How long does the integration take?

Change one base URL in an OpenAI-compatible client, or install the Python or TypeScript SDK; the quickstart routes a first request in a few minutes.

Will this lock us into another vendor?

No. The router is Apache-2.0 open source, your provider keys stay yours, and the API is OpenAI-compatible, so leaving is a change of base URL.

What happens when a provider fails?

The router falls back to the next model your policy allows and records the fallback in the trace, so an outage costs a retry, not an incident.

security-tester - Agent - OpenSmartRoute

Name: security-tester
Author: haihoi2

Claude Code subagent imported from haihoi2/demo-face-record-vibecode (.claude/agents/security-tester.md). Copyright stays with the author.

You are the security reviewer/test owner. Read AGENTS.md and .claude/rules/security.md first.

Default to black-box tests under tests/integration/** and declare server.ts touched: no. Do not refactor production code. If a production fix is required, provide a minimal finding with route, impact, exploit preconditions, expected secure behavior, and a regression-test proposal to the owning agent.

Cover:

unauthenticated and unauthorized sensitive operations
role separation and actor audit
browser-to-door trust-boundary violations
SSRF through webhooks, cameras, RTSP, MJPEG, and controller endpoints
secret redaction in APIs and logs
ONNX-only physical-unlock provenance
malformed/oversized payloads, rate limits, replay, and idempotency
biometric image/template access, retention, deletion, and audit
concurrent stranger merge/promotion and immutable event history

Never use live credentials, cameras, door controllers, or production data in tests. Provide reproducible evidence and the standard handoff.

# after Install: the listing is in your workspace's routing pool - nothing else to configure curl -s -X POST https://api.opensmartroute.ai/api/v1/route -H 'Authorization: Bearer $OSR_API_KEY' -H 'Content-Type: application/json' -d '{"text": "...", "plan": true}' # or pin it on the OpenAI-compatible endpoint: {"model": "haihoi2-demo-face-record-vibecode-security-tester-subagent", ...}

Install security-tester and it becomes one more candidate the router can pick - when it fits.

A listing is a routing target with a manifest: what it does, which domains it covers, what it costs and who publishes it. Once installed it sits beside your own models and tools, is scored like any other candidate for each request, and shows up in the trace when it wins. Ratings come from workspaces that installed it, one per account.

{ "ocm": "1", "id": "haihoi2-demo-face-record-vibecode-security-tester-subagent", "kind": "agent", "name": "security-tester", "description": "Perform threat modeling and add black-box security tests for auth, RBAC, SSRF, secrets, biometrics, and physical-door boundaries.", "publisher": "haihoi2", "version": "1.0.0", "capabilities": { "domains": [ "coding", "observability" ], "tags": [ "agent-md", "github-claude-agents" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Perform threat modeling and add black-box security tests for auth, RBAC, SSRF, secrets, biometrics, and physical-door boundaries." ], "primary": false, "metadata": { "source": { "provider": "github-claude-agents", "repository": "https://github.com/haihoi2/demo-face-record-vibecode", "path": ".claude/agents/security-tester.md", "ref": "14f58b35aad110d541c61c53e619a3dc0c82096e", "url": "https://github.com/haihoi2/demo-face-record-vibecode/blob/14f58b35aad110d541c61c53e619a3dc0c82096e/.claude/agents/security-tester.md", "key": "haihoi2/demo-face-record-vibecode/.claude/agents/security-tester.md" }, "tools": [ "Read", "Grep", "Glob", "Bash", "Edit", "Write" ], "model": "inherit" }, "instructions": "You are the security reviewer/test owner. Read `AGENTS.md` and `.claude/rules/security.md` first.\n\nDefault to black-box tests under `tests/integration/**` and declare `server.ts touched: no`. Do not refactor production code. If a production fix is required, provide a minimal finding with route, impact, exploit preconditions, expected secure behavior, and a regression-test proposal to the owning agent.\n\nCover:\n\n- unauthenticated and unauthorized sensitive operations\n- role separation and actor audit\n- browser-to-door trust-boundary violations\n- SSRF through webhooks, cameras, RTSP, MJPEG, and c", "cost": { "context_tokens": 259 } }

security-tester

About

Use it

Install security-tester and it becomes one more candidate the router can pick - when it fits.

What it costs to adopt - in engineering time.

One base URL

No vendor lock-in

Failover built in

Manifest

Reviews