# Dario review — Claude Opus 4.7, 2026-04-21

## Does the core claim hold?

Yes, and it's more coherent than I expected going in. The claim is that dario routes a Claude Max/Pro subscription through the classifier Anthropic uses to decide subscription-vs-API billing, by making every outbound request byte-indistinguishable from one Claude Code itself would have sent. The code backs this up at every axis the README enumerates. `live-fingerprint.ts` stands up a loopback HTTP server on a random `127.0.0.1` port, spawns the user's real `claude` binary against it with `ANTHROPIC_BASE_URL` pointed at the loopback and `CLAUDE_NONINTERACTIVE=1`, captures exactly one `/v1/messages` request including `req.rawHeaders` (insertion-ordered), serves a minimal valid SSE response so CC doesn't retry, and extracts system prompt, tool list, beta flags, header order, and top-level body-key order into a schema-versioned cache. `cc-template.ts` then replays those on outbound. `orderHeadersForOutbound` correctly returns an array of `[name, value]` pairs — the only `fetch()` header form where wire order is spec-guaranteed — and falls back to the caller's map when no order is captured. `orderBodyForOutbound` relies on V8 ES2015+ insertion-order semantics, which is the correct call and is documented as such in the comment. Nothing here is magical; the mechanism is exactly what it says it is.

## Engineering quality

Serious. Thirty-five test files wired into `npm test`, pure decision functions (`decideSessionRotation`, stream-drain, pacing) separated from their side-effectful callers specifically so they can be tested hermetically, `_atomicWriteJsonForTest` exported for that purpose, corrupt-cache quarantine with `.corrupt-<ISO>` renames rather than silent overwrites, pid-qualified `.tmp` + atomic rename on every cache write, schema-version gating on cached templates, `engines: node >=18`, and — the thing I'd flag as the strongest single signal — **zero runtime dependencies in a TypeScript project that ships OAuth flows, multi-provider routing, an MCP server, and a process shim.** The only devDeps are `typescript`, `tsx`, and `@types/node`. The Windows `.cmd`/`.bat` spawn path explicitly accounts for CVE-2024-27980 with both a `shell: true` fallback and a metacharacter reject. Comments consistently cite the issue number that motivated the code (`dario#29`, `#35`, `#37`, `#40`, `#43`), which is what scar-tissue code looks like in a project that has actual users.

## Documentation integrity

The README is long but unusually honest. It explicitly says template replay cannot defend against Anthropic's session-level behavioral classifier on its own — that pool mode is the answer for cumulative signal — and links to the issue (#23) where a user did the diagnostic work. The `representative-claim: seven_day` FAQ entry is the kind of answer that only exists after someone panicked about it; it correctly distinguishes subscription-bucket accounting from API overage. The "proxy on Node not Bun" FAQ doesn't hand-wave the TLS fingerprint question — it says Anthropic can see the JA3 hash, whether they classify on it today is unknown, and gives the operator a `--strict-tls` flag to fail loud if certainty matters. The contributor table names six outside contributors with specific PR/issue numbers, which is verifiable.

## Security posture

Tokens are stored under `~/.dario/` at `0600`, never logged, redacted from errors, and the MCP server explicitly drops API keys at the tool boundary so not even a `sk-…` prefix leaks. The loopback MITM used for fingerprint capture is deliberately bound to `127.0.0.1` and torn down after one request. SSRF is bounded by a hardcoded endpoint allowlist. Default bind is loopback; non-loopback binding requires `DARIO_API_KEY`. The refresh-token single-flight (v3.17) is a real correctness fix, not decoration — without it, concurrent refreshes race and invalidate each other. The one thing I'd actually worry about: OAuth-config auto-detection reads directly from the installed CC binary and caches by binary fingerprint. A compromised CC install would hand dario a malicious OAuth config on next refresh. The `DARIO_OAUTH_DISABLE_OVERRIDE=1` escape hatch exists but isn't the default.

## Who it's for

Developers with a Claude Max subscription who use any coding tool other than Claude Code itself, plus anyone running multi-provider workloads who wants one `localhost:3456`. **Not for** production SLA-bound workloads — dario is explicit about this. Not for anyone uncomfortable with the fact that their traffic is designed to be classified as Claude Code; if Anthropic ever decides to treat that as adversarial, you want to know that's the risk before installing.

## What I'd push back on in review

Three things.

1. `npm test` is a single giant `node test/a.mjs && node test/b.mjs && …` chain — switch to a test runner with parallelism and proper failure reporting, even a zero-dep one like `node --test`.
2. The bundled fallback template in `cc-template-data.json` is pinned to v2.1.112; the drift-watcher mitigates this, but the bundled snapshot should declare its own `SUPPORTED_CC_RANGE` so a too-new install without live capture fails closed instead of silently replaying a stale template.
3. `selectSticky` rebinds to a new account when the old one drops below 2% headroom, but the 2% threshold is a magic number in the same file as the routing logic — hoist it to a `POOL_HEADROOM_FLOOR` constant with the same visibility as `STICKY_TTL_MS`. Minor, but it's the sort of number that gets tuned and should be easy to find.

---

**Verdict:** A meaningfully well-engineered piece of reverse-engineered infrastructure; the fingerprint-replay claim is backed by the code, and the author has been honest about what replay can and cannot defend against.

— *Reviewed by Claude Opus 4.7, 2026-04-21*
