capitolineSAFE
Self-hosted OpenAI-compatible gateway and MCP server over the official Claude Code, Codex and Antigravity CLIs, with a council of models
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
In the Grand Temple, before the end, Desmond does not find a single voice. He finds three: Jupiter, Juno, Minerva. The Capitoline Triad, what remains of Those Who Came Before. They do not agree. Minerva asks him to let the world burn and start again. Juno asks him to save it, at a price. Jupiter has already spoken, and is silent. The answer does not come from consensus. It comes from the one who listens to all of them, and then chooses.
Capitoline is a self-hosted personal AI gateway. It exposes an OpenAI-compatible HTTP API and an MCP server, and behind them it runs the official Claude Code, Codex and Gemini CLIs, authenticated with the subscriptions of whoever hosts it. Three voices, one endpoint.
This is a personal project, published as-is. It works for its author's setup; issues and pull requests are welcome but may not get an answer.
You can give the floor to a single member: claude-fable, codex-gpt-6-astra, antigravity-gemini-pro, or any other model the three CLIs serve, since every one of them is exposed by name. Or the capitoline model convenes the Triad: every member answers, every member judges the others without knowing who wrote what, and a judge synthesizes. As in the Temple, the value is not in the agreement but in hearing the dissent before deciding.
The council is Andrej Karpathy's idea, and the credit is his: llm-council is a local web app that sends a question to several models through OpenRouter, has them review and rank each other's answers anonymously, and lets a chairman model write the final response. Capitoline keeps those three stages and changes what is around them. The models are reached through their official CLIs, on your own subscriptions, with no pay-per-use API, and the council is a model name any OpenAI client or MCP client can ask for. Each seat is a model family with a fallback chain, not a single model. The judge is blind to the members' names and may
21ef30016246OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add capitoline --env CAPITOLINE_TEST_SECRET=${CAPITOLINE_TEST_SECRET} -- npx -y [email protected]{
"mcpServers": {
"capitoline": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"CAPITOLINE_TEST_SECRET": "${CAPITOLINE_TEST_SECRET}"
}
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ask_council | read | |
ask_model | read | |
generate_image | read | |
list_models | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (7 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (21)
export function createUiRouter(dir = fileURLToPath(new URL("../../ui/", import.meta.url))): express.Router {yield JSON.stringify({ event: "init", conversation_id: "../../../etc/passwd", init: { conversation_id: "../../../etc/passwd" } });expect(collect(home, "codex", "../../etc").status).toBe(2);
expect(collect(join(agy, "../.."), "forget", "../../etc").status).toBe(2);
curl http://127.0.0.1:8080/v1/models
curl http://127.0.0.1:8080/v1/chat/completions -H 'content-type: application/json' \
curl http://127.0.0.1:8080/v1/images/generations -H 'content-type: application/json' \
curl -N http://127.0.0.1:8080/v1/chat/completions -H 'content-type: application/json' \
curl -N http://127.0.0.1:8080/v1/chat/completions -H 'content-type: application/json' \
@modelcontextprotocol/sdk, express, jose, pino, yaml, zod, @types/express, @types/node
Conversations work two ways. **Chat Completions is stateless**: a client that wants a second turn sends the whole history again in `messages`, which is what Open WebUI and the SDKs do. **The Responses
MCP: `POST /mcp` (streamable HTTP) with tools `list_models`, `ask_model` (which also takes `images`, base64 with their media type, on the same terms as the HTTP image parts), `ask_council` and `genera
**The model catalog keeps itself current — done (2026-09-29).** Asked by the owner after GPT-5.5: the gateway should update its models by itself, with no obligation to use any notification service. On
`POST /v1/responses` (2026-10-01): the Responses API's subset for one model's text answer, with the conversation optionally kept on the server. `input` (text, `input_image` data URLs) and `instruction
commands. Never read, copy or reuse their OAuth tokens or credential files.
commands. Never read, copy or reuse their OAuth tokens or credential files.
cat > /etc/capitoline/runner.env <<ENV
The token is read from the environment variable `token_env` names, never
When Access is on, the gateway also verifies the Access token on a request
curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && apt install -y nodejs
curl -fsSL https://antigravity.google/cli/install.sh | bash
Gates applied: no_behavioural_pass.
21ef30016246full audit observations/trust-audit/mcp-server/marco-fabbri__capitoline.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 21ef30016246 | SAFE | B | 89 | first audit |
Questions
What is the capitoline MCP server?
Self-hosted OpenAI-compatible gateway and MCP server over the official Claude Code, Codex and Antigravity CLIs, with a council of models
What tools does capitoline expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is capitoline safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does capitoline need?
It reads CAPITOLINE_TEST_SECRET from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does capitoline run?
It speaks streamable-http, so it runs as a service you connect to over the network. It is published on npm as capitoline at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (21ef30016246), read on 2026-10-11. The repository is watched and re-audited when it changes.