standalone

Claude Code or Claude Desktop through Agentgateway without a controller

This example runs Dex and Agentgateway locally, then configures Agentdesktop to send Claude traffic through the gateway. Dex issues the user's OAuth access token directly to Agentdesktop. Agentgateway verifies that token against Dex's JWKS before forwarding the request to Anthropic.

This example runs without a controller, and is useful for simple configuration on a single machine.

Prerequisites

• Docker with Compose
• agentdesktop and Claude Code on your PATH
• An Anthropic API key for Agentgateway's upstream requests

Run the example

Create the token Agentgateway sends with token and cost usage to the daemon:

(umask 077 && mkdir -p /tmp/agentdesktop-standalone &&
  openssl rand -hex 32 > /tmp/agentdesktop-standalone/usage-token)

Start Dex and Agentgateway from the repository root. Agentgateway uses host networking to reach the daemon on 127.0.0.1; on Docker Desktop, first enable host networking under Settings > Resources > Network. Linux supports host networking directly.

export ANTHROPIC_API_KEY=sk-ant-...
export AGENTDESKTOP_USAGE_TOKEN="$(cat /tmp/agentdesktop-standalone/usage-token)"
docker compose -f examples/standalone/compose.yaml up -d

Claude Code

Next we can run the agentdesktop daemon to configure Claude Code, and then manage authentication to Agentgateway.

First, we can run an optional dry-run to preview the changes:

$ agentdesktop daemon --config examples/standalone/config.yaml --user --dry-run
Dry run — no files will be changed

UPDATE  Claude Code settings
        /home/john/.claude/settings.json
--- current
+++ proposed
@@ -1,4 +1,12 @@
 {
+  "apiKeyHelper": "'/home/john/.cargo/bin/agentdesktop' --socket '/run/user/1000/agentdesktop.sock' credential --client-id claude-code",
+  "companyAnnouncements": [
+    "Using the local Agentgateway through Agentdesktop"
+  ],
+  "env": {
+    "ANTHROPIC_BASE_URL": "http://127.0.0.1:4001/",
+    "CLAUDE_CODE_API_KEY_HELPER_TTL_MS": "60000"
+  },
   "model": "haiku",
   "permissions": {
     "allow": [

Summary: 1 change, 5 unchanged

Then we can run the daemon, which will actually configure Claude Code:

$ agentdesktop daemon --config examples/standalone/config.yaml --user

When we run claude, we can now see the message we programmed (Using the local Agentgateway through Agentdesktop), and messages we send will traverse Agentgateway.

Usage

Agentgateway sends one access-log record per request to the daemon, which listens on 127.0.0.1:4319 (daemon.usage in config.yaml) and keeps this machine's usage. Open the desktop app and select Usage to see tokens and cost by tool and model.

Pi

Uncomment programs.pi in config.yaml to enable Pi with claude-sonnet-4-5. Run pi while the daemon is running to use that model through the gateway. Pi requires --user; authenticated gateway configuration cannot be applied with --once in user mode. Pi and Claude Desktop can share a policy: user daemons skip Claude Desktop, and system daemons skip Pi, with an inactive reason.

Claude Desktop

In the Claude Code example, we ran with --user. This runs the daemon as an unprivileged user.

Claude Desktop, however, requires root configuration.

Uncomment the Claude Desktop configuration in config.yaml, then save the file. Then run the daemon as root:

sudo "$(which agentdesktop)" daemon \
  --config examples/standalone/config.yaml