LiteLLM Relay

LiteLLM Relay is a proxy you install on employee machines through your MDM. It does two things.

First, it sets up your developers' AI tools for them. On install, Relay auto-detects the AI tools already on the machine — Claude Desktop, Claude Code, and Codex (CLI, VS Code, and the macOS app) — and wires each one to your LiteLLM AI Gateway automatically. There is no per-tool opt-in: if Relay recognizes a tool, it routes it through the Gateway. Developers just launch the tool and sign in with their corporate identity, with no provider API key and no manual setup. See Auto-configuration and the AI Tool Guides below.

Second, it catches shadow AI. Relay detects AI traffic from tools like Notion AI, Perplexity, and OpenClaw and routes it to the Gateway too, making it a single pane of glass for all AI usage in your company.

Usage

1. Install LiteLLM Relay on all your employee devices, using supported MDM
2. Employees use AI tools as they normally would, such as Notion AI.
3. Every request, response, and usage event is captured in LiteLLM.

Auto-configuration

Relay is opt-out, not opt-in. When you install it (or run relay setup), Relay scans the device for supported AI tools and wires every one it finds to the Gateway in a single pass — you never enumerate tools per machine.

Detection also runs on a schedule, so a tool installed after Relay gets wired to the Gateway automatically — no manual re-run. Because each tool's config lives in a different place, the installer registers two periodic jobs (both at login and every RELAY_AUTOCONFIGURE_INTERVAL seconds, default 3600):

The root daemon pins HOME to the installing user so it reads that user's Relay config while running as root. Installing it needs root; install.sh uses sudo when not already root (the macOS .pkg postinstall already runs as root). If it can't get root, Claude Code and Codex still auto-configure and Relay prints a warning for Claude Desktop.

You can still run detection on demand, and scope it with --only:

relay autoconfigure                       # every detected tool
relay autoconfigure --only claude-desktop # just one (repeatable)

Unset flags fall back to the saved Relay config, so a managed config.yaml seeded by your MDM is enough to configure a device with no arguments. Pass --authorize-url, --team, --api-key, or the --oidc-* flags to override. Only detected tools are touched, and one tool failing never blocks the others. Pass --skip-autoconfigure to install.sh to disable it.

Developers see their own usage, locally

Relay also ships an optional macOS menu bar app so each developer can see their own AI spend right on their machine — no dashboard login. It reads live, key-scoped usage from the Gateway and breaks it down per coding tool: spend this month, spend/day, model mix, cache-hit rate, and the relay key's budget.

Each tool (Claude Code, Codex CLI, Cursor, Gemini, …) gets its own tab with its own color. Build it from macos/RelayBarGlass (./build.sh && open RelayBarGlass.app).

AI Tool Guides

Relay onboards each AI coding tool onto the LiteLLM AI Gateway with zero developer setup — the developer just launches the tool. Pick your tool for the step-by-step guide:

• Claude Desktop
• Claude Code CLI
• Codex CLI
• Codex with VS Code

Supported MDMs

Deploy LiteLLM Relay with your existing device-management process:

• Jamf
• Microsoft Intune
• Kandji
• Mosyle
• VMware Workspace ONE
• Addigy
• Custom shell scripts or internal deployment workflows

See the MDM rollout guide for the deployable .pkg, the PAC configuration profile, and step-by-step Jamf and Intune runbooks.

Features

• Detect shadow AI usage across employee devices and company traffic sources
• Route AI traffic through LiteLLM AI Gateway for central visibility
• Log AI activity from desktop apps, browser AI, coding tools, agents, MCP clients, and LLM APIs
• Apply one set of Gateway controls for audit, access, provider routing, and policy

Relay does not log cookies or authorization headers. Payload previews are truncated and headers are redacted.

Install

Relay has no tagged release yet, so install it from GitHub. The installer builds Relay from source, so you need Rust (cargo) installed first. Relay currently supports macOS.

Clone the repository and run the installer:

git clone https://github.com/LiteLLM-Labs/litellm-relay.git
cd litellm-relay
./src/install.sh

Or install directly from main without cloning:

curl -fsSL https://raw.githubusercontent.com/LiteLLM-Labs/litellm-relay/main/src/install.sh | \
  RELAY_ALLOW_UNPINNED_MAIN=1 bash

The installer builds the relay command, adds it to your PATH, and trusts the local Relay CA so AI app payloads can be captured. Pass --skip-trust-ca to install without trusting the CA.

Then open a new terminal and run:

relay

Once tagged releases are published, production deployments will be able to pin a version tag and verify the source archive checksum:

curl -fsSL https://raw.githubusercontent.com/LiteLLM-Labs/litellm-relay/main/src/install.sh | \
  RELAY_VERSION=vX.Y.Z \
  RELAY_SHA256=<release-tarball-sha256> \
  bash