
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@chenpu17/cc-gw
Advanced tools
Local-first AI gateway for personal developers and small software teams, with web console and CLI daemon.
GitHub 仓库:chenpu17/cc-gw2
别再让 AI 配置散落在每个项目里。
cc-gw 帮你把 Claude Code、OpenAI SDK、Anthropic SDK 和内部工具统一到一个本地优先入口,把 Key、路由、日志和排查收回到控制台里。
cc-gw gives personal developers and small software teams one local-first entry for Claude Code, OpenAI SDK, Anthropic SDK, and internal tools, so keys, routing, logs, and debugging stop living in every project.
baseURL、API Key、provider 切换和排查线索散落在每个项目里npm install -g @chenpu17/cc-gw
cc-gw start --foreground --port 4100
Product site: http://127.0.0.1:4100/
Web console: http://127.0.0.1:4100/ui
GET /GET /ui/@chenpu17/cc-gwdocs/README.mddocs/product-positioning.mddocs/landing-publishing.mdbaseURL、API Key 和 provider 差异1-100 人软件研发团队先把 AI 调用入口收口如果你的目标是跨 BU 的复杂审批、企业 SSO、集团级策略中台和重治理平台,cc-gw 不是那类产品。
当前主线已收敛到正式版,当前 npm 包版本以仓库根目录 package.json 与 release 为准。对用户最直接的变化是:你可以继续用熟悉的 CLI、Web UI、配置目录和 SQLite 数据,同时获得更低的常驻资源占用;后端 Rust 化后,在相同场景下内存占用实测可降至旧 Node.js 实现的约 1/20。
cc-gw2@chenpu17/cc-gwcc-gwstart、stop、restart、status、version 等命令习惯1/20下面这张展示图基于最新控制台截图拼接,聚焦最常用的三个工作面:总览、模型路由和日志排查。

Dashboard:看流量、延迟、健康状态和今天的整体走势Models & Routing:切模型、调 provider、维护路由,不用翻业务工程Logs:请求进来之后,直接在一个地方追踪链路和异常全局安装:
npm install -g @chenpu17/cc-gw
以前台模式启动:
cc-gw start --foreground --port 4100
或以守护进程模式启动:
cc-gw start --daemon --port 4100
启动后访问:
http://127.0.0.1:4100/
根路径默认挂产品官网和定位说明,管理控制台继续使用:
http://127.0.0.1:4100/ui
默认本地数据目录:
~/.cc-gw/config.json~/.cc-gw/data/gateway.db~/.cc-gw/logs~/.cc-gw/cc-gw.pidcrates/cc-gw-core、crates/cc-gw-serversrc/clisrc/web~/.cc-gw/config.json~/.cc-gw/data/gateway.dbencryption.key、旧 api_keys.key_ciphertext、旧 Web Auth scrypt 密码格式/ui、/assets/*、/favicon.ico、/api/*、/v1/*、/openai/v1/*pnpm install
pnpm build
pnpm dev
直接通过 CLI 前台启动:
pnpm --filter @cc-gw/cli exec tsx index.ts start --foreground
pnpm build 会执行:
src/cli/distsrc/web/distbin/<platform>-<arch>/cc-gw-serverCLI 启动时的后端解析顺序:
CC_GW_SERVER_BINbin/<platform>-<arch>/cc-gw-servertarget/release 或 target/debugcargo run -p cc-gw-server --对外发布模型:
@chenpu17/cc-gw@chenpu17/cc-gw-darwin-arm64@chenpu17/cc-gw-linux-x64@chenpu17/cc-gw-linux-arm64@chenpu17/cc-gw-win32-x64用户安装:
npm install -g @chenpu17/cc-gw
安装时会通过 optionalDependencies 自动拉取当前平台的预编译二进制,无需本地编译 Rust。
Linux 版本使用 musl,Windows 版本使用静态 CRT,目标是让用户只需 npm install 即可直接运行。
本地在仓库中直接验证未发布包时,需要额外安装当前平台 native 包;否则 CLI 会回退到 cargo run:
pnpm pack:dry-run
pnpm --dir packages/native/darwin-arm64 pack --pack-destination ../../../.pack/native
npm install -g ./.pack/native/chenpu17-cc-gw-darwin-arm64-<version>.tgz
npm install -g ./.pack/chenpu17-cc-gw-<version>.tgz
当前发布目标:
win32-x64)建议在上传或发版前执行:
cargo test
pnpm build
pnpm smoke:cli
pnpm pack:dry-run
首次运行 Web E2E 前,先安装 Playwright Chromium:
pnpm exec playwright install --with-deps chromium
pnpm test:e2e:web
如需刷新 README 中使用的英文亮色截图:
pnpm docs:readme-screenshots
如果只想跑分层回归,可直接用:
pnpm test:e2e:web:core
pnpm test:e2e:web:hardening
pnpm test:e2e:web:visual
如需刷新页面级截图基线:
pnpm test:e2e:web:update-snapshots
当前仓库已具备:
docs/README.mddocs/system-design.mddocs/database-schema.mddocs/api-compatibility.mdci.ymlrelease.ymldocs/npm-packaging.mddocs/github-release-checklist.mdFAQs
Local-first AI gateway for personal developers and small software teams, with web console and CLI daemon.
The npm package @chenpu17/cc-gw receives a total of 59 weekly downloads. As such, @chenpu17/cc-gw popularity was classified as not popular.
We found that @chenpu17/cc-gw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.