{"id":51829653,"url":"https://github.com/sunerpy/kiro-provider","last_synced_at":"2026-07-22T13:33:33.826Z","repository":{"id":372184640,"uuid":"1305502827","full_name":"sunerpy/kiro-provider","owner":"sunerpy","description":"Standalone OpenAI-compatible API gateway for AWS Kiro (CodeWhisperer) — GPT direct, Claude via proxy, single-file Bun binary","archived":false,"fork":false,"pushed_at":"2026-07-19T13:00:17.000Z","size":187,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-19T14:21:13.099Z","etag":null,"topics":["api-gateway","aws","bun","claude","codewhisperer","kiro","llm-gateway","openai-compatible","proxy","typescript"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/sunerpy.png","metadata":{"files":{"readme":"README.md","changelog":"changelog/CHANGELOG-v0.x.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-07-19T07:15:13.000Z","updated_at":"2026-07-19T13:00:16.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/sunerpy/kiro-provider","commit_stats":null,"previous_names":["sunerpy/kiro-provider"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/sunerpy/kiro-provider","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fkiro-provider","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fkiro-provider/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fkiro-provider/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fkiro-provider/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/sunerpy","download_url":"https://codeload.github.com/sunerpy/kiro-provider/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/sunerpy%2Fkiro-provider/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35764375,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-07-20T02:08:10.276Z","status":"online","status_checked_at":"2026-07-22T02:00:06.236Z","response_time":124,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["api-gateway","aws","bun","claude","codewhisperer","kiro","llm-gateway","openai-compatible","proxy","typescript"],"created_at":"2026-07-22T13:33:33.251Z","updated_at":"2026-07-22T13:33:33.800Z","avatar_url":"https://github.com/sunerpy.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# kiro-provider\n\n\u003e A standalone OpenAI-compatible HTTP gateway for AWS Kiro (CodeWhisperer) — point any OpenAI SDK or agent at your own Kiro accounts.\n\n[![CI](https://github.com/sunerpy/kiro-provider/actions/workflows/ci.yml/badge.svg)](https://github.com/sunerpy/kiro-provider/actions/workflows/ci.yml)\n[![codecov](https://codecov.io/gh/sunerpy/kiro-provider/branch/main/graph/badge.svg)](https://codecov.io/gh/sunerpy/kiro-provider)\n[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)\n[![Bun](https://img.shields.io/badge/runtime-bun-black)](https://bun.sh/)\n\n[简体中文](docs/readme/README.zh.md) · English\n\n## Table of Contents\n\n- [Features](#features)\n- [Install](#install)\n- [Quickstart](#quickstart)\n- [Configuration](#configuration)\n- [Proxy](#proxy)\n- [Security](#security)\n- [Using with an LLM](#using-with-an-llm)\n- [Use with Codex CLI](#use-with-codex-cli)\n- [Development](#development)\n- [License](#license)\n\n## Features\n\n- OpenAI-compatible `POST /v1/chat/completions` (streaming SSE and non-streaming JSON), `POST /v1/responses` (OpenAI Responses API, streaming typed SSE and non-streaming JSON), `GET /v1/models`, and `GET /health`.\n- Bearer API-key gate that fails closed: the server refuses to start with no configured keys, and defaults to binding `127.0.0.1`.\n- Multi-account rotation with automatic token refresh and failover, backed by a local `bun:sqlite` account store with tombstone-based removal.\n- `accounts import` to reuse accounts already authenticated by [OpenCode's Kiro auth](https://opencode.ai/) instead of repeating device-code login.\n- A single global `proxy_url` that, when set, routes all upstream egress (model requests, token refresh, device-code login) through one HTTP(S) proxy.\n- Ships as a self-contained compiled binary via `bun build --compile` — no runtime install required on the target machine.\n\n## Install\n\nPick one of three channels.\n\n### 1. bunx / bun (fastest, requires Bun)\n\nkiro-provider ships an npm package built on Bun-only APIs (`bun:sqlite`, `Bun.serve`), so it runs under **Bun or `bunx`, not `npx` or plain `node`**. Install [Bun](https://bun.sh/) first, then:\n\n```bash\nbunx @sunerpy/kiro-provider serve --help\n```\n\nOr install it globally:\n\n```bash\nbun add -g @sunerpy/kiro-provider\nkiro-provider --help\n```\n\n### 2. Prebuilt binary (no dependencies)\n\nEvery release publishes standalone binaries for `linux` (x64, arm64), `darwin` (x64, arm64), and `windows` (x64). Download the one for your platform from [Releases](https://github.com/sunerpy/kiro-provider/releases/latest), `chmod +x` it, and run it directly. No Bun or Node.js needed at runtime.\n\nOne-line install (Linux/macOS):\n\n```bash\ncurl -fsSL https://raw.githubusercontent.com/sunerpy/kiro-provider/main/scripts/install.sh | sh\n```\n\nWindows (PowerShell):\n\n```powershell\nirm https://raw.githubusercontent.com/sunerpy/kiro-provider/main/scripts/install.ps1 | iex\n```\n\nBoth scripts pull the matching asset from `releases/latest/download/` and install it to `~/.local/bin` (override with `KIRO_PROVIDER_INSTALL_DIR`).\n\n### 3. From source (developers)\n\nRequires [Bun](https://bun.sh/).\n\n```bash\ngit clone https://github.com/sunerpy/kiro-provider.git\ncd kiro-provider\nbun install\nbun run build:binary\n./dist/kiro-provider --help\n```\n\nOr run without compiling:\n\n```bash\nbun install\nbun run src/cli/bin.ts --help\n```\n\nIn the rest of this README, `./dist/kiro-provider` refers to any of the above; substitute `bunx @sunerpy/kiro-provider`, your installed binary path, or `bun run src/cli/bin.ts` depending on which channel you used.\n\n## Quickstart\n\n1. **Get an account into the local store.** Either sign in interactively:\n\n   ```bash\n   ./dist/kiro-provider login\n   ```\n\n   or import accounts already authenticated by OpenCode:\n\n   ```bash\n   ./dist/kiro-provider accounts import\n   ```\n\n2. **Create a config with your own API key.**\n\n   ```bash\n   mkdir -p \"${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider\"\n   cp config.example.json \"${XDG_CONFIG_HOME:-$HOME/.config}/kiro-provider/config.json\"\n   # edit config.json and replace \"sk-REPLACE-ME\" with a private, random key\n   ```\n\n3. **Start the gateway.**\n\n   ```bash\n   ./dist/kiro-provider serve\n   ```\n\n4. **Call it with an OpenAI-compatible client.**\n\n   ```bash\n   curl -fsS http://127.0.0.1:8787/v1/models \\\n     -H 'Authorization: Bearer sk-your-private-key'\n   ```\n\n   ```ts\n   import OpenAI from \"openai\";\n\n   const client = new OpenAI({\n     baseURL: \"http://127.0.0.1:8787/v1\",\n     apiKey: \"sk-your-private-key\",\n   });\n\n   const completion = await client.chat.completions.create({\n     model: \"auto\",\n     messages: [{ role: \"user\", content: \"Explain this repository.\" }],\n   });\n\n   console.log(completion.choices[0]?.message.content);\n   ```\n\n   Or with the [Vercel AI SDK](https://sdk.vercel.ai/) via `@ai-sdk/openai-compatible`:\n\n   ```ts\n   import { createOpenAICompatible } from \"@ai-sdk/openai-compatible\";\n   import { generateText } from \"ai\";\n\n   const kiro = createOpenAICompatible({\n     name: \"kiro-provider\",\n     baseURL: \"http://127.0.0.1:8787/v1\",\n     apiKey: \"sk-your-private-key\",\n   });\n\n   const { text } = await generateText({\n     model: kiro(\"auto\"),\n     prompt: \"Explain this repository.\",\n   });\n   ```\n\n## Configuration\n\nConfig is loaded from `~/.config/kiro-provider/config.json` (or `$XDG_CONFIG_HOME/kiro-provider/config.json`), overridable by `KIRO_PROVIDER_*` environment variables and, for `serve`, by CLI flags. Precedence is **CLI flag \u003e environment variable \u003e config file \u003e schema default**.\n\n| Field | Default | Env var |\n| --- | --- | --- |\n| `host` | `127.0.0.1` | `KIRO_PROVIDER_HOST` |\n| `port` | `8787` | `KIRO_PROVIDER_PORT` |\n| `api_keys` | required, non-empty | `KIRO_PROVIDER_API_KEYS` |\n| `proxy_url` | `null` | `KIRO_PROVIDER_PROXY_URL` |\n| `default_region` | `us-east-1` | `KIRO_PROVIDER_DEFAULT_REGION` |\n| `account_selection_strategy` | `lowest-usage` | `KIRO_PROVIDER_ACCOUNT_SELECTION_STRATEGY` |\n| `log_level` | `info` | `KIRO_PROVIDER_LOG_LEVEL` |\n\nThe full field reference, including retry/timeout tuning and the test-only `test_upstream_endpoint`, lives in [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md).\n\n## Proxy\n\nSome networks reach one model family directly while another needs a proxy (for example, GPT direct, Claude via an approved egress). Set `proxy_url` (config file, `KIRO_PROVIDER_PROXY_URL`, or `serve --proxy`) to route **all** upstream traffic — model calls, token refresh, and device-code login — through a single HTTP(S) proxy. Leave it `null` for direct connections. See [`docs/CONFIGURATION.md`](docs/CONFIGURATION.md#proxy) for precedence details and examples.\n\n## Security\n\n- **Fail-closed authentication.** The server will not start without at least one non-empty `api_keys` entry, and every route requires `Authorization: Bearer \u003ckey\u003e`.\n- **Local bind by default.** `host` defaults to `127.0.0.1`; only bind `0.0.0.0` behind a firewall or authenticated reverse proxy.\n- **Locked-down account store.** `accounts.db` (and its WAL/SHM files) are created with mode `0600`.\n- **No secrets in logs.** Proxy URLs and account tokens are never printed; don't commit a real config file, account database, or gateway key.\n\n\u003e **Responsible use.** kiro-provider reuses AWS Kiro accounts you already control and consumes your own account quota. Supply your own accounts — this project is not a way to share or resell someone else's Kiro access, and it should not be used to circumvent per-account usage limits.\n\n## Using with an LLM\n\nPoint any OpenAI-compatible client (`openai`, `@ai-sdk/openai-compatible`, LangChain, etc.) at `http://\u003chost\u003e:\u003cport\u003e/v1` with one of your configured `api_keys`.\n\n\u003cdetails\u003e\n\u003csummary\u003eAgent command reference\u003c/summary\u003e\n\n- `kiro-provider serve [--config \u003cpath\u003e] [--host \u003chost\u003e] [--port \u003cport\u003e] [--proxy \u003curl\u003e]` — start the gateway.\n- `kiro-provider login [--config \u003cpath\u003e] [--start-url \u003curl\u003e] [--region \u003cregion\u003e]` — device-code login (AWS Builder ID, or IAM Identity Center with `--start-url`).\n- `kiro-provider accounts list` — list stored accounts and their health.\n- `kiro-provider accounts import [--from \u003cpath\u003e] [--config \u003cpath\u003e]` — import accounts from an OpenCode `kiro.db` (default source: `~/.config/opencode/kiro.db`).\n- `kiro-provider accounts remove \u003cid|email\u003e` — remove one account (writes a tombstone).\n\nContract: human-readable status lines go to stdout, errors to stderr, non-zero exit on failure. `GET /v1/models` and `GET /health` return structured JSON.\n\n\u003c/details\u003e\n\n## Use with Codex CLI\n\nkiro-provider's `POST /v1/responses` endpoint speaks the OpenAI Responses wire format, so [Codex CLI](https://github.com/openai/codex) (verified against 0.144.6) can use it as a custom `model_provider` with `wire_api = \"responses\"`. Test it with an isolated `CODEX_HOME` so your real `~/.codex` config is never touched:\n\n```bash\nexport CODEX_HOME=\"$(mktemp -d)\"        # isolated; your real ~/.codex is untouched\nexport LOCALGW_KEY=\"sk-...your gateway api key...\"\ncat \u003e \"$CODEX_HOME/config.toml\" \u003c\u003c'EOF'\nmodel = \"gpt-5.6-sol\"\nmodel_provider = \"localgw\"\n[model_providers.localgw]\nname = \"Local Gateway\"\nbase_url = \"http://127.0.0.1:8787/v1\"\nenv_key = \"LOCALGW_KEY\"\nwire_api = \"responses\"\nEOF\ncodex exec --skip-git-repo-check \"say hi\"\n```\n\nRequires the gateway running (`kiro-provider serve`) with an account already imported or logged in. Reasoning models work through Codex the same way they do for `/v1/chat/completions` (Claude via your configured proxy, GPT direct). Full details, plus a ready-made isolated smoke test (`scripts/codex-smoke.sh`), live in [`docs/CODEX.md`](docs/CODEX.md).\n\n## Development\n\n```bash\nbun install\nbun run typecheck\nbun test\nbash scripts/security-check.sh   # security regression suite (Linux, needs openssl/curl/ss)\n```\n\n## License\n\n[MIT](LICENSE)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsunerpy%2Fkiro-provider","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsunerpy%2Fkiro-provider","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsunerpy%2Fkiro-provider/lists"}