free-tier first · multi-key · multi-provider
clai doesn't describe what to do — it edits files, runs builds, scans hosts, and verifies its own work. Built for free API tiers, it rotates keys and providers automatically so rate limits never stop the job.
curl -fsSL https://raw.githubusercontent.com/pentoshi007/clai/main/install/install.sh | shAI-powered terminal assistant · ask & agent modes for shell, files & security workflows
Welcome to clai! /history past chats · /help commands
// why clai
Findings need real tool output. Builds get typechecked before “done.” Long sessions stay coherent instead of hallucinating progress.
Twelve providers wired in — Groq, Gemini, NVIDIA NIM, OpenRouter, Bynara, Kimchi, plus fully local Ollama. A fresh install runs at zero cost: stack free keys and clai assembles capacity across all of them, with a free-only filter so you never accidentally spend.
$ clai set groq gsk_… → you're live
Up to 10 keys per provider with a sticky active key. On 429s, auth errors, quota exhaustion or 5xx, clai rotates circularly — auth and quota errors switch instantly, and /fallback on extends the chain across providers.
switching groq key [2/4] …ab12 (rate limited)
Scaffolds apps, edits surgically, installs packages, runs typecheck and tests, starts dev servers as background jobs and probes them before claiming success. A scaffold alone is treated as incomplete.
✓ 14 passed · probing localhost:3000 → 200
Opt-in engagement scope with authorized/excluded targets, rate and concurrency ceilings, redirect and DNS-rebinding escape detection, and out-of-scope flagging. Recon-first methodology built for authorized pentests and bug-bounty programs — with structured, evidence-backed reports.
clai scope new --targets lab.example.com --max-rate 5
plan.create / task.update drive a live checklist that survives context compaction and reloads with /history. The agent works task-by-task and won't fake completion.
● 3/5 tasks complete · surviving compaction
Every action is classified safe / confirm / block. Deletes always confirm with a preview; destructive patterns are refused outright. Per-session allow-lists with /allow and /disallow.
confirm: fs.delete ./dist ? [y/n/v]
// providers
Point clai at any free tier, add several keys per provider, and it rotates automatically when one hits a rate limit. Prefer fully offline? Run it on Ollama.
| Provider | Default model | Tier |
|---|---|---|
| NVIDIA NIM | openai/gpt-oss-20b | Free |
| Groq | llama-3.3-70b-versatile | Free |
| Google Gemini | gemini-3.5-flash | Free |
| OpenRouter | llama-3.3-70b-instruct:free | Free |
| Bynara | mimo-v2.5-free | Free |
| Kimchi | kimi-k2.6 | Free |
| Ollama | llama3.1:8b | Local |
| OpenAI | gpt-5.4-mini | Paid |
| Anthropic | claude-3-5-haiku | Paid |
| AgentRouter | claude-opus-4-6 | Free |
| AWS Mantle | claude-haiku-4-5 | Paid |
| Qwen Cloud | qwen3.7-plus | Paid |
/freeonly on keeps the fallback chain on free tiers — you never accidentally spend.
// install
Node.js ≥ 20. Every platform, every package manager — then type clai in any terminal.
brew tap pentoshi007/clai && brew install claicurl -fsSL https://raw.githubusercontent.com/pentoshi007/clai/main/install/install.sh | sh// security work
clai is built to run authorized security work, not narrate it. Recon-first methodology, real evidence, and guardrails that keep you inside the boundaries you set.
clai authorize-pentest AGREE enables scan & attack tools with a one-time acknowledgement.
Authorized targets, exclusions, allowed phases, rate & concurrency ceilings, and an expiry.
Read-only discovery needs no plan: whois, DNS, net.scan, http.fetch, nmap, ffuf, nuclei.
plan.create from real evidence — then clai stops and waits for your /implement.
Task-by-task execution, structured findings with severity, evidence, and remediation.
Scope enforcement is real, not cosmetic
# define an engagement scope
$ clai scope new \
--targets lab.example.com,10.10.0.0/24 \
--exclude prod.example.com \
--phases recon,enumeration --max-rate 5 --max-concurrency 2
Use only on systems you are authorized to test. clai is an operator's tool: authorization, scope, and impact are yours.
// console
Streaming chat, nested tool cards, file diffs, a live plan pane, pickers, and searchable history — with a classic REPL fallback when the terminal can't host the UI.
/askAnswers, methodology, and read-only tools. No mutations, no attacks — a safe place to think.
/agentExecutes: edits, installs, scans, verifies, and works the plan until every task checks out.
/planResearches and designs a durable plan. Nothing runs until you approve it with /implement.
keyboard shortcuts
// faq
Yes. clai itself is MIT-licensed open source, and it's designed to run entirely on free API tiers — Groq, Google Gemini, NVIDIA NIM, OpenRouter, Bynara, Kimchi, and AgentRouter all have free access, and Ollama runs fully local and offline. Add multiple free keys and clai rotates between them when rate limits hit, so long sessions stay alive at $0.
clai keeps up to 10 keys per provider with a sticky active key. On HTTP 429s, auth errors, quota exhaustion, transient network errors, or 5xx responses, it rotates circularly to the next key — auth and quota errors switch immediately without waiting. With /fallback on, it can also fall back to your other configured providers, and /freeonly on guarantees the chain never touches a paid API.
Three things: it's free-tier first (12 providers, multi-key rotation, cross-provider fallback), it's honest (findings require real tool output, builds get typechecked and tested before 'done', durable plans survive context compaction), and it has real scope-based pentesting guardrails — authorized/excluded targets, rate ceilings, and redirect/DNS-rebinding escape detection.
clai is an operator's tool for authorized security work — pentests and bug-bounty programs where you have permission. Attack tools require a one-time `clai authorize-pentest AGREE` acknowledgement, and engagement scope is enforced on every action: out-of-scope hosts are flagged, never touched; rate and concurrency ceilings are token-bucket enforced; redirects that leave scope and DNS-rebinding escapes are detected and blocked.
macOS (Homebrew or install script), Linux (install script), and Windows (PowerShell installer or Scoop), plus npm i -g @pentoshi/clai on any platform with Node.js 20 or later. Native binaries are also built for every release.
Yes. Sessions are durable — /history restores full sessions including prompts, tool results, and the matching plan, even after an abort or autosave. You can also drop a .clai/context.md in any repo and its contents (lab topology, in-scope hosts, conventions) are injected every turn. /privacy on disables persistence entirely when you want a clean room.