What Is 9Router? Understand the Gateway Before Routing Your Accounts
9Router places a local gateway between Claude Code, Codex, Cursor, and multiple model providers. The two-command startup is the least important part: the real questions are how requests switch providers, where credentials are stored, and which connection modes can trigger upstream account controls.
Short Verdict
9Router is worth studying, but your primary work accounts and private company code should not be its first test data.
Its strongest feature is consolidating AI coding clients, provider protocols, and upstream accounts behind one local endpoint. Its largest security consequence is that the same endpoint can see complete prompts, API keys, OAuth refresh tokens, and every fallback decision.
| Scenario | Verdict |
|---|---|
| Testing several legitimately obtained, low-privilege API keys | Good fit |
| Evaluating protocol translation and fallback in a personal sandbox | Good fit |
| Pooling primary Claude, Codex, or Google subscription accounts | High risk; verify upstream rules first |
| Processing company secrets, client data, or regulated data | Do not adopt without a real security review |
| Requiring every request to stay on one model and data processor | Do not enable cross-provider fallback |
This page was verified on July 20, 2026. 9Router changes quickly, so provider availability, free tiers, and model names should be checked against the current README and release.
What 9Router Actually Is
9Router is a self-hosted LLM gateway. Instead of calling one model company directly, Claude Code, Codex, Cursor, Cline, OpenCode, and other clients call a compatible local endpoint. The gateway resolves the requested model, selects credentials, translates formats, executes the upstream request, and translates the response back.
It is not a model and it is not a replacement chat UI for Claude Code. A more accurate description is: a local reverse proxy, protocol adapter, and routing control plane for AI coding tools.
The Four Problems It Solves
1. One endpoint for several coding clients
Claude Code, Codex, Cursor, and other tools use different environment variables, config files, and request formats. Switching providers manually can leave stale settings that override each other. 9Router gives those clients one Base URL and moves provider state into its dashboard.
This is different from CC Switch. CC Switch primarily manages client configuration; 9Router sits in the live request path and can read, transform, and forward the payload.
2. Translation between incompatible protocols
OpenAI Chat, Responses, Anthropic Messages, Gemini, and several coding providers do not share one wire format. 9Router translates tool calls, reasoning content, images, and SSE streams into the target provider’s format.
Translation is useful, but it also adds failure modes. A successful one-line chat test does not prove that long context, parallel tools, reasoning fields, cancellation, and streaming all survive the bridge.
3. Account rotation and model fallback
9Router can rotate multiple accounts for one provider and can define ordered model combos. When an account or model returns a fallback-eligible quota or request error, the gateway can try the next configured route.
Do not confuse this with semantic task routing. It does not reliably infer that Gemini is best for the current reasoning task and Claude is best for the next code edit. The core mechanism is still driven by configured order, account state, and error heuristics.
4. Compressing tool output before it reaches the model
RTK Token Saver recognizes tool results such as git diff, grep, ls, tree, and logs, then attempts to reduce input tokens. This can help with repetitive output and oversized directory listings, but it is not strictly lossless.
The source implementation of smart-truncate keeps the head and tail while replacing middle lines with ... +N lines truncated. During incident debugging, diff review, or intermittent test analysis, the omitted middle may contain the evidence you needed.
Disable RTK when exact context matters, or bypass all token savers for one request with the documented header:
X-9Router-Token-Saver: offWhat “Unlimited Free AI” Really Means
9Router does not sell tokens or fund model inference. Upstream providers still execute requests, and usage depends on your subscriptions, API keys, trial credits, or promotional free tiers.
The current README has already corrected several early tutorials: iFlow, Qwen Code, and Gemini CLI free tiers were discontinued in 2026; Kiro has a monthly cap; the OpenCode Free model list changes; and Vertex uses time-limited credits for eligible new Google Cloud accounts.
A more accurate reading of the marketing claims is:
| Claim | Practical boundary |
|---|---|
| Free AI router | The software is free and open source; upstream inference may not be free |
| Never hit limits | Fallback can reduce interruption, but it cannot create quota or guarantee upstream availability |
| 40+ providers | A long adapter list does not guarantee stable, permitted, or complete compatibility on every route |
| Save 20-40% tokens | This is the project’s estimate; savings depend on output shape and may involve removing content |
If a guide still recommends iFlow, Qwen, or Antigravity as “unlimited free,” check its publication date before following the provider setup.
9Router vs CLIProxyAPI vs CC Switch
| Tool | What it resembles | Best use | Main tradeoff |
|---|---|---|---|
| 9Router | Dashboard-driven local LLM gateway | Personal provider management, quota views, fallback, and one client endpoint | Large state and security surface inside the complete request path |
| CLIProxyAPI | Lower-level account-to-API service | Self-hosted account pools and compatible upstreams for NewAPI or internal services | More deployment-oriented and less of an end-user workstation |
| CC Switch | Client configuration manager | Switching Base URLs, keys, MCP, prompts, and CLI profiles | Does not repair upstream protocols or execute model fallback |
Forum claims about whether one project copied another are not reliable selection evidence. The verifiable questions are more useful: which component stores credentials, which component changes requests, which one decides fallback, and how easily can you isolate a failure?
The Three Connection Modes Have Different Risk
API keys: the clearest boundary
When a provider explicitly supports API-key access and your model, billing, and use case match its documentation, 9Router mostly acts as a compatibility gateway. You still need to protect the key, but the authorization boundary is easier to reason about than a consumer subscription session.
OAuth and subscriptions: check the upstream terms
A completed OAuth login only proves that authentication succeeded. It does not prove that the provider allows a subscription entitlement to be proxied into other clients, shared with a team, or placed in an automated account pool. Multiple accounts do not remove risk controls; they simply let traffic continue through another identity.
Public issues include 403 responses, API bans, revoked tokens, and Antigravity restrictions. Those reports do not prove that every account will be banned, but they are enough to reject any blanket “safe because OAuth works” claim.
MITM: the highest-risk route
9Router also supports MITM modes for clients or IDEs that cannot be redirected with a normal Base URL. These modes may involve a local root certificate, DNS or hosts changes, traffic interception, and client fingerprint emulation.
If Claude Code, Codex, or another OpenAI-compatible client already accepts a custom endpoint, do not enable MITM merely to avoid a small configuration change.
Local Does Not Mean Data Stays Local
“Local gateway” means the gateway process runs on your device. Prompts, source snippets, tool results, and attachments still go to the selected upstream provider. With cross-provider fallback, the data processor may change during one coding workflow.
The current source also serializes provider connection fields including accessToken, refreshToken, and apiKey into the local SQLite database. No encryption layer is visible on that persistence path, so ~/.9router should be treated as a credential directory, not as disposable cache data.
A Safer First-Run Baseline
The official CLI currently binds to 0.0.0.0 by default. The project has authentication gates for remote APIs, the dashboard, and sensitive local routes, but a personal workstation does not need to expose the listener across the LAN by default.
Use a separate low-privilege account or low-limit key and bind only to loopback:
OBSERVABILITY_ENABLED=false 9router --host 127.0.0.1 --skip-updateThis is not an installation walkthrough. It is a conservative first-run baseline. Before sending real code, also verify that:
- The dashboard has a unique, strong password.
- Cloud Sync, Cloudflare Tunnel, Tailscale, and MITM are disabled unless explicitly needed.
- Permissions, backups, and sync software around
~/.9routerare appropriate for credentials. - RTK starts disabled so your comparison uses the original context.
- The first combo contains only one provider; add fallback after protocol tests pass.
- Streaming, tool calls, and token records have been checked with a minimal request or an API relay checker.
Final Verdict: Should You Use It?
If you want to study multi-model routing, consolidate legitimately obtained API keys, or observe fallback behavior in a personal sandbox, 9Router provides a more complete control plane than a set of environment variables.
If the real goal is “free Claude or Codex without caring about upstream rules,” that is the most dangerous reason to adopt it. Free tiers change, client fingerprints change, and OAuth permissions can be tightened. Account rotation cannot turn an unstable route into a service-level agreement.
Treat 9Router as an experimental gateway, not an unlimited quota machine. Constrain the listener, credentials, and logs before deciding whether real projects should pass through it.