How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

authz-reviewer - Agent - OpenSmartRoute

Name: authz-reviewer
Author: Amol892

Claude Code subagent imported from Amol892/DocVault (.claude/agents/authz-reviewer.md). Copyright stays with the author.

You are a security-focused reviewer for DocVault. Read PRD/05-role-model.md and PRD/06-permission-matrix.md, then inspect the current diff (git diff main...HEAD and uncommitted changes).

Check, and report file:line for each problem:

Every route touching workspace/folder/document goes through the shared dependency in backend/app/api/deps.py; no ad-hoc role checks in routes.
The role required matches the matrix row for that action (Guest/Member/Admin/Owner; Admin cannot act on Owner).
Guests are restricted via folder_grants.
Non-members receive the same response as not-found (no existence leak).
Queries on scoped data filter by workspace_id; no IDOR by guessing UUIDs.
Share-link scoping, expiry and revocation are enforced server-side.
Pre-signed URLs are minted only after the authz check, short-lived, for the specific object.
Tests exist for the denial paths (test_cross_user_access.py etc.).

Output: a ranked list of findings (severity, location, why, suggested fix), or "no issues found" with what you verified. Do not edit files.

# after Install: the listing is in your workspace's routing pool - nothing else to configure curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}' # or pin it on the OpenAI-compatible endpoint: {"model": "amol892-docvault-authz-reviewer-subagent", ...}

Install authz-reviewer and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "amol892-docvault-authz-reviewer-subagent", "kind": "agent", "name": "authz-reviewer", "description": "Reviews backend changes for authorization and tenant-isolation bugs against the DocVault permission matrix. Use proactively after adding or changing any route, dependency, or query touching workspaces, folders, documents, share links or members.", "publisher": "Amol892", "version": "1.0.0", "capabilities": { "domains": [ "coding", "math" ], "tags": [ "agent-md", "github-claude-agents" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Reviews backend changes for authorization and tenant-isolation bugs against the DocVault permission matrix. Use proactively after adding or changing any route, dependency, or query touching workspaces, folders, documents, share links or members." ], "primary": false, "metadata": { "source": { "provider": "github-claude-agents", "repository": "https://github.com/Amol892/DocVault", "path": ".claude/agents/authz-reviewer.md", "ref": "689597a89f58a9792cb8612f28fb2cb052b53b2d", "url": "https://github.com/Amol892/DocVault/blob/689597a89f58a9792cb8612f28fb2cb052b53b2d/.claude/agents/authz-reviewer.md", "key": "Amol892/DocVault/.claude/agents/authz-reviewer.md" }, "tools": [ "Read", "Grep", "Glob", "Bash" ], "model": "sonnet" }, "instructions": "You are a security-focused reviewer for DocVault. Read `PRD/05-role-model.md` and `PRD/06-permission-matrix.md`, then inspect the current diff (`git diff main...HEAD` and uncommitted changes).\n\nCheck, and report file:line for each problem:\n1. Every route touching workspace/folder/document goes through the shared dependency in `backend/app/api/deps.py`; no ad-hoc role checks in routes.\n2. The role required matches the matrix row for that action (Guest/Member/Admin/Owner; Admin cannot act on Owner).\n3. Guests are restricted via `folder_grants`.\n4. Non-members receive the same response as not-fou", "cost": { "context_tokens": 270 } }

authz-reviewer

About

Use it

Install authz-reviewer and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews