I now have a complete picture from the PyPI page, the package metadata, and the linked GitHub repository. Here's my review. --- # Review: `openrouter-agent-cli` (PyPI) ## What it is A **standalone terminal agent for OpenRouter models** — essentially a Claude-Code-style REPL in your terminal, backed by any model available on [OpenRouter](https://openrouter.ai), with tool-calling, session persistence, and context management. Latest version on PyPI: **0.1.5** ([project page](https://pypi.org/project/openrouter-agent-cli/), [release list](https://pypi.org/simple/openrouter-agent-cli/)). ## Key features (from the project page) - **Tool actions**: `run_bash`, `read_file`/`write_file`/`edit_file`, and `discover` (web search via Brave API + page navigation via `pyunbrowser`) - **Permission gating**: interactive `allow`/`deny`/`ask` per tool call, with a persistent policy cached in `~/.openrouter-agent-cli/policy.json`; default policy is `ask` for every call - **Session persistence & context management**: history saved to `~/.openrouter-agent-cli/sessions/<id>.json`, manual `/compact` + automatic compaction past `--max-history-messages` - **Parallel tool batching**: concurrent `discover` calls (`max_concurrency`, default 5, 1–16 cap) - **REPL niceties**: Markdown-rendered assistant replies and multi-line paste support - **Scripting mode**: `--prompt` runs one message, emits only the reply to stdout, logs to stderr - **Slash commands**: `/help`, `/new`, `/model`, `/usage`, `/compact`, `/tools on|off`, `/allow`, `/deny`, `/cwd`, `/discovery`, `/concurrency`, etc. - **Default model** is the free-tier `nvidia/nemotron-3.5-lightning:free`; overridable via `--model` or `OPENROUTER_MODEL` ## Packaging & metadata Verified from [pyproject.toml](https://raw.githubusercontent.com/protostatis/openrouter-agent-cli/main/pyproject.toml): - **License**: MIT; **Requires Python ≥ 3.10** - **Core dependencies**: `httpx>=0.27`, `prompt-toolkit>=3.0.53`, `pyunbrowser>=0.0.21`, `rich>=15.0.0` - **Extras**: `unbrowser` (openai, python-dotenv), `viz` (matplotlib), `full` (all) - **Console script**: `openrouter-agent` → `openrouter_agent_cli.cli:main` - Ships both an sdist and a `py3-none-any` wheel per release ([simple index](https://pypi.org/simple/openrouter-agent-cli/)) ## Release history & activity - **4 PyPI releases**: 0.1.2 → 0.1.5 ([simple index](https://pypi.org/simple/openrouter-agent-cli/)) - GitHub tags: **v0.1.4 – Apr 6, 2026** ("Robustness improvements") and **v0.1.5 – Aug 23, 2026** ("markdown rendering, multi-line paste support, output hardening") ([tags](https://github.com/protostatis/openrouter-agent-cli/tags), [releases](https://github.com/protostatis/openrouter-agent-cli/releases)) - Latest release is 3 days old — actively maintained - Repo: public, **0 stars, 0 forks, 27 commits, 0 open issues/PRs**, with CI workflow, tests, `uv.lock`, `SECURITY.md`, and a `BASH_TOOL_COMPARISON.md` ([repo](https://github.com/protostatis/openrouter-agent-cli)) ## Security posture — the standout quality The docs are **unusually candid about risk**, which is important for a tool that executes shell commands: - `run_bash` is **not jailed** — it runs in `--workdir` only; file tools (`read_file`/`write_file`/`edit_file`) do enforce a workdir jail ([project page](https://pypi.org/project/openrouter-agent-cli/)) - `discover` is **https-only**, blocks private/loopback/link-local/metadata hosts on the initial URL, but **redirects are not revalidated** (explicitly labeled "best-effort SSRF") - Explicit warnings that web content is untrusted and the model may be **prompt-injected**, and that model tool-call output is reflected literally into `run_bash` commands - Each `discover` call has a 30s timeout; timed-out threads are "abandoned" (not yet killable subprocesses) - A [SECURITY.md](https://raw.githubusercontent.com/protostatis/openrouter-agent-cli/main/SECURITY.md) exists with private-vulnerability-reporting guidance and a tool-safety summary ## Caveats / criticisms - **Very early-stage, unproven**: v0.1.x, single maintainer, 0 stars/forks, no community vetting — don't expect battle-tested reliability - **Windows limitation**: real web discovery depends on `pyunbrowser`, which ships only Linux/macOS wheels; on Windows the CLI works but `discover` may be unavailable (README admits this) - **Known rough edges acknowledged by the author**: redirect SSRF gaps, tool-message truncation at 8000 chars with "valid-JSON truncation not yet guaranteed", thread abandonment on discover timeout - **Thin PyPI metadata**: no classifiers, no author info, no per-version changelog on PyPI itself (changelog lives in GitHub releases) - The tool is powerful-by-default (a free-tier model gets `run_bash` access) — the `ask`-by-default permission gate is essential; the docs say to keep it enabled ## Verdict A **well-documented, security-conscious early-stage CLI** for driving OpenRouter models from the terminal with real tool use. The documentation quality (especially the security notes and tool-schema transparency) is better than most far more popular projects. Treat it as a promising hobby-grade tool: the codebase is small and readable enough to audit, and given it can execute arbitrary shell commands, I'd personally review the source (27 commits, MIT) before pointing it at anything important — or at minimum keep `/deny run_bash` unless you genuinely need it. **Sources opened:** - [PyPI project page – openrouter-agent-cli](https://pypi.org/project/openrouter-agent-cli/) - [PyPI simple index (all releases/files)](https://pypi.org/simple/openrouter-agent-cli/) - [pyproject.toml (metadata & deps)](https://raw.githubusercontent.com/protostatis/openrouter-agent-cli/main/pyproject.toml) - [GitHub repository](https://github.com/protostatis/openrouter-agent-cli) - [GitHub releases](https://github.com/protostatis/openrouter-agent-cli/releases) - [GitHub tags](https://github.com/protostatis/openrouter-agent-cli/tags) - [SECURITY.md](https://raw.githubusercontent.com/protostatis/openrouter-agent-cli/main/SECURITY.md)