Juracich Path·@juracich/transporter
Your plan, as an API.
You already pay for Claude Code and Codex. Path serves an OpenAI-compatible endpoint straight from the CLIs already signed in on your machine, so your apps can call them like any other model provider, without a second, metered API bill.
One npm install. One process, on 127.0.0.1. No server to deploy, nothing to pair, and your prompts never reach us.
npm install -g @juracich/transporterNode 20+ on macOS, Linux or WSL. Free while Path is in beta , a Juracich account is all it asks for.
The request leaves your client and comes straight back.
The advantage
An API your plan was never given.
Claude Code and Codex are terminal tools. They were built to be typed at, not called, and neither vendor hands a subscription an endpoint. So the plan you already pay for has been unreachable from your own code: to build anything on top of it you opened a second account, took an API key, and started paying per token for capability you were already buying.
Path gives that subscription an address. The CLIs are already signed in on your machine; Path puts an ordinary HTTP API in front of them and answers on 127.0.0.1. The work is done by the plan you have, so it comes out of a flat monthly bill instead of a metered one.
Reachable at last
A plan is an interactive login. Path turns it into an endpoint your scripts, agents, CI jobs and side projects can call like any other provider.
One bill, not two
A flat subscription instead of per-token metering. Work that fits inside the plan you are already paying for stops arriving as a separate usage invoice.
Bounded by your plan
Path raises no limit. Throughput is whatever your subscription allows, and when the window is spent, requests wait. It removes the second bill, not the ceiling.
Whether a consumer plan permits this is the vendor’s call and it can change. We spell that out rather than bury it.
How to use it
Three commands, then you’re serving.
- 1
Install
npm install -g @juracich/transporterNode 20 or newer. Installs two names for the same tool, transporter and juracich-path, on the machine where Claude Code or Codex is already signed in.
- 2
Sign in, once
transporter signinYour browser opens on a consent screen and hands a scoped token back over loopback. It can confirm your licence and read your email address, and nothing else on your account.
- 3
Serve
transporter serveBinds 127.0.0.1 and prints your base_url. Nothing outside the machine can reach it, which is why no API key is required by default.
$ transporter serve
✓ claude 2.1.225 (Claude Code)
✓ codex codex-cli 0.135.0
✓ Serving locally 2 runners
base_url http://127.0.0.1:8787/v1
api_key not required (loopback)
models claude, codex
account you@example.com
Not sure what to type? Run transporter on its own and pick from the menu. Every command is in there, with serve at the top.
The whole integration
One line changes. Nothing else.
Path speaks the OpenAI chat-completions API, streaming included. If your code already talks to a model provider, you change base_url. The official SDKs, LangChain, Cursor, and anything else that accepts a custom base URL all work unmodified.
It speaks Anthropic’s /v1/messagestoo, on the same port, so the official Anthropic SDK is also a one-line change. Point whichever one you already use at it.
The model string splits at the slash: the half before it picks the runner, and everything after goes to the vendor CLI untouched. So new model aliases work the day they ship.
| claude | Claude Code, default model |
| claude/opus | Latest Opus |
| claude/sonnet | Latest Sonnet |
| claude/opus[1m] | Latest Opus, 1M context |
| codex | Codex, default model |
| codex/gpt-5.5 | GPT-5.5 |
from openai import OpenAI
client = OpenAI(
base_url="http://127.0.0.1:8787/v1",
api_key="unused",
)
r = client.chat.completions.create(
model="claude/opus",
messages=[{"role": "user", "content": "Hi"}],
)What you get
A gateway’s features, in one local process.
Runs on your machine
One process, bound to loopback. No server to deploy, nothing to pair, no account to provision, and no hop through us for your prompts to make.
No API keys
Requests are served by the subscription already signed in on the machine. Path never sees, stores, or transmits your Claude or OpenAI credentials. They stay in each CLI's own store.
Both vendors, one endpoint
Claude Code and Codex behind the same API. Switch between them with the model string, on whichever machines have them installed.
Two API shapes, same endpoint
OpenAI chat completions and Anthropic's own /v1/messages, on the same port. The Anthropic surface is held to the real wire shape in detail, so the official SDK streams against it unmodified: named events in order, thinking and tool_use blocks, and stop reasons the API can actually return.
Real sessions
The CLIs keep their own conversation state. Thread path.session_id and you get their native context and prompt caching instead of resending a flattened transcript every turn.
Confined by default
A run's working directory must resolve inside a workspace root you named, Claude runs with permission-mode auto and Codex read-only, and stray API keys are stripped from the environment.
A doctor, not a stack trace
One command checks Node, the effective user, both vendor CLIs and their auth state, file permissions, clock skew and workspace roots. Then prints the fix for whatever's wrong.
Quota-aware routing
In fleet mode the gateway reads each machine's five-hour window state. A box that's burned through its quota stops receiving traffic before requests start failing, and returns when the window resets.
Outbound-only fleets
Agents dial the gateway, never the reverse. No inbound ports, no port-forwarding, no SSH keys held by anyone but you. It works behind NAT and corporate firewalls.
Made to live in a terminal
Bare transporter opens an interactive menu; every command also works non-interactively for scripts and systemd units. Status reports on a running daemon without a management port.
$ transporter doctor
Install
✓ transporter 0.2.0 bundle
✓ Daemon build matches this CLI
Vendor CLIs
✓ claude 2.1.225
✓ claude authenticated claude.ai · max
✓ codex 0.135.0
Workspaces
✗ /srv/checkouts does not exist
Fix: transporter workspace remove /srv/checkouts
Built to be debuggable
When it breaks, it tells you why.
Most failures here are invisible: a CLI that quietly logged out, a service running as the wrong user, an install that is a version behind what’s actually running. transporter doctor checks all of it and prints the exact command that fixes it.--fixapplies the safe repairs itself.
And transporter run “hello” executes a single run with no server involved at all, the fastest way to tell “the vendor CLI is broken” apart from “Path is broken”, which otherwise look identical.
The trust question
What leaves your machine.
Path runs locally, so this list is short and worth being precise about.
Your prompts and completionsnever leaves your machine
Go from your client to the CLI on your machine, and back. They never reach us.
Your Claude or OpenAI credentialsnever leaves your machine
Stay in each vendor CLI's own credential store. Path never reads them.
Your filesnever leaves your machine
Read by the CLI locally, under the workspace limits you set.
A licence checkleaves your machine
On start-up and roughly every 72 hours, Path asks juracich.com whether your account is still active. It sends your scoped token and nothing else. No prompts, no usage, no telemetry.
If juracich.com is unreachable, Path keeps working on its last successful check for two weeks. An outage on our side, or a laptop with no signal, doesn’t stop you using your own subscription on your own computer. Full detail in the docs.
Security
A middle layer, and nothing more.
Path translates. A request arrives in OpenAI or Anthropic shape, Path rewrites it as a CLI invocation, the CLI answers, and Path rewrites the answer back. That is the entire job. It is not a model, not a proxy to one of ours, and not somewhere your data comes to rest.
Which means the usual question, how much do we have to trust the vendor, has a smaller answer than usual: we are a package you install, running as you, on hardware you own.
We are not on the request path
Your client talks to 127.0.0.1 on your own machine, the prompt goes to the CLI beside it, and the answer comes straight back. None of that round trip crosses our infrastructure, so there is nothing on our side to breach, subpoena or leak.
It never holds your credentials
Claude Code and Codex keep their logins in their own credential stores. Path shells out to them as you. It has no copy of a vendor token to lose, and stray API keys are stripped from the environment a run inherits.
It stores nothing
No prompt log, no completion log, no usage record. Conversation state lives in the vendor CLIs' own session files, on your disk, under your user.
Loopback until you say otherwise
The listener binds 127.0.0.1. Serving it to anything beyond the machine is an explicit flag you pass, not a default you have to notice and turn off.
One outbound call, and you can watch it
A licence check to juracich.com on start-up and roughly every 72 hours, carrying a scoped token and nothing else. It is a Node process on your box: point a packet capture at it and confirm.
Confined while it runs
A run's working directory has to resolve inside a workspace root you named. Claude runs with permission-mode auto, Codex read-only, so a prompt cannot talk the CLI into wandering.
In fleet mode the same holds one level up: agents dial the gateway outbound, the gateway never holds a vendor login, and no inbound port is opened on the machines doing the work.
When one machine isn’t enough
Or run a fleet behind one endpoint.
serve covers the common case: the client and the subscription on the same box. If calls come from somewhere else, or several machines should sit behind a single URL, the same binary can instead dial out to a Path gateway.
Agents always dial out, so your machines need no inbound ports and nobody holds SSH credentials for a box they don’t own. The gateway routes to whichever machine has the runner available and quota left on its five-hour window, and skips the ones that are spent.
Gateway mode is still private beta and set up by hand.
Talk to us about a fleet# local: one machine, no gateway
transporter serve
# fleet, dial out to a gateway
transporter login --agent-id web-1 \
--token <secret> --gateway wss://…
transporter startBefore you install
What Path needs from you.
- A machine that's awake when your requests arrive.
- Path runs the CLIs where you install them. Your laptop is fine if the client is on it too; for anything always-on, a cheap VPS or a Mac mini in a closet does the job. Node 20 or newer, on macOS, Linux, or WSL.
- Your own subscription, already signed in.
- We don't resell access and we don't provide the plan. You log into Claude Code or Codex as you normally would, as the same user that will run Path, since vendor credentials are per-user. And Path serves from it. Nothing about your plan changes.
- A Juracich account.
- One browser sign-in, so Path can confirm the install is entitled to run. It's free during the beta, the token is scoped to that single check, and you can revoke it from your devices page at any time.
- Your plan's terms are yours.
- Running your subscription through an API-shaped endpoint may not be permitted under every consumer plan, and the vendors can change that at any time. You're the plan holder, so that call, and that risk, sits with you. We'll tell you what we know; we won't pretend the question doesn't exist.
Two minutes to your first request.
Install it, sign in once, and point whatever you already use at the printed URL.
npm install -g @juracich/transporter