge.”
• A default branch named release/v3.8.50 makes provenance harder to reason about.