把 Claude Code 和 Codex
变成多租户服务 Claude Code and Codex,
as a multi-tenant service

高仿 Claude / Codex，隔离环境，完美支持 DeepSeek / Anthropic / OpenAI。 A close copy of Claude and Codex, an isolated environment per user, and DeepSeek, Anthropic or OpenAI behind it. 

curl -fsSL https://u.kfd.me/X7 | sh

多租户，一人一个隔离环境Multi-tenant, one isolated environment each

每个用户一个容器：非 root、CapDrop ALL、内存 / CPU / PID 限额，只挂载自己的工作目录。装什么跑什么互不影响，对话也各自私密。 A container per user: non-root, all capabilities dropped, memory / CPU / PID limits, and only that user's workspace mounted. What one installs or runs reaches nobody else, and conversations stay their own.

DeepSeek / Anthropic / OpenAI 都能接DeepSeek, Anthropic and OpenAI

多条上游同时生效，用户选模型、请求按模型走。同一个模型可以挂两条上游，各配各的价格。 Several upstreams at once, and a request follows the model it asks for. One model can be served by two of them, priced separately.

计费、配额、限速Billing, quotas and rate limiting

按 token 或按金额计费，价格表可改而历史账单锁定当时价格。配额分 5 小时 / 周 / 月三个窗口，在一个 turn 内部就能刹住。每条上游各有自己的并发闸门。 Billed by tokens or by money, with past bills keeping the price of their time. Quotas run on three windows — five hours, a week, a month — and stop a turn from inside it. Each upstream has a concurrency gate of its own.

网页端和 CLI 都能用The web app and your own CLI

网页是高仿 Claude 的对话界面；本机照常敲 claude / codex，一条命令接进来。Anthropic Messages 与 OpenAI Responses 两套协议都兼容。 A close copy of the Claude interface in the browser, and claude / codex on your own machine, connected with one command. Both wire protocols are spoken: Anthropic Messages and OpenAI Responses.

请求怎么走Where a request goes

每一次调用都经过计量网关：它按模型决定发往哪条上游，逐次记账，配额和限速也在这一步。 Every call goes through the metering gateway: it picks the upstream from the model, books the usage call by call, and applies the quota and the rate limit there.

浏览器browser
→
app
→
agent 容器agent container claude / codex 只有 20 分钟票据holds a ticket only
→
gateway 在这里换成上游 tokenthe upstream token goes on here 计量 · 配额 · 审计metering · quota · audit
→
上游upstream

功能Features

账号Accounts

  • 邀请码注册、邮件定向邀请Invite-code registration and email invites
  • token 轮转，重放即判定泄漏并撤销全部会话Token rotation; a replayed token is treated as a leak and every session is revoked
  • 多设备管理、停用即时踢线Multi-device management, instant lockout on suspend

计量与配额Metering and quota

  • 逐次调用从 SSE 流里旁路解析 usageUsage sniffed off the SSE stream, call by call
  • 5 小时 / 周 / 月三个窗口，边界全平台统一Three windows — 5 hours, a week, a month — the same instants for everybody
  • 每个用户看到的是自己的额度，不是共享池Each user is shown their own allowance, never the shared plan's
  • 按 token 或按金额计费，历史账单锁定当时价格Billing by tokens or by money; past bills keep the price of their time

记忆与画像Memory and profile

  • 助手在对话里自己记，下次对话自动读回The assistant writes memory as you talk and reads it back later
  • 看得到、改得动、删得掉，改坏了能撤销Read it, correct it, delete it, undo a bad change
  • 每个对话一句话总结，并换成说明内容的标题Every conversation summarised in a line, and named after what it was about
  • 使用画像纯统计，不经过模型The usage profile is counted, never inferred

接入方式Ways in

  • 网页对话、附件、Markdown + 代码高亮The web app, with attachments, Markdown and syntax highlighting
  • 自带 CLI：一条命令装好，照常敲 claudeYour own CLI: one command to install, then run claude as usual
  • Anthropic Messages 与 OpenAI Responses 两套协议Both wire protocols — Anthropic Messages and OpenAI Responses
  • 多条上游同时生效，按模型路由，同一模型可挂多条、各配各的价格Several upstreams at once, routed by model — one model can be served by two of them, priced separately

运维Operations

  • 出网审计代理，完整 prompt 落盘An audit proxy that records every outbound request, full prompt
  • 额度、价格、并发、上游与模型后台热改，无需重启Quotas, prices, concurrency, upstreams and models change without a restart
  • 界面与提示 9 种语言，覆盖率由测试保证Nine languages throughout, with coverage checked by tests