Claude Code Limiter: Self-Hosted Rate Limiter for Shared Claude Code Subscriptions

What It Solves

When multiple developers share one Claude Code Max subscription without usage controls, a single user can exhaust Anthropic's rate limits by sending too many prompts (like 50 prompts in an hour), locking everyone else out for the day. There's no built-in way to prevent this.

Features

• Per-model quotas — e.g., opus: 5/day, sonnet: 25/day, haiku: 50/day per user
• Credit budgets — single daily budget across all models (opus = 10 credits, sonnet = 3, haiku = 1). Users decide how to spend it.
• Sliding 24h windows — no midnight reset gaming
• Time-of-day rules — restrict expensive models to work hours
• Real-time dashboard — live usage feed, per-user breakdowns, usage charts
• Kill switch — instantly revoke a user's access and force logout, remotely
• Tamper-proof — 6 security layers including managed-settings.json enforcement, file permissions, integrity-checking watchdog, and server-side tracking

How It Works

Setup:

1. Self-host the server — single Docker command on any VPS, cloud, or your network
2. Add users in the dashboard — set their name, limits, credit budget → get an install code
3. Install on each machine — sudo npx @howincodes/claude-code-limiter setup --code CLM-xxx --server https://your-server
4. Done — the hook checks limits on every prompt via Claude Code's managed-settings.json (highest-priority config, can't be overridden by users)

User experience: When a user exceeds their limit, they see: "Daily opus limit reached. Used 5/5 prompts today. All usage today: opus: 5/5 (0 left) sonnet: 12/25 (13 left) haiku: 3/50 (47 left) Credit balance: 15/100 Switch to another model or try again later."

Technical Details

• Client hook: zero npm dependencies, Node.js built-ins only. Installs into managed-settings.json with allowManagedHooksOnly: true so users can't add bypass hooks.
• Server: Express + SQLite + vanilla JS dashboard. Single Docker container, single volume mount.
• Offline-capable: hook caches limits locally, works when server is unreachable, syncs when back online.
• Fail-closed: if someone deletes the config files, all prompts are blocked (not allowed).

Links

• GitHub: github.com/howincodes/claude-code-limiter
• npm (client): @howincodes/claude-code-limiter
• npm (server): @howincodes/claude-code-limiter-server
• Docker: ghcr.io/howincodes/claude-code-limiter:latest

Open source. Self-hostable. MIT licensed.