ajsai47/backdoor: Running Claude Code Against Any OpenAI-Compatible Provider

The lock-in problem Backdoor is aimed at

Claude Code is a client. It sends requests to an API endpoint and renders what comes back. The README states the problem plainly: the tool is hardwired to Anthropic's API, so you pay Anthropic's prices and use Anthropic's models. Backdoor's premise is that the harness and the model are separable, and that only the endpoint needs to move.

The audience follows from that. A developer who already likes Claude Code's tool use and agentic loops but wants a cheaper or local backend is the target user. So is anyone who wants to benchmark Llama, Mistral or DeepSeek against their own codebase without giving up the agent UI. The README frames the motivation in terms of access: a student or a solo developer who cannot absorb top-tier API costs still gets the same interface.

One thing worth separating from the pitch. The README's cost table compares Claude Opus 4.7 at roughly $9,834 for 500M tokens against DeepSeek V3 Flash at $5.34. Those are the project author's own figures, and the README does not describe the methodology behind them. Treat the direction as plausible and the exact ratio as unverified.

How the proxy intercepts and translates Claude Code traffic

Claude Code is pointed at localhost:8082 and believes it is talking to Anthropic. Backdoor receives the request in Anthropic's Messages API format, translates it to OpenAI's chat completions format, forwards it to PROVIDER_BASE_URL, and streams the response back in the shape Claude Code expects. The README's own summary of the data flow is a two-line diagram: Claude Code to Anthropic API before, Claude Code to Backdoor to anything after.

The translation layer has to handle more than message text. Tool use is the part that matters most for a coding agent, and the README claims Backdoor handles it. Streaming is the other. The repository layout backs up the shape of the thing: server.py at the top level, a src/ package, a pyproject.toml declaring FastAPI, uvicorn, httpx, pydantic and tiktoken as dependencies. tiktoken is there for token counting, which cost.py presumably consumes.

The .env.example exposes a set of request optimizations that are on by default: SKIP_QUOTA_PROBES, SKIP_TITLE_GENERATION, SKIP_SUGGESTION_MODE, MOCK_PREFIX_DETECTION and MOCK_FILEPATH_EXTRACTION. These suppress or fake ancillary calls Claude Code makes that are not part of the actual coding turn. That is a deliberate trade: fewer requests against a metered provider, at the cost of fidelity for features like title generation. The README does not document what breaks when those are disabled.

Installing Backdoor and running a first session

The README gives a three-command path. Clone the repository, change into it, and run the shell script named backdoor, which the README describes as an animated setup wizard that picks your provider, writes your config and launches Claude Code.

git clone https://github.com/ajsai47/backdoor
cd backdoor
./backdoor

If you would rather skip the wizard, the README says to copy .env.example to .env, fill it in, and run ./run.sh directly. The provider block is three variables, and the .env.example carries commented examples for each supported endpoint.

PROVIDER_BASE_URL=https://api.deepseek.com/v1
PROVIDER_API_KEY=your-key
PROVIDER_MODEL=deepseek-chat

PROVIDER_MODEL must be the slug the provider expects, not a friendly name. The README calls this out in troubleshooting because slugs vary: DeepSeek uses deepseek-chat, Groq uses llama-3.3-70b-versatile, and the .env.example default is meta/llama-3.3-70b-instruct against NVIDIA NIM. The same file also sets PROVIDER_MAX_TOKENS to 32768, PROVIDER_TEMPERATURE to 1.0 and PROVIDER_TOP_P to 1.0, plus HOST=127.0.0.1, PORT=8082 and LOG_FILE=proxy.log.

For a local backend, PROVIDER_BASE_URL becomes http://localhost:11434/v1 for Ollama or http://localhost:1234/v1 for LM Studio, and no key leaves the machine. If the proxy fails to start, the README points at port 8082 already being in use and suggests changing PORT to 8083. If nothing appears in proxy.log, it suggests running uv run uvicorn server:app directly to see the error.

Where Backdoor breaks down

The proxy is a translation layer, and translation layers lose things. The README does not enumerate which Anthropic Messages API fields survive the trip and which are dropped. If your workflow depends on a parameter that has no OpenAI equivalent, you will not find out from the README; you will find out from a malformed response.

Tool use is the second risk. The README asserts that Backdoor handles tool use, and Claude Code is useless without it. But tool-calling quality is a property of the model on the other end, not of the proxy. A small local model that emits tool calls in a slightly different shape than the proxy expects will produce failures that look like Backdoor bugs. The README's troubleshooting section does not cover this case at all.

Provider-side limits are the third. PROVIDER_MAX_TOKENS defaults to 32768, and not every provider accepts that ceiling. The README's only guidance for a 404 or a model-not-found error is to check the model slug, which is a real cause but not the only one.

There is also a naming problem. Searching for this project surfaces a large amount of unrelated material about security backdoors, a Comedy Central show, and financial backdoor conversions. The README does not address discoverability, and the repository has no homepage set.

Backdoor compared with a dedicated multi-provider client

The obvious alternative is a coding agent that was built multi-provider from the start, such as Aider or Cline, both of which let you select a backend without a translation proxy in the path. The difference is architectural rather than cosmetic. Those tools own their own agent loop, so they can shape requests natively for whichever provider they target. Backdoor keeps Claude Code's loop intact and rewrites the wire format underneath it.

That trade cuts both ways. You keep Claude Code's tool use and codebase navigation exactly as they are, which is the whole point of the project. In exchange, you accept a translation step that has to map one vendor's API surface onto another's, and every mismatch is a bug class that a native client does not have.

A second alternative is simply running Claude Code against Anthropic and paying for it. That is the correct answer if your work depends on Anthropic-specific behaviour, and the README says as much in its own way by framing the project as a tribute to the harness rather than a replacement for the model.

Maintenance, licence and what a fork actually costs you

The repository is MIT licensed, which permits commercial use, modification and redistribution provided the copyright notice and permission notice are retained. That is a permissive licence with no copyleft obligation. It is not legal advice; read the LICENSE file in the repository for the actual terms.

The last push to the default branch was on 2026-05-22. No releases were retrieved. That combination matters for adoption: there is no tagged version to pin, so the practical upgrade path is pulling from main and re-reading the diff. The README states the codebase is under 600 lines, which keeps the review surface small, but it also means the project's behaviour can change between pulls without a version number to warn you.

Runtime cost is low. The dependency list is FastAPI, uvicorn, httpx, pydantic, pydantic-settings, python-dotenv, tiktoken and python-telegram-bot, with Python 3.11 or newer required. A uv.lock is present, so the intended workflow appears to be uv-based, and the README's debugging suggestion of uv run uvicorn server:app is consistent with that. The Telegram dependency is pulled in even if you never set TELEGRAM_BOT_TOKEN, which is a small amount of unused surface area in the default install.

Editorial conclusion

Adopt Backdoor if you already use Claude Code and want to point the same harness at DeepSeek, Groq, a local Ollama instance or an OpenRouter key, and you are comfortable debugging a proxy that writes to proxy.log. Do not adopt it if you depend on Anthropic-specific features the translation layer does not cover, or if you need a published release to pin. Before you commit, verify three things: that your provider's exact model slug matches PROVIDER_MODEL, that port 8082 is free, and that your provider's tool-calling behaviour survives the round trip on your own workload.

Frequently asked questions

Official sources

1. ajsai47/backdoor on GitHub
2. Issues
3. License: MIT
4. README