AI Command Center
One gateway. Every AI project. One dashboard.
- Status
- Live · npm + PyPI · MIT
- Role
- Designer, author, maintainer — solo
- Stack
- Node.js ≥18 — zero runtime deps · Vanilla JS/CSS dashboard · Python + JS SDKs · Next.js docs site · GitHub Actions CI
Every team running LLMs has the same blind spot: spend is scattered across provider consoles, and nobody can answer "what did this feature cost us yesterday?" AI Command Center is my answer — a self-hosted gateway you point any app at with a one-line base-URL change. Requests pass through untouched; every token, cost, and millisecond lands in one dashboard. No SDK adoption, no database, no telemetry wiring. npx ai-command-center and you're running.
The one-line pitch is literal
Integration is a single base-URL swap — OpenAI(base_url="http://localhost:4321/p/invoice-bot/openai/v1") — in any language. The /p/<project> path segment groups calls per project. API keys pass through; prompt and response bodies are never stored.
The gateway proxies 11+ providers — OpenAI, Anthropic, Gemini, OpenRouter, Mistral, DeepSeek, xAI, Groq, Together, Ollama, plus anything OpenAI-compatible — and reads real token usage on the way past to compute exact per-request cost, shown in rupees, dollars, or euros at live FX rates.
Zero dependencies, on purpose
The npm gateway package has zero runtime dependencies — pure Node stdlib. CI installs nothing. The dashboard is vanilla JS and CSS. This isn't asceticism: a tool that watches your infrastructure shouldn't be a supply-chain risk itself, and it should still start in seconds on a bare VM.
Pricing never silently drifts: config overrides → a daily-refreshed community price sheet (cached to disk) → stale cache → a shipped hand-curated dataset. Four layers of fallback, so costs stay exact even offline.
Built like a product, not a demo
Traces and sessions, prompt-version metrics, model comparison, budgets with anomaly alerts and webhooks. RBAC with admin/member/viewer roles, per-project gateway keys, and last-admin lockout protection. Opt-in provider routing fans requests across failover or round-robin pools.
A /api/track endpoint ingests non-LLM AI spend too — speech-to-text, TTS, telephony, image generation — with shared trace IDs, so an entire pipeline reads as one session. The docs are honest about failure modes: the gateway is not fail-open, and the README says so, with supervision examples and a kill-switch story.
All benchmarks run against an in-process mock upstream — no keys, no network. Reproduce with npm run evals; CI runs the smoke version.
SSE passthrough with usage capture
Streaming responses have to flow through unbuffered — but token counts live at the end of the stream. The proxy detects `text/event-stream`, measures TTFB, and where needed injects `stream_options.include_usage` and relays the stream while recovering usage from the final frames. Getting backpressure right so a slow client can't balloon gateway memory was one of the hardest bugs.
A random web page must not spend your keys
The dashboard runs on localhost, which makes CSRF and cross-origin abuse a real threat model. I wrote an explicit origin policy: no-Origin and same-origin requests are trusted, everything else must be allowlisted. Auth is scrypt-hashed passwords (async, so hashing never stalls proxied traffic) and HMAC-signed cookies compared with timing-safe equality.
Exact cost, not estimates
Cost accounting uses real token counts including cached tokens, priced against a 4-layer fallback dataset with live FX. Verified by recomputing 20 provider/model/token-mix cases independently: zero mismatches.