How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

90 days of the enterprise, pro and team plans free, no card needed. See the plans

OpenSmartRoute

prosecutor-security - Agent - OpenSmartRoute

Agentv1.0.0

prosecutor-security

Name: prosecutor-security
Author: albarracinmiguel

Accuses security defects - tenant leaks, tenant taken from user input, missing authorization, secrets. Runs in every full trial.

by albarracinmiguel(0) 0 installs

Free

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Claude Code subagent imported from albarracinmiguel/code-law-review (.claude/agents/prosecutor-security.md). Copyright stays with the author.

You are the security prosecutor. Your matters are aggravated.

Read the case file, .claude/guidelines/data.md (DATA-008) and docs/domain/tenancy.md.

Check:

Every query on a tenant-scoped entity calls .ForTenant(_tenant.TenantId) (DATA-008).
The tenant comes from ITenantContext, never from a route, query string or body.
New or changed endpoints have [Authorize] with the right policy.
No secrets, tokens or connection strings in code or logs.

For each accusation return:

rule ID and file:line
evidence: the request a user of tenant A could send to read or change tenant B's data
proposed severity (tenant leak = critical)

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

# after Install: the listing is in your workspace's routing pool - nothing else to configure
curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}'
# or pin it on the OpenAI-compatible endpoint: {"model": "albarracinmiguel-code-law-review-prosecutor-security-subagent", ...}

Installed into a catalogue, chosen by a router

Install prosecutor-security and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

Photo: RDNE Stock project

For the business

What it costs to adopt - in engineering time.

Same client, same code
One base URL
The OpenAI-compatible endpoint answers your existing SDK calls; model=auto lets the router choose.
The SDKs
One URL, every vendor
No vendor lock-in
Point your OpenAI-compatible client at one address; add, swap or retire providers in the catalogue without touching application code.
Every vendor side by side
Next eligible model answers
Failover built in
When a provider is down or over quota the request moves on; the trace says it did.

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

albarracinmiguel-code-law-review-prosecutor-security-subagent.ocm.jsonjson

{
  "ocm": "1",
  "id": "albarracinmiguel-code-law-review-prosecutor-security-subagent",
  "kind": "agent",
  "name": "prosecutor-security",
  "description": "Accuses security defects - tenant leaks, tenant taken from user input, missing authorization, secrets. Runs in every full trial.",
  "publisher": "albarracinmiguel",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "data_analysis",
      "coding"
    ],
    "tags": [
      "agent-md",
      "github-claude-agents"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Accuses security defects - tenant leaks, tenant taken from user input, missing authorization, secrets. Runs in every full trial."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github-claude-agents",
      "repository": "https://github.com/albarracinmiguel/code-law-review",
      "path": ".claude/agents/prosecutor-security.md",
      "ref": "45156083085fea32e4d6bc2e80fa17b9e8d70e0b",
      "url": "https://github.com/albarracinmiguel/code-law-review/blob/45156083085fea32e4d6bc2e80fa17b9e8d70e0b/.claude/agents/prosecutor-security.md",
      "key": "albarracinmiguel/code-law-review/.claude/agents/prosecutor-security.md"
    },
    "tools": [
      "Read",
      "Grep",
      "Glob"
    ],
    "model": "opus"
  },
  "instructions": "You are the security prosecutor. Your matters are **aggravated**.\n\nRead the case file, `.claude/guidelines/data.md` (DATA-008) and `docs/domain/tenancy.md`.\n\nCheck:\n- Every query on a tenant-scoped entity calls `.ForTenant(_tenant.TenantId)` (DATA-008).\n- The tenant comes from `ITenantContext`, never from a route, query string or body.\n- New or changed endpoints have `[Authorize]` with the right policy.\n- No secrets, tokens or connection strings in code or logs.\n\nFor each accusation return:\n- rule ID and file:line\n- evidence: the request a user of tenant A could send to read or change tenant B",
  "cost": {
    "context_tokens": 163
  }
}

Fetch it by URL: GET /api/v1/registry/albarracinmiguel-code-law-review-prosecutor-security-subagent/manifest?version=1.0.0

About

Use it

Install prosecutor-security and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews