CloudCLI, formerly Claude Code UI, is a self-hosted web interface for coding agents you already run in a terminal: Claude Code, Codex, Cursor CLI and OpenCode. Start the server on your machine and open it from any browser, including a phone on the same network, to get a chat view, an integrated shell, a file explorer with editing, a Git panel for staging, committing and switching branches, and browser sessions for agent web tasks.
It finds your existing sessions in ~/.claude automatically and reads and writes the same configuration, so MCP servers and permissions you set in the UI show up in Claude Code and the other way round. Claude Code's tools start disabled until you enable them, and a plugin system adds tabs and backend services. It is AGPL-3.0 with about 14,300 stars, at v1.37.5 when scanned.
You bring your own subscription: the UI drives the official CLIs and SDKs, which use your existing logins. For the self-hosted version your machine has to stay on, and a paid hosted version, CloudCLI Cloud, is the company's business.
- Repository: github.com/siteboon/claudecodeui
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: TypeScript. Stars: 14.3K. Forks: 2,073. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit 80fbeac
Who it is for
Developers who run Claude Code or Codex on a desktop or server and want to check on or steer sessions from a laptop, tablet or phone, and people who prefer a file tree and Git panel to a bare terminal.
Getting started
1. Run it once with npx (needs Node.js 22 or later)
npx @cloudcli-ai/cloudcli2. Or install it globally for regular use
npm install -g @cloudcli-ai/cloudcli && cloudcli3. Experimental: run agents in an isolated Docker sandbox (needs the sbx CLI)
npx @cloudcli-ai/cloudcli@latest sandbox ~/my-projectThen open http://localhost:3001 and sign in with the account it asks you to create. Enable only the Claude Code tools you need in Tools Settings, and do not expose port 3001 to the internet: whoever can log in can run a shell on your machine.
Safety scan
We cloned siteboon/claudecodeui at commit 80fbeac on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- All 29 secret hits are the placeholder ghp_xxxx text shown in the GitHub token field, repeated across 14 translation files and GithubAuthenticationCard.tsx. There are no real tokens, no suspicious code patterns, no committed binaries and no bare-IP URLs.
- On credentials, read in the cloned code: the provider modules read ~/.claude/.credentials.json and ~/.codex/auth.json only to report whether you are logged in and with which email. The agent work itself goes through the official @anthropic-ai/claude-agent-sdk and @openai/codex-sdk packages, which use those logins as the CLIs do. No telemetry or analytics code turned up in the server or UI, and the UI login uses hashed passwords.
- Install hooks: postinstall runs scripts/fix-node-pty.js, which only sets the execute bit on node-pty's spawn-helper on macOS, and prepare installs husky. In the Docker sandbox, start-cloudcli.sh is sourced from ~/.bashrc inside the sandbox to start the server.
- 257 known advisories in package-lock.json (9 critical), a single lockfile mixing the server's runtime dependencies with build and test tooling. The critical ones include handlebars, tinypool (the test runner), node-tar, shell-quote, basic-ftp and DOMPurify. For a server with shell access, keep it updated.
- 6 workflows, none using pull_request_target; 3 of 8 third-party actions are pinned to a commit. Contributing guide present; no security policy or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 29 candidates found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | 2 npm lifecycle scripts. 2 installer scripts (one edits your shell profile) |
| Committed binaries | None. |
| CI workflows | 6 workflows. None use pull_request_target. 5 of 8 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 31 distinct hosts referenced from source; most often github.com, cloudcli.ai, github.com.helper, git.example.test. No URLs to bare IP addresses. |
| Known vulnerabilities | 257 advisories across 1,805 pinned packages: 9 critical, 118 high, 104 moderate, 26 low. package-lock.json: 1,981 packages, 257 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (29, redacted)
npm lifecycle scripts (2)
package.jsonpostinstall:node scripts/fix-node-pty.jspackage.jsonprepare:husky
Installer scripts (2)
- docker/shared/install-cloudcli.sh, 12 lines
- docker/shared/start-cloudcli.sh, 19 lines, edits your shell profile
Worst known vulnerabilities (24 of 257)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-5rq4-664w-9x2c | critical | basic-ftp@5.0.5 | Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
| GHSA-cg2g-xh64-v4q7 | critical | dompurify@3.4.7 | DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output mo… |
| GHSA-8r5x-fm3f-whwj | critical | handlebars@4.7.9 | Handlebars: JavaScript Injection via AST Type Confusion in compile (bypass of CVE-2026-33937) |
| GHSA-p8wg-vrv2-v86f | critical | handlebars@4.7.9 | Handlebars: JavaScript Injection via Own Property Check Bypass |
| GHSA-jqcg-44mw-7w3h | critical | proxy-addr@2.0.7 | proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet |
| GHSA-w7jw-789q-3m8p | critical | shell-quote@1.8.3 | shell-quote quote() does not escape newlines in object .op values |
| GHSA-23hp-3jrh-7fpw | critical | tar@6.2.1 | node-tar: Decompression/parse DoS via unlimited input |
| GHSA-5gmw-xhrv-c9v3 | critical | tinypool@1.1.1 | Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution |
| GHSA-85c8-ppgw-ccpr | critical | tinypool@1.1.1 | Tinypool: Prototype Pollution Gadget to RCE in run() options |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.18 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.18 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-xjj6-f33q-929c | high | undici@6.28.1 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-3jxr-9vmj-r5cp | high | brace-expansion@1.1.12 | brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups |
| GHSA-6j4f-fj2g-mc7p | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion |
| GHSA-mh99-v99m-4gvg | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash |
| GHSA-qhr7-859c-m2p7 | high | brace-expansion@1.1.12 | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion |
| GHSA-rgw5-rvv9-x895 | high | brace-expansion@1.1.12 | brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation |
| GHSA-2883-xcg3-v3hh | high | js-yaml@4.1.1 | js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources |
| GHSA-52cp-r559-cp3m | high | js-yaml@4.1.1 | js-yaml: YAML merge-key chains can force quadratic CPU consumption |
| GHSA-5p4m-2wfm-xmqj | high | js-yaml@4.1.1 | JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) - CVE-2026-59870 fix not backported |
| GHSA-22jm-h49p-29qw | high | @modelcontextprotocol/sdk@1.29.0 | MCP TypeScript SDK: Experimental tasks were not tied to the session that created them |
| GHSA-46jr-4wx8-v453 | high | @modelcontextprotocol/sdk@1.29.0 | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation |
| GHSA-6qxp-vccf-f47h | high | @modelcontextprotocol/sdk@1.29.0 | MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server |
| GHSA-27r3-jxmh-p828 | high | body-parser@2.2.2 | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body |
By the numbers
| Stars | 14.3K |
|---|---|
| Forks | 2,073 |
| Contributors | 114 |
| Commits | 874 |
| Open issues | 162 |
| Open pull requests | 209 |
| Releases | 92 |
| Latest release | v1.37.5 |
| Licence | AGPL-3.0 |
| Main language | TypeScript |
| Project age | 1 year |
| Last push | Oct 24, 2026 |
| Tracked files | 1,071 |
| Lines of code | 206.4K |
| Checkout size | 11 MB |
Lines by language: TypeScript 156.9K, JSON 29.1K, Markdown 8,452, JavaScript 8,319, CSS 1,819, HTML 1,060.
Questions
Is CloudCLI free?
The self-hosted version is free and open source under AGPL-3.0. You still need your own Claude, Codex or Cursor subscription or API key, and the hosted CloudCLI Cloud is a paid service starting at 7 euros a month.
Is CloudCLI an official Anthropic product?
No. It is an independent open-source project that drives Anthropic's official Claude Code through its SDK, alongside OpenAI's Codex, Cursor CLI and OpenCode.
Can I use Claude Code from my phone with CloudCLI?
Yes. Run the server on your computer and open your computer's IP address and port in a phone browser on the same network. The desktop must stay on for self-hosted use.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.