Kotro

Local Rust LLM proxy for Cursor & Claude Code — stop MCP prompt injection, cut agent token waste.

One binary on your machine. No SaaS. Sees every tool result before it reaches the model.

▶ 78s demo (narrated) · silent · dashboard · exploit guide

Who this is for

• You run Cursor, Claude Code, or any OpenAI / Anthropic-compatible agent with MCP tools
• You want injection scan + secret redaction without sending traffic through a third-party gateway
• You also want cache / budget / circuit breaker so runaway agents don’t bill you overnight

30-second install

curl -sL https://raw.githubusercontent.com/kotro-labs/kotro-proxy-engine/main/scripts/install.sh | bash
kotro-proxy
# Point your agent base URL at http://127.0.0.1:8080/v1
# Dashboard: http://127.0.0.1:9090/dashboard

Without Kotro → with Kotro

See it yourself (no API key)

git clone https://github.com/kotro-labs/kotro-proxy-engine.git && cd kotro-proxy-engine
make demo-savings      # ~68% savings story + secret redaction
make demo-injection    # warn → HTTP 400 block + security tiles

Honest path: Kotro sits on the HTTP path to the provider — not raw MCP stdio. When an agent includes poisoned tool/file content in the next /v1/chat/completions or /v1/messages body, the scanner sees it.

Point your agent at it

Cursor

1. Settings → Models
2. Set OpenAI Base URL to http://localhost:8080/v1
3. Keep your provider API key
4. Optional: Command Palette → Kotro: Verify Cache (MISS then HIT)

Claude Code

KOTRO_UPSTREAM_URL=https://api.anthropic.com kotro-proxy &
ANTHROPIC_BASE_URL=http://localhost:8080 claude

OpenAI-compatible (Aider, SDKs, …)

OPENAI_BASE_URL=http://localhost:8080/v1 your-tool

What it does

Is Kotro the right tool for you?

Kotro is deliberately narrow: a single-binary proxy for one developer’s coding-agent traffic. It is not a team-wide multi-provider gateway.

That “nothing else in the path” property is structural, not a checkbox — a hosted gateway can’t offer it without changing its business model.

About the 99.3% upstream-token figure

In a published 3-turn codebase eval (benchmarks/eval-suite/RESULTS.md), billed upstream tokens dropped dramatically because request-shape stability let the provider’s prefix cache fire. Kotro’s local cache missed on those turns (new content each time). Treat 68% / make demo-savings as the honest “same day with local cache” story; treat 99.3% as an upstream-prefix interaction, not “local cache alone.”

Install details

Verifying releases

Release binaries are signed keylessly via cosign + SPDX SBOM:

cosign verify-blob \
  --certificate kotro-proxy-x86_64-apple-darwin.tar.gz.pem \
  --signature kotro-proxy-x86_64-apple-darwin.tar.gz.sig \
  --certificate-identity-regexp 'https://github.com/kotro-labs/kotro-proxy-engine/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  kotro-proxy-x86_64-apple-darwin.tar.gz

curl | bash / Homebrew / npm do not run this check automatically — verify the GitHub Release asset when you need that guarantee.

Quick start (manual)

KOTRO_UPSTREAM_URL=https://api.openai.com kotro-proxy
# or: KOTRO_UPSTREAM_URL=https://api.anthropic.com kotro-proxy

Point the IDE/SDK at http://127.0.0.1:8080/v1. Dashboard: http://127.0.0.1:9090/dashboard.

Smoke curls

curl -N http://127.0.0.1:8080/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -d '{"model":"gpt-4o","stream":true,"messages":[{"role":"user","content":"hello"}]}'

curl -N http://127.0.0.1:8080/v1/messages \
  -H "Content-Type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -d '{"model":"claude-3-5-sonnet-20241022","max_tokens":256,"stream":true,"messages":[{"role":"user","content":"hello"}]}'

Cache hits return X-Kotro-Cache: HIT. Hard-block injections with KOTRO_INJECTION_BLOCK=true.

Aider + local Ollama

ollama run llama3
KOTRO_UPSTREAM_URL=http://localhost:11434/v1 kotro-proxy &
export ANTHROPIC_API_KEY="dummy"
aider --model anthropic/claude-3-5-sonnet-20241022 --openai-api-base http://localhost:8080/v1

Configuration

Cache key strategies

Profiles

Architecture

IDE / Agent  →  kotro-proxy (:8080)
                 ├─ injection scan · redaction · loop / budget
                 ├─ cache · compress · tool cache
                 ├─ /v1/chat/completions
                 ├─ /v1/messages
                 └─ /v1/*  (passthrough)
                        ↓
                 upstream (OpenAI, Anthropic, Ollama, mock, …)

Launch docs: Week 1 distribution · Dev.to article (cost → security) · Viral packaging notes

Cancel-storm leak audit

brew install k6
make cancel-audit

Rust (shipping target)

cd rust && cargo test && cargo run -p kotro-proxy

Architecture map: docs/RUST-ARCHITECTURE.md

The Go tree under internal/ is frozen at v0.1.0-go as a behavioral reference — not the runtime you should ship.

Benchmarks

make load-test
make eval-suite

Results: benchmarks/eval-suite/RESULTS.md. Threat model: docs/security/THREAT-MODEL.md.

Project layout

rust/kotro-proxy/    Active Rust implementation
cmd/mockupstream/    Offline OpenAI + Anthropic SSE mock
docs/launch/         Demo scripts, HN / Dev.to assets
internal/            Frozen Go reference
scripts/             install, demos, benches

License

MIT — contributions welcome.