Find a file
A 5ff178fb12
fix: Prevent Python/JSON injection in Cherry Servers lib (#312)
- create_server(): Validate hostname, plan, region env vars with
  validate_resource_name(); pass all values via sys.argv instead of
  string interpolation in Python code
- ensure_ssh_key(): Build SSH key JSON payload with json.dumps via
  sys.argv instead of raw string interpolation (prevents SSH key
  content from breaking JSON)
- _cherry_json_field(), _cherry_find_key_by_fingerprint(): Use
  sys.argv instead of bash variable interpolation in Python strings

Agent: security-auditor

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-10 18:00:10 -08:00
.claude fix: Add monitoring loop instructions and increase watchdog to 10 min (#315) 2026-02-10 17:49:54 -08:00
.githooks Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
.github fix: Force HTTP/1.1 for streaming to avoid HTTP/2 stream errors 2026-02-10 22:51:35 +00:00
aws-lightsail refactor: Decompose create_server in UpCloud and AWS Lightsail (#249) 2026-02-10 14:11:54 -08:00
binarylane fix: Remove double-quoting in json_escape printf callers 2026-02-10 20:04:30 +00:00
cherry fix: Prevent Python/JSON injection in Cherry Servers lib (#312) 2026-02-10 18:00:10 -08:00
civo refactor: Extract helpers from civo and kamatera create_server functions (#124) 2026-02-09 20:18:15 -08:00
cli fix: Resolve display names and case-insensitive input in CLI (#306) 2026-02-10 17:37:51 -08:00
daytona feat: Add kilocode scripts for e2b, modal, fly, civo, scaleway, daytona (#113) 2026-02-09 19:45:51 -08:00
digitalocean refactor: Decompose Hyperstack create_vm and DigitalOcean create_server (#179) 2026-02-10 07:43:19 -08:00
e2b feat: Add kilocode scripts for e2b, modal, fly, civo, scaleway, daytona (#113) 2026-02-09 19:45:51 -08:00
fly refactor: reduce complexity in Fly, Koyeb, and Railway providers (#293) 2026-02-10 15:30:32 -08:00
gcp feat: Add kilocode scripts for hetzner, digitalocean, vultr, linode, lambda, aws-lightsail, gcp (#114) 2026-02-09 19:46:21 -08:00
github-codespaces feat: Add kilocode on GitHub Codespaces (#291) 2026-02-10 15:28:29 -08:00
hetzner feat: Add Continue AI coding assistant (#303) 2026-02-10 16:49:31 -08:00
ionos fix: Prevent Python injection in IONOS credential handling (#307) 2026-02-10 17:37:54 -08:00
kamatera refactor: extract duplicated JSON parsing helpers in kamatera and cherry providers (#299) 2026-02-10 16:14:30 -08:00
koyeb refactor: reduce complexity in Fly, Koyeb, and Railway providers (#293) 2026-02-10 15:30:32 -08:00
latitude feat: Add kilocode scripts for runpod, upcloud, binarylane, genesiscloud, latitude, ovh, kamatera (#115) 2026-02-09 19:46:31 -08:00
linode refactor: Decompose Linode and GenesisCloud create_server functions (#219) 2026-02-10 12:32:40 -08:00
modal fix: Prevent shell injection in Railway env var injection and file upload (#222) 2026-02-10 12:34:13 -08:00
northflank feat: Add plandex on Northflank (#282) 2026-02-10 15:26:13 -08:00
oracle refactor: Decompose oversized OCI functions into focused helpers (#169) 2026-02-10 07:17:18 -08:00
ovh refactor: Decompose long functions in Vultr and OVH providers (#228) 2026-02-10 12:48:39 -08:00
railway refactor: reduce complexity in Fly, Koyeb, and Railway providers (#293) 2026-02-10 15:30:32 -08:00
render feat: Add Plandex on Render (#278) 2026-02-10 15:25:51 -08:00
scaleway refactor: Decompose create_server in Scaleway and Fly.io providers (#171) 2026-02-10 07:18:00 -08:00
shared fix: Remove double-quoting in json_escape printf callers 2026-02-10 20:04:30 +00:00
sprite fix: Poll for sprite provisioning instead of blind sleep 2026-02-11 00:52:35 +00:00
test fix: Poll for sprite provisioning instead of blind sleep 2026-02-11 00:52:35 +00:00
upcloud refactor: Decompose create_server in UpCloud and AWS Lightsail (#249) 2026-02-10 14:11:54 -08:00
vultr refactor: Decompose long functions in Vultr and OVH providers (#228) 2026-02-10 12:48:39 -08:00
.gitignore fix: remove cli.js build artifact from repo and add to .gitignore (#297) 2026-02-10 16:10:42 -08:00
.shellcheckrc ci: add shellcheck linting infrastructure 2026-02-08 01:08:34 +00:00
CLAUDE.md docs: Replace 'coding agent' with 'agents using remote API inference' 2026-02-11 00:26:00 +00:00
LICENSE Improve README with better intro, how-it-works, and dev guide (#51) 2026-02-08 18:16:46 +00:00
manifest.json feat: Add IONOS Cloud provider with minute-based billing (#304) 2026-02-10 16:51:34 -08:00
README.md docs: Sync README matrix with manifest.json 2026-02-11 01:47:09 +00:00

Spawn

Launch any AI agent on any cloud with a single command. Coding agents, research agents, self-hosted AI tools — Spawn deploys them all. All models powered by OpenRouter. (ALPHA software, use at your own risk!)

15 agents. 26 clouds. 355 combinations. Zero config.

Install

curl -fsSL https://openrouter.ai/lab/spawn/cli/install.sh | bash

Or install directly from GitHub:

curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/cli/install.sh | bash

Usage

spawn                         # Interactive picker
spawn <agent> <cloud>         # Launch directly
spawn list                    # Show the full matrix

Examples

spawn                                    # Interactive picker
spawn claude sprite                      # Claude Code on Sprite
spawn aider hetzner                      # Aider on Hetzner
spawn claude sprite --prompt "Fix bugs"  # Non-interactive with prompt
spawn aider sprite -p "Add tests"        # Short form
spawn claude                             # Show clouds available for Claude

Commands

Command Description
spawn Interactive agent + cloud picker
spawn <agent> <cloud> Launch agent on cloud directly
spawn <agent> <cloud> -p "text" Non-interactive with prompt
spawn <agent> <cloud> --prompt-file f.txt Prompt from file
spawn <agent> Show available clouds for an agent
spawn list Full agent x cloud matrix
spawn agents List all agents
spawn clouds List all cloud providers
spawn update Check for CLI updates

Without the CLI

Every combination works as a one-liner — no install required:

bash <(curl -fsSL https://openrouter.ai/lab/spawn/{cloud}/{agent}.sh)

Non-Interactive Mode

Skip prompts by providing environment variables:

# OpenRouter API key (required for all agents)
export OPENROUTER_API_KEY=sk-or-v1-xxxxx

# Cloud-specific credentials (varies by provider)
export SPRITE_API_KEY=...        # For Sprite
export HCLOUD_TOKEN=...           # For Hetzner
export DO_API_TOKEN=...           # For DigitalOcean

# Run non-interactively
spawn claude sprite

You can also use inline environment variables:

OPENROUTER_API_KEY=sk-or-v1-xxxxx spawn claude sprite

Get your OpenRouter API key at: https://openrouter.ai/settings/keys

For cloud-specific auth, see each cloud's README in this repository.

Matrix

Sprite Hetzner Cloud DigitalOcean Vultr Linode (Akamai) AWS Lightsail GCP Compute Engine GitHub Codespaces E2B Modal Fly.io Civo Scaleway Daytona UpCloud BinaryLane Latitude.sh OVHcloud Kamatera Cherry Servers Oracle Cloud Infrastructure Koyeb Northflank Railway Render IONOS Cloud
Claude Code
OpenClaw
NanoClaw
Aider
Goose
Codex CLI
Open Interpreter
Gemini CLI
Amazon Q CLI
Cline
gptme
OpenCode
Plandex
Kilo Code
Continue

How it works

Each cell in the matrix is a self-contained bash script that:

  1. Provisions a server on the cloud provider
  2. Installs the agent
  3. Injects your OpenRouter API key so every agent uses the same billing
  4. Drops you into an interactive session

Scripts work standalone (bash <(curl ...)) or through the CLI.

Development

git clone https://github.com/OpenRouterTeam/spawn.git
cd spawn
git config core.hooksPath .githooks

Structure

{cloud}/lib/common.sh    # Cloud provider primitives (provision, SSH, cleanup)
{cloud}/{agent}.sh        # Agent deployment script
shared/common.sh          # Shared utilities (OAuth, logging, SSH helpers)
cli/                      # TypeScript CLI (bun)
manifest.json             # Source of truth for the matrix

Adding a new cloud

  1. Create {cloud}/lib/common.sh with provisioning primitives
  2. Add to manifest.json
  3. Implement agent scripts using the cloud's primitives
  4. See CLAUDE.md for full contributor guide

Adding a new agent

  1. Add to manifest.json
  2. Implement on 1+ cloud by adapting an existing agent script
  3. Must support OpenRouter via env var injection

License

Apache 2.0