
Security News
Open VSX Unblocks Extension IDs Used in Malware Campaign
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.
@vaaya/router
Advanced tools
LLMs from your terminal through your Vaaya wallet, no API keys: ask one-shot questions, chat, or run a local OpenAI-compatible proxy that routes every request to the cheapest capable model (Kimi, GPT, Gemini, Claude, DeepSeek and 300+ more).
LLMs from your terminal through your Vaaya wallet. No API keys, no per-provider accounts: one login, 300+ models (Kimi, GPT, Gemini, Claude, DeepSeek and more), billed per token at model cost plus 3%.
npx @vaaya/router login # once; sign up right there if you're new
npx @vaaya/router "explain CORS in one paragraph"
If you have the vaaya CLI (npm i -g vaaya-cli), plain vaaya is the same
thing with the full toolset already on: it runs --mcp chat for you.
The answer streams back. No model named means auto-routing: short and simple goes to a cheap model, tools/code/long context go up-tier.
Ask once (pipes work; the answer is stdout, the price trailer is stderr, so piping the output onward stays clean):
npx @vaaya/router "why is my docker build slow"
git diff | npx @vaaya/router "write a commit message"
cat error.log | npx @vaaya/router --best "find the root cause"
Chat (a running conversation in your terminal):
npx @vaaya/router
> whats a monad
> /model kimi-k3
> now explain it like moonshot would
Tools (--tools lets the model act mid-answer, paid from the same wallet):
npx @vaaya/router --tools "read https://news.ycombinator.com and summarize the top story"
npx @vaaya/router --tools "find the email of Jane Doe at stripe.com"
The model gets web_search (1 cent), read_page (1 cent), and find_email (4 cents); every call prints as it runs. Tool mode defaults to the mid tier for reliable function calling and answers without streaming.
Full Vaaya toolset (--mcp) gives the model everything your agents get,
live from the MCP server: consult, use (image/video/audio generation,
scraping, research, enrichment, sandboxes, email), account tools, and any
suite you have unlocked:
npx @vaaya/router --mcp # chat where the model can do anything Vaaya does
npx @vaaya/router --mcp "find 5 seed-stage fintech founders in London"
The tool list is fetched at session start, so it always matches what your
agents see. llm and vaaya_logout are excluded (recursion and
disconnect-yourself hazards).
Serve (an OpenAI-compatible endpoint for coding agents):
npx @vaaya/router serve # http://localhost:4141/v1
export OPENAI_BASE_URL=http://localhost:4141/v1
export OPENAI_API_KEY=vaaya # any value; real auth is your Vaaya login
From an agent via MCP: agents connected to the Vaaya MCP can call the
llm tool directly, no proxy or base URL needed. Same wallet, same pricing.
vaaya/auto (the default) is classified heuristically from the request:
short, tool-free, code-free prompts route to the cheap tier; tool calls or
code content route to mid; very large contexts route to the frontier tier.--cheap / --mid / --best (or models vaaya/cheap|mid|best) force a
tier directly.--model <id> (or any concrete model string, e.g.
anthropic/claude-opus-5, moonshotai/kimi-k3) passes through untouched.GET /v1/models on the proxy lists the vaaya/* aliases plus every concrete
model in the current tier table, so agent UIs that populate a model picker
show the full set.
Whatever the model costs on OpenRouter, plus 3%, from your prepaid Vaaya balance. Typical calls: cheap tier well under a tenth of a cent, best tier 1 to 3 cents. Sub-cent usage accumulates and settles in 1 cent steps; every charge is visible at vaaya.ai/transactions. A $10/day per-account inference cap applies.
vaaya-router "question ..." # one-shot ask (streams; --cheap/--mid/--best/--model)
vaaya-router # chat session
vaaya-router serve [--port N] # OpenAI-compatible proxy (default 4141)
vaaya-router login # interactive browser login
vaaya-router login --token vst_... # login with a setup token, no browser
| Env var | Default | Purpose |
|---|---|---|
VAAYA_LLM_BASE | https://vaaya.ai | Hosted API origin (override for self-hosting or a preview deploy). |
OPENAI_API_KEY is required by most OpenAI-compatible clients but is
ignored by the proxy; authentication is the stored Vaaya login from
login (same credential store as @vaaya/mcp, one login covers both).ask/chat kick off the device-code
login inline; the proxy responds 401 telling the client to run login.MIT © Vaaya
FAQs
LLMs from your terminal through your Vaaya wallet, no API keys: ask one-shot questions, chat, or run a local OpenAI-compatible proxy that routes every request to the cheapest capable model (Kimi, GPT, Gemini, Claude, DeepSeek and 300+ more).
We found that @vaaya/router demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Open VSX has removed three extension IDs from its malicious-extension list as the legitimate publishers they impersonated move to claim the names for themselves.

Product
Socket’s PHP and Composer support is now in Beta for all customers, with PHP reachability analysis generally available.

Product
Socket is bringing experimental protection to Firefox, scanning 97,000+ extensions in Mozilla's official directory for malware and risky updates.