clai
A fast, terminal-native AI agent that runs real tools — built to run on free API tiers, stay alive across rate limits with multi-key + multi-provider switching, and do serious work: building, debugging, and scope-based pentesting / bug bounty.
clai is an agentic CLI. It doesn't just describe what to do — it edits files, runs shell commands, scans hosts, fetches HTTP evidence, keeps a durable task plan, and verifies its own work before claiming success. It runs entirely in your terminal with a full-screen console UI (and a classic line REPL fallback).
Two things make it practical for everyday use:
- It's cheap-to-free to run. Point it at Groq, Google Gemini, NVIDIA NIM, OpenRouter, Bynara, Kimchi, or a local Ollama — all have free access — and clai stacks them. Add several keys per provider; when one hits a rate limit, it rotates to the next automatically. Want frontier models instead? Serve Kimi K3 on your own Modal endpoint on Modal's $30/month of free credit, or start on Lightning AI's 40M free tokens.
- It's honest. Findings need real tool output. Builds get typechecked/run before "done." Compaction and history keep long sessions coherent instead of hallucinating progress.
---
Highlights
- Free-tier first. 15 providers wired in, 6 cloud free tiers + local Ollama. Default provider is NVIDIA NIM (openai/gpt-oss-20b) so a fresh install can run at no cost.
- Multi-key smart switching. Up to 10 keys per provider with a sticky active key and circular rotation on rate-limit / auth / quota / transient / 5xx / empty-response errors. Optional cross-provider fallback and a free-only filter.
- Bring your own endpoint. Deploy Kimi K3 (or Qwen / DeepSeek / GLM / GPT-OSS / your own fine-tune) to a Modal endpoint and drive it from clai on $30/month of free compute credit. Modal, Lightning AI and TokenRouter each keep a list of up to 10 base URLs with a sticky active one, so several deployments live side by side and you switch with one command — same editor, same ★ active row as keys.
- Scope-based pentesting. Opt-in engagement scope with authorized/excluded targets, allowed phases, rate and concurrency ceilings, redirect and DNS-rebinding escape detection, and out-of-scope flagging — designed for authorized pentests and bug-bounty programs.
- Real building & debugging. Scaffolds apps, edits code surgically, installs packages, runs builds/tests, starts dev servers as background jobs, and probes them before reporting success.
- Durable plans. plan.create / task.update drive a live checklist that survives context compaction and reloads with /history — the agent works task-by-task and won't fake completion.
- Native + text tool calling. Uses provider-native function calling where available, with a text-fence fallback (toolCalling: auto|native|text).
- Safety gate you control. Every action is classified safe / confirm / block; deletes always confirm with a preview; destructive patterns are blocked.
---
Install
macOS
brew tap pentoshi007/clai && brew install clai
# or
curl -fsSL https://raw.githubusercontent.com/pentoshi007/clai/main/install/install.sh | shLinux
curl -fsSL https://raw.githubusercontent.com/pentoshi007/clai/main/install/install.sh | shWindows
irm https://raw.githubusercontent.com/pentoshi007/clai/main/install/install.ps1 | iex
# or
scoop bucket add clai https://github.com/pentoshi007/clai && scoop install clai