Anyray Connect
anyray-connect is the on-ramp: one command that signs a developer in and points their
coding tools at your Anyray gateway.
What it does
Connect finds the AI tools installed on a machine and edits each tool's own config so its requests go through the gateway — where they are tracked, attributed, and optimized. Three things to know:
- It only edits tool config. Base URLs and provider entries in each tool's own settings files. No CA certificates, no machine-wide proxy or DNS changes.
- Keys stay where they belong. The org's provider API keys stay on the gateway. Each
developer gets their own short-lived gateway key (
ark_…), minted when they enroll. - It's reversible.
--revertrestores every config Connect wrote.
What it configures
| Tool | What Connect changes | ID |
|---|---|---|
| Claude (API) | the env block in ~/.claude/settings.json — ark_ key as token | claude-code |
| Claude (Subscription) | same env block — your own Claude sign-in stays | claude-code |
| Claude Desktop | its third-party gateway mode | claude-desktop |
| Codex (app, CLI, IDE) | ~/.codex/config.toml — anyray becomes the default provider | codex |
| Cursor | OpenAI custom endpoint (BYOK) for Ask/Plan chat | cursor |
| VS Code Copilot Chat | an Anyray chat provider (VS Code 1.121+) | copilot |
| GitHub Copilot CLI | COPILOT_PROVIDER_* env in your shell profile — seat-billed via the gateway's Copilot carrier route when a Copilot sign-in is readable, org-billed BYOK under --org / with no seat | copilot-cli |
| OpenCode | its direct API providers and its Copilot provider | opencode |
| JetBrains AI Assistant | Anyray Claude and Codex agents in its agent registry | jetbrains |
| Devin Desktop | Anyray Claude and Codex agents in its agent registry | windsurf |
| Shell & SDKs | base-URL env vars in the shell profile | shell-env |
Tools that aren't installed are skipped. To configure only some, pass --tools with a
comma-separated list of ids from the table.
Behind any base URL that isn't Anthropic's own, Claude Code stops looking a model's
capabilities up and budgets a flat 200,000-token window, compacting at ~95% of it. So if you
pin a model in ~/.claude/settings.json, Connect asks the gateway what that model's window
actually is, then hands the answer back through the knob Claude Code reads for that model id:
- A Claude model with a million-token window gets its long-context alias —
modelbecomesclaude-opus-4-8[1m]. Same model, long-context variant. Claude Code skipsCLAUDE_CODE_MAX_CONTEXT_TOKENSforclaude-*ids, so the alias is the setting that actually restores the window. - Any other model id gets
env.CLAUDE_CODE_MAX_CONTEXT_TOKENS, which is exactly where Claude Code reads a window for a model it has no table of its own for.
Both are client-side only; nothing is added to your requests. Connect never picks a model for
you — with no pinned model, or a window it can't resolve, it writes nothing and Claude Code
keeps its own default. --revert undoes both, leaving an alias you set yourself alone.
One thing Connect can't reach: a --model flag on your launch command, or a model picked
inside the app, overrides settings.json. Add the alias there too, quoting it in zsh —
claude --model 'claude-opus-4-8[1m]'.
How to run it
An admin creates a passwordless enrollment link in Console → Users, or shares the org's SSO command.
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --enroll https://app.anyray.ai/enroll/enl_…
# or, with enterprise SSO:
curl -fsSL https://app.anyray.ai/connect.sh | sh -s -- --sso https://app.anyray.ai/sso/tnt_…
Enrollment mints your personal gateway key and sets your name and team for spend
attribution. Connect then detects your tools, shows what it will change, and writes each
tool's config. Add --dry-run to preview without writing anything.
Editors that were running pick up the new config on restart.
npx anyray-connect status shows which tools point at the gateway, plus your gateway, name,
and team. If something looks wrong, npx anyray-connect doctor diagnoses gateway
reachability and each tool's config.
Staying current
Connect installed with connect.sh keeps itself on the published release. About every 30
minutes it checks which version is current, and if the machine is on a different one it
downloads that build, verifies its SHA-256 checksum against the published SHA256SUMS, and
swaps it in. Commands you run after that use the new version immediately; nothing you
configured is rewritten, because every tool, hook, and service points at the same stable path.
It follows the published version in both directions. If a release turns out to be bad and Anyray un-publishes it, machines move back to the previous build on their next check — the previous version is still on disk, so that costs a file swap, not a download.
| Command | What it does |
|---|---|
anyray-connect update | Check and install now instead of waiting for the next check |
anyray-connect update --check | Report which version is published; change nothing |
anyray-connect update --auto off | Stop updating this machine automatically |
anyray-connect update --auto on | Resume automatic updates (and update now) |
A release Anyray marks mandatory — a security or correctness fix — still installs on a
machine that has opted out. Everything else waits for you to run anyray-connect update.
Your own Claude/ChatGPT plan vs. the org API key
By default each tool uses the developer's own subscription (Claude or ChatGPT seat) where
one is detected and supported, and the org's API key otherwise. Force it one way with
--subscription (always the developer's own plan) or --org (always the org key). See
Anthropic — subscription login for how the seat lane works.
Updating an npm install
npx anyray-connect@latest already resolves the current release on every run, so npm installs
have nothing to keep current and don't self-update. anyray-connect update reports this rather
than changing anything. The same is true of a copy your IT team placed on the machine — that
one is theirs to roll.
Undoing a run
npx anyray-connect --revert restores every tool config Connect wrote and clears the stored
enrollment. Restart any editor that was running. Reconnecting later needs a fresh enrollment
link or the SSO command.