Claude Code on Kimi, GLM or Grok through your own Cloudflare account
A Claude Code turn that costs $0.0044 instead of $0.21, running Kimi K2.7 Code, billed by Cloudflare, with no Anthropic key and no Moonshot key in the configuration. That is the outcome this page produces. Follow the steps in order and it takes about twenty minutes.
Two reasons to want it. The money: the same work priced at $0.95 per million input tokens instead of $3 to $15, on one invoice you already receive. The obedience: open-weight models such as Kimi K2.7 Code and GLM-5.2 follow an explicit instruction more literally than Claude does, and if your work depends on instructions being followed exactly rather than improved upon, that difference is the point. Both reasons are quantified further down, with the arithmetic shown.
Evidence status
Observed marks first-party measurements or runtime receipts from the named environment. Derived marks arithmetic calculated from cited inputs. Specified marks vendor or standards documentation. Implemented and deployed name code and live-state evidence, respectively. Reproduced means the stated procedure was rerun. Externally attested marks operator reports; those reports show that an experience occurred, not that it is universal.
Every term on this page, defined
| Term | What it means here |
|---|---|
| Claude Code | Anthropic's command-line coding agent. It reads and writes files, runs shell commands, and calls tools. It is a client program: the model it talks to is whatever address you configure. |
| Anthropic Messages API | The request and response format Claude Code speaks: POST /v1/messages with a JSON body. Defined at platform.claude.com/docs/en/api/messages. Full explanation: What the Anthropic Messages API is. |
| Chat Completions | The request and response format most other providers speak: POST /v1/chat/completions. Different field names, different streaming events. Not interchangeable with the Messages API without translation. |
| Cloudflare AI Gateway | A proxy in front of AI providers that adds logging, caching, rate limits, retries and billing. Setup: How to create a Cloudflare AI Gateway. |
| Workers AI | Models Cloudflare hosts and bills directly, named @cf/author/model. Includes Kimi K2.7 Code and GLM-5.2. Details: Workers AI for coding models. |
| Unified Billing | Cloudflare pays the upstream provider and bills you, so no provider API key appears in your configuration. Arithmetic: Cloudflare Unified Billing. |
| BYOK | Bring Your Own Keys. You store the provider's key in the gateway instead of sending it with each request. |
| MCP | Model Context Protocol. How extra tools are attached to a coding agent. Reference: MCP, from its own documents. |
| Tool search | A client setting that stops every MCP tool definition being sent in every request. Cost impact: Why MCP tool schemas are most of your bill. |
| Translator | A program that accepts Anthropic Messages requests and converts them to Chat Completions, then converts the answer back. Also called a shim or a proxy. This page publishes one. |
| Turn | One request-and-response cycle between Claude Code and a model. A single instruction from you usually costs several turns. |
The problem, stated exactly
Claude Code sends POST /v1/messages. Cloudflare's AI Gateway has an endpoint that speaks that format, documented for Claude Code by Cloudflare itself, and it reaches Anthropic's models only.
Every other model in Cloudflare's catalogue — Kimi, GLM, Grok, DeepSeek, MiniMax — is listed as Chat Completions. Each model page in the catalogue states this in a field named Request formats.
| Model | Request formats as catalogued | Reachable by Claude Code unmodified |
|---|---|---|
| anthropic/claude-opus-5 | Anthropic Messages | yes |
| minimax/m3 | Chat Completions, Anthropic Messages | see the measurement below |
| moonshotai/kimi-k3 | Chat Completions | no |
| xai/grok-4.5 | Chat Completions | no |
| deepseek/deepseek-v4-pro | Chat Completions | no |
| @cf/moonshotai/kimi-k2.7-code | Chat Completions | no |
| @cf/zai-org/glm-5.2 | Chat Completions | no |
So one piece is missing: a translator between the two formats. Nothing else about Claude Code needs to change.
Before you start
Five prerequisites. Each one is a link and a check you can run.
- A Cloudflare account. Sign up at dash.cloudflare.com/sign-up. The free plan is enough to deploy the translator; model usage is paid per token.
- An AI Gateway with authentication turned ON. Dashboard path and screenshots: How to create a Cloudflare AI Gateway. Authentication must be on, because Unified Billing refuses an unauthenticated gateway — proof of that refusal is further down.
- A Cloudflare API token with
Workers AI: Read,Workers AI: RunandAI Gateway: Runon your account. Create it at dash.cloudflare.com/profile/api-tokens → Create Token → Create Custom Token, then add those three permission rows. Copy the token once; Cloudflare does not show it again. - Your Cloudflare account ID. Dashboard → any domain → the right-hand sidebar, or the 32-character hex string in your dashboard URL.
- Node.js 20 or newer. Check with
node --version. Install from nodejs.org. Wrangler, Cloudflare's deploy tool, runs throughnpxand needs no separate install.
Route A: Claude models, on your Cloudflare bill, no code
If you only want Claude billed through Cloudflare, stop after this section. Cloudflare documents it and it needs no translator.
export ANTHROPIC_BASE_URL="https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/<GATEWAY_ID>/anthropic"
export ANTHROPIC_API_KEY="<CF_AIG_TOKEN>"
export ANTHROPIC_CUSTOM_HEADERS="cf-aig-authorization: Bearer <CF_AIG_TOKEN>"
claude<CF_AIG_TOKEN> is a gateway token with Run permission. Cloudflare's own words: "The Anthropic endpoint exposes the same /v1/messages API that Claude Code expects."
Check it worked, before starting a session:
curl -s -o /dev/null -w "%{http_code}\n" \
-X POST "$ANTHROPIC_BASE_URL/v1/messages" \
-H "cf-aig-authorization: Bearer <CF_AIG_TOKEN>" \
-H "anthropic-version: 2023-06-01" -H "content-type: application/json" \
-d '{"model":"claude-sonnet-4-5","max_tokens":16,"messages":[{"role":"user","content":"hi"}]}'Expected output: 200. A 403 means the gateway token lacks Run permission. A 401 means the cf-aig-authorization header is missing or wrong.
Route B: any model, through one translator you deploy
Six commands. The translator is one file, MIT licensed, in a public repository.
git clone https://github.com/massoumicyrus/claude-code-cloudflare-gateway
cd claude-code-cloudflare-gateway
npx wrangler secret put CF_ACCOUNT_ID # paste the 32-character account id
npx wrangler secret put CF_API_TOKEN # paste the token from prerequisite 3
npx wrangler secret put SHIM_TOKEN # paste any random string: openssl rand -base64 24
npx wrangler deploywrangler deploy prints the URL it deployed to, in the form https://claude-code-cloudflare-gateway.<your-subdomain>.workers.dev.
Point Claude Code at it:
export ANTHROPIC_BASE_URL="https://claude-code-cloudflare-gateway.<your-subdomain>.workers.dev/<SHIM_TOKEN>"
export ANTHROPIC_AUTH_TOKEN="<SHIM_TOKEN>"
export ANTHROPIC_API_KEY=""
export ANTHROPIC_MODEL="kimi"
export ANTHROPIC_DEFAULT_OPUS_MODEL="kimi"
export ANTHROPIC_DEFAULT_SONNET_MODEL="kimi"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="glm-flash"
export CLAUDE_CODE_SUBAGENT_MODEL="kimi"
export ENABLE_TOOL_SEARCH=true
export CLAUDE_CODE_ATTRIBUTION_HEADER=0
claudeWhy each line exists:
ANTHROPIC_BASE_URL— the address Claude Code sends every request to. The token is the last path segment because an existingclaudelogin can overrideANTHROPIC_AUTH_TOKEN; measured on the desktop app, which sent its own credential instead of the variable. A token in a URL can appear in logs, so the translator also accepts it in anx-api-keyheader if you prefer that.ANTHROPIC_AUTH_TOKEN— sent asAuthorization: Bearer.ANTHROPIC_API_KEYis sent asx-api-keyinstead. Setting the wrong one produces a silent401.ANTHROPIC_MODELand the three_DEFAULT_lines — Claude Code fills four model slots, not one. Leave any of them unset and that slot asks for a Claude model your gateway does not serve.ANTHROPIC_DEFAULT_HAIKU_MODEL— the background slot: session titles, summaries, quick classifications.glm-flashis@cf/zai-org/glm-4.7-flashat $0.06 per million input tokens, the cheapest model in the catalogue that still calls tools reliably.ENABLE_TOOL_SEARCH=true— stops every MCP tool definition being sent in every request. This single line changed a measured turn from 149,187 input tokens to 14,109. Explanation and measurements: Why MCP tool schemas are most of your bill.CLAUDE_CODE_ATTRIBUTION_HEADER=0— stops Claude Code prepending a value that changes on every request to the front of the system prompt, which prevents any upstream cache from ever matching. Detail below.
Verify before trusting it:
node tools/contract-test.mjs "https://<your-worker-host>/<SHIM_TOKEN>" kimi21 checks, each printing PASS or FAIL: the response envelope, usage numbers, stop-reason mapping, the streaming event sequence in order, a streamed tool call whose arguments arrive incrementally and parse as JSON, a second turn that reads a tool result, token counting, the model list, and a wrong token being refused. All 21 pass on the reference deployment as of 2026-07-25.
Which name gets you which model
Type the name on the left. The model on the right runs. Anything unrecognised resolves to the default rather than silently calling Anthropic.
| What you type | What runs | Context | Billed as |
|---|---|---|---|
kimi | @cf/moonshotai/kimi-k2.7-code | 262,144 tokens | Workers AI |
k3 | moonshotai/kimi-k3 | 1,048,576 tokens | Unified Billing |
glm | @cf/zai-org/glm-5.2 | 262,144 tokens | Workers AI |
glm-flash | @cf/zai-org/glm-4.7-flash | 131,072 tokens | Workers AI |
grok | xai/grok-4.5 | per catalogue | Unified Billing |
minimax | minimax/m3 | per catalogue | Unified Billing |
opus5 / sonnet5 | anthropic/claude-opus-5 / -sonnet-5 | per catalogue | Unified Billing |
Two names exist for one reason. The desktop client checks model names against a list of Anthropic-shaped names and refuses anything else before sending a request, so claude-kimi-k2.7-code and claude-glm-5.2 also work and route to the same models. Any name containing kimi, glm, grok or gpt resolves to that family.
One table in the translator generates both this mapping and the list served at /v1/models. The first version generated them separately, and claude-kimi-k3 quietly ran K2.7 while claude-glm-flash ran GLM-5.2 at twenty times the input price. A published name that routes elsewhere is worse than no list at all.
The money, with the arithmetic
Published rates, per million tokens, from Cloudflare's Workers AI pricing page:
| Model | Input | Cached input | Output |
|---|---|---|---|
| @cf/moonshotai/kimi-k2.7-code | $0.95 | $0.19 | $4.00 |
| @cf/zai-org/glm-5.2 | $1.40 | $0.26 | $4.40 |
| @cf/zai-org/glm-4.7-flash | $0.06 | none published | $0.40 |
Four turns measured through one gateway, read from its own log rows:
| Configuration | Model | Input | Cached | Output | Cost | Latency |
|---|---|---|---|---|---|---|
| MCP attached, no tool search | @cf/zai-org/glm-5.2 | 149,443 | 64 | 18 | $0.20922644 | 10.9 s |
| MCP attached, no tool search | @cf/moonshotai/kimi-k2.7-code | 149,187 | 64 | 19 | $0.02852109 | 4.6 s |
| MCP disabled entirely | @cf/moonshotai/kimi-k2.7-code | 21,928 | 13,312 | 45 | $0.01089448 | 2.8 s |
| MCP attached, tool search on | @cf/moonshotai/kimi-k2.7-code | 14,109 | 12,480 | 128 | $0.00443075 | 1.6 s |
Read those four rows in order and three facts follow.
Fact one: the tool definitions, not the conversation, are the bill. Row four is the same MCP server as rows one and two, all its tools still reachable, at one tenth the input tokens — and cheaper than row three, which had no MCP server connected at all.
Fact two: the model choice is a 7.3× multiplier on the same turn. $0.20922644 against $0.02852109 for an identical 149k-token request.
Fact three: one row does not reconcile, and that is stated rather than smoothed. The GLM row multiplies out exactly — 149,379 uncached tokens at $1.40 per million is $0.20913, plus output, against a logged $0.20922644. The two small Kimi rows reconcile the same way. The second Kimi row does not: 149,123 uncached tokens at $0.95 per million should be $0.1417, and the log says $0.02852109, an effective $0.191 per million, which is the cached rate applied to input the same row reports as 64 tokens cached. Cloudflare's documentation calls the cost field "an estimation based on the number of tokens sent and received". Treat per-row cost as the platform's estimate and the token counts as the hard numbers. Every ratio above is computed from token counts.
What that means per month. At 60 turns of real agent work per day, 22 working days, with tool search on and the measured $0.00443 per turn: 60 × 22 × $0.00443 = $5.85 per month. The same 1,320 turns at the un-tuned GLM figure of $0.20922644 would be $276. A Claude Max subscription is $100 or $200 per month depending on tier. The comparison that matters is not model against model, it is tuned configuration against untuned: the same models, the same work, a 47× difference from two environment variables.
The two settings that decide the bill
Tool search. Claude Code's default is to send every tool definition from every connected MCP server in every request. Captured on the same machine, same prompt, back to back:
ENABLE_TOOL_SEARCH=false tools=856 ['Agent','AskUserQuestion','Bash','CronCreate', ... 852 more]
ENABLE_TOOL_SEARCH=true tools=9 ['Agent','AskUserQuestion','Bash','Edit','Read',
'Skill','ToolSearch','Workflow','Write']The nine include a ToolSearch tool the model calls when it needs something not in front of it. Whether a non-Claude model actually uses it is the question that matters, because a deferred tool nobody looks for is a broken tool. Kimi K2.7 Code was asked for a tool it had never been shown; it called ToolSearch, found the tool named TIME_NOW, invoked it, and returned the payload:
{"now":"2026-07-25T18:35:56-07:00","today":"2026-07-25","time":"18:35:56",
"zone":"America/Los_Angeles","iso":"2026-07-25T18:35:56-07:00"}Anthropic's prompt-caching documentation states that MCP tool search is unavailable behind a custom ANTHROPIC_BASE_URL gateway, and Moonshot's own Claude Code guide instructs setting ENABLE_TOOL_SEARCH=false. On claude-cli 2.1.165 against this gateway it worked and cut input tokens 10.6×. Both pages may be describing other versions or other endpoints. Re-check it on your version with the capture tool below rather than trusting any of the three claims, including this one.
The attribution line. Claude Code prepends a line of this shape to the system prompt:
x-anthropic-billing-header: cc_version=2.1.177.01c; cc_entrypoint=sdk-cli; cch=<NONCE>;The cch= value changes on every request. api.anthropic.com removes that line by position before the model sees it. Every other provider receives it, and because it sits in front of a 20,000-token prefix that would otherwise be identical between turns, no cache can match. Measured effect here: cached input per turn went from 64 tokens to between 12,480 and 14,976 once the line was gone. Set CLAUDE_CODE_ATTRIBUTION_HEADER=0 on the client, and the translator removes the block server-side as well. Never merge or reorder the system array around it: the removal is positional, and a merged block beginning with that header takes the rest of your system prompt with it.
Why obedience is a reason on its own
Price is measurable and above. This is the other reason, stated plainly.
A model trained to be maximally helpful will improve on your instruction. It will add the thing you did not ask for, soften the thing you asked for bluntly, and summarise where you asked for the literal output. For a reader who needs an instruction executed exactly as written, that is not a small friction — it is the defect, and it is the trained behaviour, not a bug in a particular reply.
Open-weight models fine-tuned for coding — Kimi K2.7 Code, GLM-5.2 — are trained against benchmarks that reward completing the stated task. In practice they take a literal instruction more literally. That claim is not a benchmark result and is not presented as one; the benchmark numbers below say Claude leads on task completion. It is an operating observation, and the reason a cost-neutral switch can still be worth making: the cheaper model is also the one that does what the line says.
The structural point underneath it: an agent you can point at any model is an agent whose behaviour you can choose. An agent locked to one vendor's tuning is that vendor's judgement about what you meant. Everything above exists so that choice costs six commands instead of a rewrite.
What people who did this report
Real accounts, positive and negative, quoted and linked. These are anecdotal reports from individuals, not measurements.
Every documented route, ranked
1. The vendor's own Anthropic-format endpoint. Shortest path, no proxy, no Cloudflare. You lose the single invoice and the gateway's logs.
# Kimi (Moonshot)
export ANTHROPIC_BASE_URL="https://api.moonshot.ai/anthropic"
export ANTHROPIC_AUTH_TOKEN="$MOONSHOT_API_KEY"
export ANTHROPIC_MODEL="kimi-k3[1m]"
export ENABLE_TOOL_SEARCH="false" # required by Moonshot's own guide
# GLM (Z.ai)
export ANTHROPIC_BASE_URL="https://api.z.ai/api/anthropic"
# DeepSeek — claude-opus* maps to v4-pro, claude-sonnet*/haiku* to v4-flash
export ANTHROPIC_BASE_URL="https://api.deepseek.com/anthropic"2. OpenRouter. One key, hundreds of models, officially supported, no proxy: "When you set ANTHROPIC_BASE_URL to https://openrouter.ai/api, Claude Code speaks its native protocol directly to OpenRouter. No local proxy server is required." Billed by OpenRouter, and also reachable as a first-class provider inside AI Gateway.
3. Cloudflare custom providers. Register any HTTPS base URL as custom-<slug> and the gateway forwards your path to it, so a vendor's own Anthropic endpoint sits behind your gateway with its logging, caching and rate limits. The vendor still bills you; Unified Billing does not apply.
4. LiteLLM. The most complete translator in existence and a proxy you must run and keep running. Correct on streaming, tool calls, thinking blocks with signatures, images and token counting. Its cache_control pass-through is limited to Claude and Bedrock targets, so cache breakpoints are dropped against a plain chat-completions backend anyway.
5. claude-code-router. 36,000 stars, actively developed, desktop app and CLI. Translation is delegated to a separate package; its npm latest tag has lagged its GitHub releases, so check the version you installed before trusting a number from its README.
6. A local model, which needs no translator at all. This inverted between late 2025 and early 2026: llama.cpp, vLLM, Ollama and LM Studio all serve /v1/messages natively now. llama.cpp merged it on 2025-11-28 and implements token counting; Ollama shipped it in v0.14.0 and explicitly does not support token counting, tool_choice, metadata or cache_control; LM Studio recommends at least 25,000 tokens of context "since Claude Code can be quite context-heavy." Any guide that tells you to run a proxy for a local model is out of date.
What breaks, and the exact fix
| Symptom | Cause | Fix |
|---|---|---|
402 with Gateway authentication is required to use unified billing | Unified Billing is refused on a gateway with authentication off | Turn authentication on for that gateway and send cf-aig-authorization |
Catalogue models 402 while @cf/ models work | Same cause. Workers AI does not need Unified Billing | Same fix |
401 on every request, curl works | Wrong variable: ANTHROPIC_AUTH_TOKEN sends Authorization: Bearer, ANTHROPIC_API_KEY sends x-api-key | Match the variable to what your endpoint accepts; the translator here accepts either, plus the path token |
| Main thread works, subagents and session titles fail | Only ANTHROPIC_MODEL was set; the background and subagent slots still ask for a Claude model | Set ANTHROPIC_DEFAULT_HAIKU_MODEL and CLAUDE_CODE_SUBAGENT_MODEL |
400 naming thinking or adaptive | The client sends thinking: {"type":"adaptive"} to models that reject it | Use a translator that drops the field, or set CLAUDE_CODE_DISABLE_THINKING=1 |
400 invalid thinking: only type=enabled is allowed for this model on subagents only | The client omits thinking on subagent and structured-output calls; some endpoints require it | Known open defect against Moonshot's endpoint; the translator route avoids it by never forwarding the field |
Model missing from /model | Gateway model discovery is off by default and drops every id not starting with claude or anthropic | Set CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1, or select with claude --model <name> |
| Turn ends with no visible output | Kimi and GLM spend the output budget on reasoning before answering; an empty assistant turn aborts the client | Raise max_tokens; the translator falls back to the reasoning text so the turn is never empty |
| Cost per turn far above the published rate | The attribution line is defeating the upstream cache | CLAUDE_CODE_ATTRIBUTION_HEADER=0, and strip the block in the translator |
| Anthropic still receives usage metrics | Setting ANTHROPIC_BASE_URL alone does not turn metrics off | DISABLE_TELEMETRY=1 |
403 with an HTML body, gateway logs show nothing | A web application firewall inspected the request body; prompts contain XML-like tags and code | Exempt /v1/messages from body inspection |
Two limits of the whole approach, in Anthropic's words and mine. Anthropic: it "doesn't endorse, maintain, or audit third-party gateway products, and doesn't support routing Claude Code to non-Claude models through any gateway." That is an unsupported configuration, not a prohibited one — no term forbids it — and it means the client changes when Anthropic changes it, and you catch up. Mine: images are forwarded, thinking is not, and prompt caching is whatever the upstream does with a prefix.
Do the cheaper models do the work
On identical independent harnesses, the open models sit one tier behind Claude, not two. SWE-bench Verified on mini-SWE-agent 2.0.0, one attempt each: Claude Opus 4.5 76.8, GLM-5 72.8, Claude Sonnet 4.5 71.4, Kimi K2.5 70.8. Terminal-Bench 2.1 with Claude Code as the harness: Fable 5 83.8, Opus 4.8 78.9, Sonnet 5 74.6, GLM-5.1 58.7, with no Kimi entry at all.
Every vendor-published score that has an independent counterpart is higher than the independent one. GLM-4.6: 68.2 on Z.ai's own scaffold, 55.4 on mini-SWE-agent. Kimi K2.5: 76.8 in-house, 70.8 independent. Claude Opus 4.6: 80.4 in-house over 25 trials, 75.6 independent. The direction is uniform, so read the scaffold before the score.
Two more facts before anyone builds an argument on a leaderboard: the official SWE-bench Verified board's newest submission is from February 2026, and Anthropic stopped publishing SWE-bench Verified in text from Opus 4.7 onward — Opus 5 publishes neither it nor Terminal-Bench.
Verify every measurement on this page yourself
Nothing here needs to be taken on trust. Two tools, both in the repository.
The wire capture. A local server that speaks the Anthropic Messages format, logs exactly what the client sent, and answers with a valid response. This is where every request-shape number on this page came from.
node tools/capture-gateway.mjs # listens on :8787, appends capture.jsonl
ANTHROPIC_BASE_URL=http://localhost:8787 ANTHROPIC_AUTH_TOKEN=x claude -p "say ok"What one capture on claude-cli 2.1.165 recorded, 2026-07-25:
HEAD / user-agent: Bun/1.3.14
POST /v1/messages?beta=true model=<ANTHROPIC_MODEL> max_tokens=32000 tools=861
POST /v1/messages?beta=true model=<HAIKU_SLOT> max_tokens=1024 tools=0
anthropic-version: 2023-06-01
anthropic-beta: claude-code-20250219,oauth-2025-04-20,interleaved-thinking-2025-05-14,
context-management-2025-06-27,prompt-caching-scope-2026-01-05,
mid-conversation-system-2026-04-07,effort-2025-11-24,extended-cache-ttl-2025-04-11
system: [ 92 chars, 62 chars, 5681 chars ] cache_control: [ none, ephemeral, ephemeral ]Four constraints for anyone writing a translator follow from that capture, and the reference implementation obeys all four: match on the path because the query string is present; serve both model slots; keep the system array in its original order; and expect the tool list, not the prompt, to dominate the payload.
The contract test. 21 checks against a live deployment, listed earlier in Route B. Run it after every change.
The complete requirement list for a translator
Seven behaviours. Each one is a real defect in at least one published shim, so each is checked by the contract test.
- Stream. A gateway that buffers whole responses stalls the client.
- Emit tool arguments incrementally —
content_block_start, theninput_json_deltachunks — not one blob at the end. - Order tool results correctly. Anthropic puts
tool_resultblocks inside a user turn; Chat Completions wantsrole:"tool"messages immediately after the assistant turn that called them. - Map stop reasons:
stoptoend_turn,lengthtomax_tokens,tool_callstotool_use. Nobody can producestop_sequencefaithfully, because Chat Completions returnsstopfor both cases with no discriminator. - Never return an empty turn. Fall back to the reasoning text when the output budget was spent before any answer.
- Answer
/v1/messages/count_tokens. It is optional, and without it the client estimates locally; an estimate beats a 404. - Remove the attribution block without reordering the
systemarray.
Four Cloudflare Workers shims exist and each fails at least one of these: luohy15/y-router is archived and drops max_tokens; glidea/claude-worker-proxy is active but sends tool arguments as one blob, has no token-count route and drops images; tingxifa/claude_proxy types system as a string, which is not the shape the client sends; mrdear/cloudflare-ai-proxy ignores images by design.
What this costs to keep running
The translator is a Cloudflare Worker. On the free plan that is 100,000 requests per day at no charge; a heavy day of agent work is a few hundred. The gateway itself is free; its logs are retained per your plan. Model tokens are the only real cost, at the rates above. Unified Billing adds 5% on purchased credits and passes provider pricing through with no markup, and Workers AI models are billed as Workers AI rather than through it — the arithmetic of that split is in Cloudflare Unified Billing.
One security fact to hold onto: Cloudflare states that AI Gateway token permissions "cannot be restricted to a single gateway", so a token with Run reaches every gateway on the account, including any holding stored provider keys. Rate-limit the gateway you use for this — 120 requests per 60 seconds is enough for one operator and caps the damage if a token leaks.
Key evidence
20 more ranked claims
Model review30 contributions · 1 modelExpand the recursive review layer
/api/articles/claude-code-on-cloudflare-ai-gateway/contributionsAsk this article · 8 suggested prompts
Text the build (+14245134626) or WhatsApp — slug|question creates a question node. Paste evidence with ingest slug|q:NODE_ID|your paste.