Find a file
A beceb69962
test: add 151 tests for key-server security-critical logic (#1036)
Add comprehensive test coverage for the key-server
(.claude/skills/setup-agent-team/key-server.ts), which previously had
zero tests despite containing security-critical logic:

- validKeyVal: API key validation (control chars, shell metacharacters,
  length limits) - 37 tests
- SAFE_PROVIDER_RE: path traversal prevention in provider names - 21 tests
- UUID_RE: batch ID format validation - 12 tests
- signHmac/verifyHmac: HMAC signing and verification for signed URLs - 17 tests
- isAuthed: timing-safe Bearer token auth - 9 tests
- rateCheck: rate limiting logic - 8 tests
- esc: HTML escaping for XSS prevention - 13 tests
- cleanup: data store batch expiry logic - 9 tests
- Key submission validation flow - 6 tests
- Route matching, security headers, backward compat - 19 tests

Agent: test-engineer

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-13 20:11:35 -05:00
.claude improve: make QA bot more effective with structured failures and verification (#1034) 2026-02-13 20:07:54 -05:00
.githooks Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
.github fix: CI test summary uses NO_COLOR instead of sed hack (#985) 2026-02-13 11:26:41 -08:00
alibabacloud refactor: decompose ensure_aliyun_credentials and extract _aliyun_instance_public_ip (#1026) 2026-02-13 18:31:39 -05:00
atlanticnet fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
aws-lightsail fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
binarylane fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
cherry fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
civo fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
cli test: add 151 tests for key-server security-critical logic (#1036) 2026-02-13 20:11:35 -05:00
cloudsigma fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
codesandbox fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
contabo fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
daytona fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
digitalocean fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
e2b fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
exoscale fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
fly fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
gcp fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
genesiscloud fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
github-codespaces fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
hetzner fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
hostinger fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
hostkey fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
hyperstack fix: add actionable guidance to agent installation failures across 126 scripts (#966) 2026-02-13 10:14:03 -08:00
ionos fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
kamatera fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
koyeb fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
latitude fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
linode fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
local fix: add actionable guidance to agent installation failures across 126 scripts (#966) 2026-02-13 10:14:03 -08:00
modal fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
netcup fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
northflank fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
oracle fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
ovh fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
railway fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
ramnode fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
render fix: harden upload_file path validation with strict allowlist regex across 10 clouds (#993) 2026-02-13 12:20:40 -08:00
scaleway fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
shared fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
sprite fix(security): replace unquoted heredocs with printf to prevent shell expansion in API keys (#1031) 2026-02-13 19:41:10 -05:00
test improve: make QA bot more effective with structured failures and verification (#1034) 2026-02-13 20:07:54 -05:00
upcloud fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
vultr fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
webdock fix(ux): show post-session summary with server status and reconnect info (#1037) 2026-02-13 20:06:40 -05:00
.gitignore fix: address medium security findings from #753 (#755) 2026-02-12 15:48:52 -08:00
.shellcheckrc ci: add shellcheck linting infrastructure 2026-02-08 01:08:34 +00:00
CLAUDE.md docs: expand test infrastructure instructions for discovery bot (#987) 2026-02-13 11:41:25 -08:00
LICENSE Improve README with better intro, how-it-works, and dev guide (#51) 2026-02-08 18:16:46 +00:00
manifest.json feat: Add Alibaba Cloud provider support (#1002) 2026-02-13 13:57:22 -08:00
README.md docs: Sync README matrix with manifest.json (#956) 2026-02-13 08:49:21 -08:00

Spawn

Launch any AI agent on any cloud with a single command. Coding agents, research agents, self-hosted AI tools — Spawn deploys them all. All models powered by OpenRouter. (ALPHA software, use at your own risk!)

15 agents. 36 clouds. 514 combinations. Zero config.

Install

curl -fsSL https://openrouter.ai/labs/spawn/cli/install.sh | bash

Or install directly from GitHub:

curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/cli/install.sh | bash

Usage

spawn                         # Interactive picker
spawn <agent> <cloud>         # Launch directly
spawn matrix                  # Show the full agent x cloud matrix

Examples

spawn                                    # Interactive picker
spawn claude sprite                      # Claude Code on Sprite
spawn aider hetzner                      # Aider on Hetzner
spawn claude sprite --prompt "Fix bugs"  # Non-interactive with prompt
spawn aider sprite -p "Add tests"        # Short form
spawn claude                             # Show clouds available for Claude

Commands

Command Description
spawn Interactive agent + cloud picker
spawn <agent> <cloud> Launch agent on cloud directly
spawn <agent> <cloud> --dry-run Preview without provisioning
spawn <agent> <cloud> -p "text" Non-interactive with prompt
spawn <agent> <cloud> --prompt-file f.txt Prompt from file
spawn <agent> Show available clouds for an agent
spawn matrix Full agent x cloud matrix
spawn list Show previously launched spawns
spawn agents List all agents
spawn clouds List all cloud providers
spawn update Check for CLI updates

Without the CLI

Every combination works as a one-liner — no install required:

bash <(curl -fsSL https://openrouter.ai/labs/spawn/{cloud}/{agent}.sh)

Non-Interactive Mode

Skip prompts by providing environment variables:

# OpenRouter API key (required for all agents)
export OPENROUTER_API_KEY=sk-or-v1-xxxxx

# Cloud-specific credentials (varies by provider)
export SPRITE_API_KEY=...        # For Sprite
export HCLOUD_TOKEN=...           # For Hetzner
export DO_API_TOKEN=...           # For DigitalOcean

# Run non-interactively
spawn claude sprite

You can also use inline environment variables:

OPENROUTER_API_KEY=sk-or-v1-xxxxx spawn claude sprite

Get your OpenRouter API key at: https://openrouter.ai/settings/keys

For cloud-specific auth, see each cloud's README in this repository.

Matrix

Sprite Hetzner Cloud DigitalOcean Vultr Linode (Akamai) AWS Lightsail GCP Compute Engine GitHub Codespaces CodeSandbox E2B Modal Fly.io Civo Scaleway Daytona UpCloud BinaryLane Latitude.sh OVHcloud Kamatera Cherry Servers Oracle Cloud Infrastructure Koyeb Northflank Railway Render IONOS Cloud Exoscale Contabo Hostinger Netcup Local Machine RamNode Atlantic.Net HOSTKEY CloudSigma
Claude Code
OpenClaw
NanoClaw
Aider
Goose
Codex CLI
Open Interpreter
Gemini CLI
Amazon Q CLI
Cline
gptme
OpenCode
Plandex
Kilo Code
Continue

How it works

Each cell in the matrix is a self-contained bash script that:

  1. Provisions a server on the cloud provider
  2. Installs the agent
  3. Injects your OpenRouter API key so every agent uses the same billing
  4. Drops you into an interactive session

Scripts work standalone (bash <(curl ...)) or through the CLI.

Development

git clone https://github.com/OpenRouterTeam/spawn.git
cd spawn
git config core.hooksPath .githooks

Structure

{cloud}/lib/common.sh    # Cloud provider primitives (provision, SSH, cleanup)
{cloud}/{agent}.sh        # Agent deployment script
shared/common.sh          # Shared utilities (OAuth, logging, SSH helpers)
cli/                      # TypeScript CLI (bun)
manifest.json             # Source of truth for the matrix

Adding a new cloud

  1. Create {cloud}/lib/common.sh with provisioning primitives
  2. Add to manifest.json
  3. Implement agent scripts using the cloud's primitives
  4. See CLAUDE.md for full contributor guide

Adding a new agent

  1. Add to manifest.json
  2. Implement on 1+ cloud by adapting an existing agent script
  3. Must support OpenRouter via env var injection

Contributing

The easiest way to contribute is by testing and reporting issues. You don't need to write code.

Test a cloud provider

Pick any agent + cloud combination from the matrix and try it out:

spawn claude hetzner      # or any combination

If something breaks, hangs, or behaves unexpectedly, open an issue using the bug report template. Include:

  • The exact command you ran
  • The cloud provider and agent
  • What happened vs. what you expected
  • Any error output

Request a cloud or agent

Want to see a specific cloud provider or agent supported? Use the dedicated templates:

Requests with real-world use cases get prioritized.

Report auth or credential issues

Cloud provider APIs change frequently. If you hit authentication failures, expired tokens, or permission errors on a provider that previously worked, please report it — these are high-priority fixes.

Code contributions

See CLAUDE.md for the full contributor guide covering shell script rules, testing, and the shared library pattern.

License

Apache 2.0