Orientim is a self-hosted, local-first budget guard for AI agents — from download to your first hard-stopped agent in about five minutes. No account, no cloud; everything below happens on your own machine.
8000 and 8501 must be free — Orientim runs locally on them.Download the build for your OS and open it. Because the app is new and not yet code-signed, your system will warn you the first time — this is expected. Here's how to get past it safely.
Windows (.exe)
Double-click orientim.exe. If SmartScreen appears, click
More info, then Run anyway.
Microsoft Defender SmartScreen prevented an unrecognized app from starting.
App: orientim.exe · More info
macOS (.dmg)
Open the .dmg and drag Orientim to Applications. On first launch,
right-click the app → Open, then confirm Open
in the dialog (a normal double-click won't offer the button the first time).
This will not harm your Mac. Right-click → Open to launch it once; macOS remembers your choice.
Once it starts, Orientim lives in your menu bar / system tray and opens the
dashboard in your browser at http://localhost:8501.
Paste the license key from your purchase email and click Activate. This is the one and only time the app talks to the network — after that it works fully offline.
An "agent" is just one of your provider API keys with a hard budget cap attached. Click Add agent, then fill in four things:
Your real key is stored locally and masked immediately (sk-v…1234). Repeat
for as many keys/agents as you like — each has its own independent limit.
Each agent card shows a local address to send traffic to. You keep using your tool
exactly as before — you just change where it points and use the local key
orientim-secure-key in place of your real one.
Claude Code — step by step
Claude Code reads two environment variables. Copy them from the agent's card in Orientim,
set them in your terminal, then run claude. That's the whole setup.
1. Copy the connection from the agent's card in Orientim:
2. Paste them in your terminal, then run Claude Code:
3. Done — Claude Code
now runs through Orientim, and every call counts toward your cap. To make it permanent, add
the two export lines to your shell profile (~/.zshrc or
~/.bashrc).
Continue / Cline (VS Code)
In the model config, set the API base and key:
apiBase: http://127.0.0.1:8000/proxy/<agent-id>/v1 apiKey: orientim-secure-key
Aider
OPENAI_API_BASE=http://127.0.0.1:8000/proxy/<agent-id>/v1 OPENAI_API_KEY=orientim-secure-key aider --model gpt-4o
Any OpenAI-compatible SDK
# python client = OpenAI( base_url="http://127.0.0.1:8000/proxy/<agent-id>/v1", api_key="orientim-secure-key", )
There are two keys, and telling them apart is the whole trick:
sk-…) — entered once in the dashboard.
You never put this in your tools again.orientim-secure-key) — what your tools use instead.
It stays on your machine.Orientim checks the local key, then swaps in your real key only on the call to the official API. It all happens on your computer — nothing about your keys leaves it:
your tool → sends orientim-secure-key Orientim → checks limit, swaps in sk-…real provider ← official API responds, cost is metered on the way back
Every call is metered as its response comes back and written to a local request log —
model, token split, stop reason and cost. When an agent reaches its budget cap, the card
turns red and further requests are hard-stopped with HTTP 402 — no new spend
is possible until you raise the cap yourself.
To resume, open the agent and raise its cap (or reset spend). You're always the one in control — nothing lifts the block automatically.
"It doesn't work with Cursor"
Correct — Cursor routes its AI through its own cloud rather than calling providers directly from your machine, so no local tool can sit in front of it. Use Claude Code, Continue, Cline, Aider, or any tool where you control the base URL.
The dashboard won't open
Make sure nothing else is using ports 8000 or 8501. Then open
http://localhost:8501 manually. On Windows, if startup fails, a
proxy_error.log file is written next to the app with details.
My tool gets a 401
The tool must send orientim-secure-key as its API key — not your real key,
and not a blank value. Double-check the base URL includes the full
/proxy/<agent-id> path from the agent card.
Costs look slightly off
Cost is exact where the provider reports it (e.g. OpenRouter). For others it's computed from token usage and model rates, which you can adjust in the pricing settings. Claude prompt-caching is approximate.