MiMo Code Free Model Proxy

MiMo Code is Xiaomi’s AI coding tool with a free quota — but only usable inside MiMo Code. Let’s break it open.

Reverse-Engineering the Auth

The free API needs no login. Auth is done via a bootstrap endpoint:

POST https://api.xiaomimimo.com/api/free-ai/bootstrap
Body: {"client": "<device fingerprint>"}
Response: {"jwt": "eyJhbG..."}

Just sniff the traffic. No OAuth, no API key, no session — one POST gets you a JWT for the chat API.

Device Fingerprint

The client param is a locally generated fingerprint:

import hashlib, platform, os

def get_fingerprint() -> str:
    raw = "|".join([
        platform.node(),                        # hostname
        platform.system().lower(),              # darwin / linux / windows
        platform.machine(),                     # arm64 / x86_64
        platform.processor() or "unknown-cpu",  # CPU model
        os.environ.get("USER") or "unknown",    # username
    ])
    return hashlib.sha256(raw.encode()).hexdigest()

It’s persisted to ~/.local/share/mimocode/mimo-free-client so the same machine always bootstraps to the same token:

from pathlib import Path

FINGERPRINT_FILE = Path.home() / ".local/share/mimocode/mimo-free-client"

def get_fingerprint() -> str:
    if FINGERPRINT_FILE.exists():
        return FINGERPRINT_FILE.read_text().strip()
    fp = hashlib.sha256(...).hexdigest()
    FINGERPRINT_FILE.parent.mkdir(parents=True, exist_ok=True)
    FINGERPRINT_FILE.write_text(fp)
    FINGERPRINT_FILE.chmod(0o600)
    return fp

Parsing the JWT

The JWT’s exp field tells you when it expires:

def _parse_jwt_exp(jwt: str) -> float:
    # JWT payload is base64url-encoded JSON
    parts = jwt.split(".")
    pad = 4 - len(parts[1]) % 4
    payload = json.loads(base64.urlsafe_b64decode(parts[1] + "=" * pad))
    return payload.get("exp", time.time() + 3600) * 1000  # milliseconds

The proxy auto-refreshes 5 minutes before expiry:

async def get_token(self) -> str:
    if self._jwt and self._exp - time.time() * 1000 > 300_000:  # 5 min left
        return self._jwt
    # ... bootstrap for a new token

Concurrency Safety

When multiple requests notice expiry at once, only one bootstrap should fire:

async def get_token(self) -> str:
    if self._bootstrapping:  # another request is already bootstrapping
        return (await self._bootstrapping)[0]  # wait and reuse
    self._bootstrapping = asyncio.ensure_future(self._bootstrap())
    try:
        self._jwt, self._exp = await self._bootstrapping
        return self._jwt
    finally:
        self._bootstrapping = None

Request Forwarding

With the token, forward to the chat endpoint:

POST https://api.xiaomimimo.com/api/free-ai/openai/chat
Headers:
  Authorization: Bearer <jwt>
  X-Mimo-Source: mimocode-cli-free
  User-Agent: mimocode/0.1.0 ai-sdk/provider-utils/4.0.23 runtime/bun/1.3.14
Body: <OpenAI-format JSON>

But you can’t just pass through — the client format differs from standard OpenAI.

Body Rewriting

def _prepare_body(body: bytes) -> bytes:
    payload = json.loads(body)

    messages = payload.get("messages", [])
    normalized = []
    has_system_prompt = False

    for msg in messages:
        item = dict(msg)

        # MiMo Code uses developer role; standard is system
        if item.get("role") == "developer":
            item["role"] = "system"

        # Check for existing system prompt
        if item.get("role") == "system" and isinstance(item.get("content"), str):
            if item["content"].startswith("You are MiMoCode"):
                has_system_prompt = True

        normalized.append(item)

    # Inject default prompt if none present
    if not has_system_prompt:
        normalized.insert(0, {
            "role": "system",
            "content": "You are MiMoCode, an interactive CLI tool..."
        })

    payload["messages"] = normalized

    # MiMo requires stream_options for streaming
    if payload.get("stream"):
        payload.setdefault("stream_options", {"include_usage": True})

    return json.dumps(payload, separators=(",", ":"), ensure_ascii=False).encode()

Retry on Expiry

Auto re-bootstrap on 401/403:

resp = await client.send(req)
if resp.status_code in (401, 403):
    await jwt_mgr.invalidate()           # discard old token
    token = await jwt_mgr.get_token()    # bootstrap anew
    resp = await client.send(req)        # retry

Streaming Passthrough

SSE is piped directly without decoding:

async def _send_streaming(body: bytes):
    token = await jwt_mgr.get_token()
    client = httpx.AsyncClient(timeout=120)
    resp = await client.send(
        client.build_request("POST", CHAT_URL, headers=_build_headers(token), content=body),
        stream=True,
    )

    async def stream():
        try:
            async for chunk in resp.aiter_bytes():
                yield chunk
        finally:
            await resp.aclose()
            await client.aclose()

    return StreamingResponse(stream(), media_type="text/event-stream")

MiMo’s stream is already standard SSE — just pipe it through.