Find a file
A fa5b4979e8
fix: upgrade SSH to StrictHostKeyChecking=accept-new (TOFU) and randomize temp paths (#849)
- Change SSH default from StrictHostKeyChecking=no to accept-new, which
  accepts host keys on first connection but rejects if they change later
  (Trust On First Use). This protects against MITM attacks on subsequent
  connections. Requires OpenSSH 7.6+ (released Oct 2017).
- Replace predictable $$-based temp file path in upload_config_file with
  $RANDOM to prevent symlink attacks on the remote server.

Addresses findings from issue #763.

Agent: security-auditor

Co-authored-by: A <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-02-13 02:11:47 -08:00
.claude fix: rewrite monitoring loops to require TaskList on every iteration (#858) 2026-02-13 01:59:06 -08:00
.githooks Add guardrails: CLAUDE.md rules, hooks, pre-commit validation (#33) 2026-02-07 20:02:19 -08:00
.github fix: prevent duplicate review_all runs via reason-based dedup (#848) 2026-02-13 01:41:11 -08:00
aws-lightsail refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
binarylane refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
cherry fix: use log_step (cyan) for in-progress messages instead of log_info (green) (#757) 2026-02-12 15:48:38 -08:00
civo refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
cli fix: upgrade SSH to StrictHostKeyChecking=accept-new (TOFU) and randomize temp paths (#849) 2026-02-13 02:11:47 -08:00
codesandbox feat: add CodeSandbox cloud provider (#857) 2026-02-13 02:09:31 -08:00
contabo refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
daytona refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
digitalocean refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
e2b refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
exoscale refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
fly refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
gcp refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
genesiscloud fix: prevent Python code injection via unescaped variables in inline Python (#771) 2026-02-12 16:47:13 -08:00
github-codespaces refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
hetzner refactor: reduce complexity in Hetzner _validate_server_type_for_location (#831) 2026-02-12 23:52:17 -08:00
hostinger refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
hyperstack fix: use log_step (cyan) for progress messages instead of log_warn (yellow) (#534) 2026-02-11 14:37:43 -08:00
ionos refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
kamatera refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
koyeb refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
latitude refactor: reduce complexity in latitude and ovh cloud libs (#835) 2026-02-13 01:17:20 -08:00
linode refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
local feat: implement local/plandex.sh (#854) 2026-02-13 02:10:08 -08:00
modal refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
netcup refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
northflank refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
oracle refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
ovh refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
railway refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
ramnode feat: implement ramnode gaps for gemini, amazonq, plandex, kilocode (#855) 2026-02-13 02:09:35 -08:00
render fix: use log_step (cyan) for in-progress messages instead of log_info (green) (#768) 2026-02-12 16:45:58 -08:00
scaleway refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
shared fix: upgrade SSH to StrictHostKeyChecking=accept-new (TOFU) and randomize temp paths (#849) 2026-02-13 02:11:47 -08:00
sprite refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00
test feat: add CodeSandbox cloud provider (#857) 2026-02-13 02:09:31 -08:00
upcloud refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
vultr refactor: use sys.argv instead of bash interpolation in Python body builders (#842) 2026-02-13 01:45:11 -08:00
.gitignore fix: address medium security findings from #753 (#755) 2026-02-12 15:48:52 -08:00
.shellcheckrc ci: add shellcheck linting infrastructure 2026-02-08 01:08:34 +00:00
CLAUDE.md rename: setup-trigger-service -> setup-agent-team 2026-02-12 21:38:58 +00:00
LICENSE Improve README with better intro, how-it-works, and dev guide (#51) 2026-02-08 18:16:46 +00:00
manifest.json feat: implement local/plandex.sh (#854) 2026-02-13 02:10:08 -08:00
README.md refactor: replace Python with jq in Hetzner lib, fix /lab → /labs URLs (#827) 2026-02-12 23:14:11 -08:00

Spawn

Launch any AI agent on any cloud with a single command. Coding agents, research agents, self-hosted AI tools — Spawn deploys them all. All models powered by OpenRouter. (ALPHA software, use at your own risk!)

15 agents. 32 clouds. 468 combinations. Zero config.

Install

curl -fsSL https://openrouter.ai/labs/spawn/cli/install.sh | bash

Or install directly from GitHub:

curl -fsSL https://raw.githubusercontent.com/OpenRouterTeam/spawn/main/cli/install.sh | bash

Usage

spawn                         # Interactive picker
spawn <agent> <cloud>         # Launch directly
spawn matrix                  # Show the full agent x cloud matrix

Examples

spawn                                    # Interactive picker
spawn claude sprite                      # Claude Code on Sprite
spawn aider hetzner                      # Aider on Hetzner
spawn claude sprite --prompt "Fix bugs"  # Non-interactive with prompt
spawn aider sprite -p "Add tests"        # Short form
spawn claude                             # Show clouds available for Claude

Commands

Command Description
spawn Interactive agent + cloud picker
spawn <agent> <cloud> Launch agent on cloud directly
spawn <agent> <cloud> --dry-run Preview without provisioning
spawn <agent> <cloud> -p "text" Non-interactive with prompt
spawn <agent> <cloud> --prompt-file f.txt Prompt from file
spawn <agent> Show available clouds for an agent
spawn matrix Full agent x cloud matrix
spawn list Show previously launched spawns
spawn agents List all agents
spawn clouds List all cloud providers
spawn update Check for CLI updates

Without the CLI

Every combination works as a one-liner — no install required:

bash <(curl -fsSL https://openrouter.ai/labs/spawn/{cloud}/{agent}.sh)

Non-Interactive Mode

Skip prompts by providing environment variables:

# OpenRouter API key (required for all agents)
export OPENROUTER_API_KEY=sk-or-v1-xxxxx

# Cloud-specific credentials (varies by provider)
export SPRITE_API_KEY=...        # For Sprite
export HCLOUD_TOKEN=...           # For Hetzner
export DO_API_TOKEN=...           # For DigitalOcean

# Run non-interactively
spawn claude sprite

You can also use inline environment variables:

OPENROUTER_API_KEY=sk-or-v1-xxxxx spawn claude sprite

Get your OpenRouter API key at: https://openrouter.ai/settings/keys

For cloud-specific auth, see each cloud's README in this repository.

Matrix

Sprite Hetzner Cloud DigitalOcean Vultr Linode (Akamai) AWS Lightsail GCP Compute Engine GitHub Codespaces E2B Modal Fly.io Civo Scaleway Daytona UpCloud BinaryLane Latitude.sh OVHcloud Kamatera Cherry Servers Oracle Cloud Infrastructure Koyeb Northflank Railway Render IONOS Cloud Exoscale Contabo Hostinger Netcup Local Machine RamNode
Claude Code
OpenClaw
NanoClaw
Aider
Goose
Codex CLI
Open Interpreter
Gemini CLI
Amazon Q CLI
Cline
gptme
OpenCode
Plandex
Kilo Code
Continue

How it works

Each cell in the matrix is a self-contained bash script that:

  1. Provisions a server on the cloud provider
  2. Installs the agent
  3. Injects your OpenRouter API key so every agent uses the same billing
  4. Drops you into an interactive session

Scripts work standalone (bash <(curl ...)) or through the CLI.

Development

git clone https://github.com/OpenRouterTeam/spawn.git
cd spawn
git config core.hooksPath .githooks

Structure

{cloud}/lib/common.sh    # Cloud provider primitives (provision, SSH, cleanup)
{cloud}/{agent}.sh        # Agent deployment script
shared/common.sh          # Shared utilities (OAuth, logging, SSH helpers)
cli/                      # TypeScript CLI (bun)
manifest.json             # Source of truth for the matrix

Adding a new cloud

  1. Create {cloud}/lib/common.sh with provisioning primitives
  2. Add to manifest.json
  3. Implement agent scripts using the cloud's primitives
  4. See CLAUDE.md for full contributor guide

Adding a new agent

  1. Add to manifest.json
  2. Implement on 1+ cloud by adapting an existing agent script
  3. Must support OpenRouter via env var injection

Contributing

The easiest way to contribute is by testing and reporting issues. You don't need to write code.

Test a cloud provider

Pick any agent + cloud combination from the matrix and try it out:

spawn claude hetzner      # or any combination

If something breaks, hangs, or behaves unexpectedly, open an issue using the bug report template. Include:

  • The exact command you ran
  • The cloud provider and agent
  • What happened vs. what you expected
  • Any error output

Request a cloud or agent

Want to see a specific cloud provider or agent supported? Use the dedicated templates:

Requests with real-world use cases get prioritized.

Report auth or credential issues

Cloud provider APIs change frequently. If you hit authentication failures, expired tokens, or permission errors on a provider that previously worked, please report it — these are high-priority fixes.

Code contributions

See CLAUDE.md for the full contributor guide covering shell script rules, testing, and the shared library pattern.

License

Apache 2.0