Skillget

ungate

skill
Security Audit
Fail
Health Warn
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Low visibility — Only 5 GitHub stars
Code Fail
  • exec() — Shell command execution in apps/api/src/adapter/openai-to-anthropic.ts
  • exec() — Shell command execution in apps/api/src/adapter/xml-tool-parser.ts
Permissions Pass
  • Permissions — No dangerous permissions requested
Purpose
This tool acts as a local proxy that allows developers to use a standard Claude subscription within the Cursor IDE, translating OpenAI-style API requests to provider-native formats.

Security Assessment
Risk Rating: Medium. The tool inherently handles sensitive authentication data. It requires your Claude OAuth credentials or MiniMax API keys to function, and routes all of your IDE's AI requests through a local proxy. The automated scan flagged two instances of shell command execution in the API adapter files. While this is standard for a Node.js application designed to spawn and manage a local proxy server, the execution points should still be manually verified to ensure they are not vulnerable to injection. No hardcoded secrets or dangerous system permissions were detected.

Quality Assessment
The project is actively maintained, with its most recent code push occurring today. It benefits from a clear description and a permissive MIT license. However, community trust and visibility are currently very low. The repository has only 5 GitHub stars, meaning the codebase has not been broadly examined by the security community. Additionally, the tool relies on a specific workaround for a known bug in Cursor 3.0 to function properly, which could impact future stability.

Verdict
Use with caution. The underlying concept is safe, but the combination of newly discovered shell execution flags, sensitive credential handling, and low community visibility means you should review the source code before relying on it.
SUMMARY

Use your Claude subscription in Cursor without an API key.

README.md

Ungate

Ungate

Use Claude subscription and MiniMax in Cursor through a local proxy that translates OpenAI-style requests into provider-native APIs.

Open VSX Downloads License: MIT Last commit

Why

Cursor can connect to OpenAI-compatible APIs, but provider-specific flows still get in the way. Claude subscriptions work through OAuth, not Anthropic API keys. MiniMax works through its own API and has provider-specific streaming behavior. Ungate hides those differences behind one local proxy and one Cursor-compatible endpoint.

How it works

Cursor allows a custom OpenAI Base URL. Ungate listens on that URL and translates requests to the target provider API, including streaming, tool calls, and vision where supported.

Cursor 3.0 introduced a bug: built-in model names can bypass OpenAI Base URL and go straight to the real provider API. In practice this means requests for standard Claude model names may skip Ungate entirely even when a proxy URL is configured. Ungate treats this as a bug because Cursor ignores the user's proxy setting for those models.

Workaround: use custom model IDs from the Ungate Models section instead of Cursor's built-in Claude model names.

The extension starts the proxy as a child process and shows its settings in a Webview panel. From there you configure the provider, copy the public proxy URL, and copy the proxy API key that Cursor uses to authenticate to your local proxy.

Features

  • OpenAI-to-provider request translation
  • Streaming responses
  • Tool calls mapping
  • Image support
  • OAuth authentication via Claude account
  • MiniMax API key authentication
  • MiniMax <think>...</think> reasoning separation
  • Request analytics
  • Analytics split by provider: Claude and MiniMax
  • Built-in web UI panel

Installation

Install from the marketplace:

cursor --install-extension orchidfiles.ungate

Or search @id:orchidfiles.ungate in the Extensions panel.

Open VSX

Setup

  1. Install the extension. Ungate starts the local API automatically.
  2. Click the Ungate :<port> item in the status bar to open the Ungate panel.
  3. Choose the provider you want to use.
  4. For Claude, sign in with your Claude account through OAuth.
  5. For MiniMax, enter your MiniMax API key and choose a Base URL: Global, China, or Custom.
  6. In the Tunnel section, click Start tunnel, then copy the public URL shown in the panel.
  7. Paste it into Cursor Settings → Models → OpenAI Base URL.
  8. Copy the proxy API key from the same panel and paste it into Cursor Settings → Models → OpenAI API Key.
  9. In the Ungate Models section, copy the model IDs you want and add them as custom models in Cursor.
  10. If you use MiniMax, add MiniMax-M2.7 as a custom model in Cursor.
  11. Select one of your custom models in Cursor and start chatting.

Development

git clone https://github.com/orchidfiles/ungate.git
cd ungate
pnpm install

Build dev-kit (needed once, before other builds):

pnpm --filter @ungate/dev-kit build

Build the API:

pnpm --filter @ungate/api build

Build the extension:

pnpm --filter ungate build

License

MIT

Support

Bug reports and feature requests: GitHub issues
Everything else: [email protected]

Made by the author of orchidfiles.com — essays from inside startups.
If you found ungate useful, you'll probably enjoy the essays.

Reviews (0)

No results found