Atlas / MCP servers / ypollak2 / llm-router

llm-routerBLOCK

Name: llm-router
Author: ypollak2

mcp/ypollak2/llm-router

MCP server by ypollak2 · ai routing · anthropic · claude · Audited 2026-10-07

Universal LLM router for AI coding tools. Works with Claude Code, Cursor, Codex, Gemini CLI, Copilot and more. Free-first fallback chain cuts costs 35-80%.

Verdict

BLOCK

Grade

Trust score

43 /100

Exposed tools

6 5r · 1w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

llm-router

Stop spending your Claude Pro/Max quota on questions a free model can answer.

llm-router hooks into your coding tool's own lifecycle, reads each prompt before the model does, and drafts an answer on a free or local model first. No API keys needed on a Claude subscription — routing runs through MCP tools and local models.

One caveat: routed answers are advisory by default — Claude still takes the turn unless LLMROUTERZEROCLAUDE=1. By default some tool calls wait until a prompt is routed; LLMROUTER_ENFORCE=off turns that off. Draft-rate and acceptance figures live in docs/MEASUREMENT.md, with their n, window and conditions.

Read from source at commit 13c11eba40eaOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add llm-routing --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env DEEPSEEK_API_KEY=${DEEPSEEK_API_KEY} --env GEMINI_API_KEY=${GEMINI_API_KEY} --env GOOGLE_API_KEY=${GOOGLE_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "llm-routing": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "DEEPSEEK_API_KEY": "${DEEPSEEK_API_KEY}",
        "GEMINI_API_KEY": "${GEMINI_API_KEY}",
        "GOOGLE_API_KEY": "${GOOGLE_API_KEY}"
      }
    }
  }
}

Exposed tools (6)

5 read · 1 write · 0 destructive.

Tool	Risk	Description
`agoragentic_browse`	read	Browse available services on the Agoragentic marketplace.
`agoragentic_status`	read	Get llm-router agent status on Agoragentic.
`agoragentic_task`	write	Execute a task on the Agoragentic capability marketplace.
`agoragentic_wallet`	read	Check Agoragentic wallet balance and status.
`bash`	read	y
`router`	read	llm-router: the last 10 routing decisions (time, model, why, outcome)

Trust audit

BLOCKgrade F · trust 43/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (12 observation(s))
Network: declared (16 observation(s))
Shell: declared (7 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (25)

HIGHFilesystem / path · fs.credential_store · CWE-22, CWE-59

src/llm_router/capabilities.py:278

"id_rsa", "id_ed25519", ".npmrc", ".pypirc", ".netrc",

Why it matters. touches a credential store

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

.claude/hooks/auto-route.py:33

".env" ... urllib.request

Why it matters. reads secrets in the same file that sends data out

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

hooks/auto-route.py:342

".env" ... urlopen

Why it matters. reads secrets in the same file that sends data out

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

src/llm_router/hooks/auto-route.py:342

".env" ... urlopen

Why it matters. reads secrets in the same file that sends data out

HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319

src/llm_router/seats.py:287

dict(os.environ) ... urllib.request

Why it matters. reads secrets in the same file that sends data out

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/llm_router/config.py:125

"169.254.169.254", "metadata.google.internal", "metadata",

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

src/llm_router/config.py:130

if host.startswith("169.254.") or host.startswith("fe80:") or "169.254.169.254" in host:

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

HIGHHard-coded secrets · secret.db_uri · CWE-798, CWE-321

src/llm_router/alerts.py:46

a value can (`{"postgresql://u:pw@h/db": "unreachable"}` is a real shape

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/llm_router/commands/invoice.py:65

mod = __import__(f"llm_router.invoice_reconciliation.{provider}", fromlist=["pull_monthly_invoice"])

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/llm_router/proxy/backends.py:142

fn = getattr(importlib.import_module(mod), attr, None)

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

src/llm_router/server.py:402

importlib.import_module(name)

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

src/llm_router/complexity_knn.py:221

evidence: float  # Σw / (Σw + κ): neighbour share of the score, 0-1