TracerLLM_PROVIDER environment variable, with LLM_AUTH_METHOD selecting API-key or OAuth auth where both are supported. Defaults are tracked in config/config.py and routing lives in core/llm/llm_client.py.
Quick reference
| Provider | LLM_PROVIDER | Auth | Reasoning model default | Toolcall model default |
|---|---|---|---|---|
| Anthropic API key | anthropic + LLM_AUTH_METHOD=api_key | ANTHROPIC_API_KEY | claude-sonnet-4-6 | claude-haiku-4-5-20251001 |
| Anthropic OAuth | anthropic + LLM_AUTH_METHOD=oauth | Onboarding launches claude auth login | Claude Code CLI default | Claude Code CLI default |
| OpenAI API key | openai + LLM_AUTH_METHOD=api_key | OPENAI_API_KEY | gpt-5.4-mini | gpt-5.4-mini |
| OpenAI OAuth | openai + LLM_AUTH_METHOD=oauth | OpenSRE opens localhost:1455 for Codex-compatible OAuth | Codex CLI default | Codex CLI default |
| OpenRouter | openrouter | OPENROUTER_API_KEY | openrouter/auto | openrouter/auto |
| DeepSeek | deepseek | DEEPSEEK_API_KEY | deepseek-v4-pro | deepseek-v4-flash |
| Google Gemini API key | gemini | GEMINI_API_KEY | gemini-3.1-pro-preview | gemini-3.1-flash-lite-preview |
| Google Gemini CLI | gemini-cli | gemini interactive login or API key env | Gemini CLI default | Gemini CLI default |
| Google Antigravity CLI | antigravity-cli | agy browser OAuth / OS keyring | Antigravity CLI configured model | same as reasoning model |
| NVIDIA NIM | nvidia | NVIDIA_API_KEY | meta/llama-3.1-405b-instruct | meta/llama-3.1-8b-instruct |
| MiniMax | minimax | MINIMAX_API_KEY | MiniMax-M3 | MiniMax-M2.7-highspeed |
| Amazon Bedrock | bedrock | AWS IAM (AWS_REGION) | us.anthropic.claude-sonnet-4-6 | us.anthropic.claude-haiku-4-5-20251001-v1:0 |
| Ollama (local) | ollama | None (local daemon) | llama3.2 | llama3.2 |
| GitHub Copilot CLI | copilot | copilot login or gh auth login (CLI) | Copilot CLI default | Copilot CLI default |
| xAI Groq API key | groq | GROQ_API_KEY | llama-3.3-70b-versatile | llama-3.1-8b-instant |
| xAI Grok Build CLI | grok-cli | grok login (CLI) | Grok Build CLI default | Grok Build CLI default |
| Pi CLI (BYOK) | pi | provider API key env or pi → /login | Pi configured model (PI_MODEL to override) | same as reasoning model |
- Reasoning model — full-capability model used for diagnosis, claim validation, and multi-step analysis.
- Toolcall model — lightweight, lower-cost model used for tool selection and routing.
Selecting a provider
SetLLM_PROVIDER (default: anthropic) in your environment or .env file:
.env:
ANTHROPIC_API_KEY. OpenSRE keeps the provider as
anthropic or openai; LLM_AUTH_METHOD=oauth selects the OAuth-backed runtime.
OAuth browser login, token storage, refresh, and logout are delegated to the
vendor CLI that owns that account session. OpenSRE owns the onboarding UX and
does not persist OAuth tokens directly.
In the interactive shell, /model shows curated quick-pick choices for common models. Providers
with fast-changing or account-gated catalogs (OpenAI, OpenRouter, Gemini, NVIDIA, Bedrock, local
CLIs, Ollama, and DeepSeek) also accept custom model IDs:
LLM_MAX_TOKENS (default 4096) controls the response token budget for every provider.
Login and secret storage
Useopensre auth for provider login without writing secrets to .env:
| Command | What it does |
|---|---|
opensre auth | Show auth status for subscription and API-key providers |
opensre auth login deepseek | Open DeepSeek setup guidance, validate DEEPSEEK_API_KEY, store it in the system keychain, and select DeepSeek |
opensre auth login claude | Configure the claude-code provider through Claude Code CLI subscription login |
opensre auth login chatgpt | Configure the codex provider through OpenSRE-managed ChatGPT OAuth |
opensre auth verify deepseek | Intentionally resolve DeepSeek credentials and refresh stale local metadata |
opensre auth logout deepseek | Remove OpenSRE-managed DeepSeek credentials and metadata |
opensre auth login never reads browser cookies, browser profiles, browser local storage, or IndexedDB. API-key providers use hidden paste prompts plus keyring storage. OpenAI OAuth is handled by OpenSRE’s local Codex-compatible callback server; other subscription providers delegate OAuth/session handling to the vendor CLI that owns the browser login flow.
opensre auth and /auth status are prompt-safe: they do not read API-key secrets from Keychain. For API-key providers they inspect environment variables plus non-secret metadata in ~/.opensre/llm-auth.json. If a key was deleted directly from Keychain, status may show the old metadata until you run opensre auth verify <provider> or start a request; that verification marks the provider stale when the secret is gone.
For Codex CLI auth, status checks do not run codex login status by default,
because some Codex versions can open browser OAuth while checking a session.
Run /login chatgpt or opensre auth login chatgpt from an interactive
terminal when you need to refresh the browser login. OpenSRE starts its own
temporary callback server on http://localhost:1455/auth/callback, exchanges
the short-lived OAuth code, and writes Codex-compatible tokens to the local
Codex auth store before redirecting the browser to the Codex-style
/success?id_token=... completion page. If a browser flow reaches /success
with token material directly, OpenSRE stores that token material instead of
dropping the callback. Use codex login only as a direct CLI fallback.
Inside the interactive shell, use the same flows through /auth or /login:
API providers
Anthropic
OpenAI
o1, o3, o4, gpt-5*) automatically use max_completion_tokens instead of max_tokens.
OpenRouter
https://openrouter.ai/api/v1.
DeepSeek
https://api.deepseek.com.
Run opensre auth login deepseek for browser-assisted key setup and secure local storage.
Google Gemini
https://generativelanguage.googleapis.com/v1beta/openai/. Get an API key at aistudio.google.com.
NVIDIA NIM
https://integrate.api.nvidia.com/v1. Browse available models on build.nvidia.com.
MiniMax
https://api.minimax.io/v1. Temperature is fixed to 1.0 to match MiniMax recommendations.
Amazon Bedrock
InvokeModel / Converse access scoped to those resources in IAM).
Model routing:
- Anthropic Claude on Bedrock (
anthropic.claude-*,us.anthropic.claude-*, and foundation-model ARNs that containanthropic.claude) use the existing AnthropicBedrock SDK path. - Other Bedrock foundation models (for example Mistral, Meta Llama, Amazon Titan IDs you enable in your account) use the Bedrock Converse API via
boto3, so you can setBEDROCK_REASONING_MODELto a non-Claude model ID when your use case requires it. - Application inference profile ARNs (
…:application-inference-profile/…) do not encode the vendor in the ID; those are always sent through Converse, which works for any backing model in the profile.
config/config.py are US cross-region inference profile IDs for Anthropic Claude; override with IDs or ARNs that are inference-access enabled in your account and region.
Ollama (local)
${OLLAMA_HOST}/v1.
CLI providers (subprocess)
CLI-backed providers shell out to a vendor CLI instead of an HTTP API during inference. OpenSRE detects the binary onPATH (or via an explicit env var) and reuses the existing session. OpenAI OAuth is stored by OpenSRE in Codex-compatible auth format; other CLI-backed providers authenticate via the vendor’s own login command.
Investigation timeouts: Each ReAct turn runs one full CLI subprocess with the system prompt, tool schemas, and conversation history. The shared default subprocess budget is 300 seconds (Python adds a small buffer). Override per provider when needed, for example GEMINI_CLI_TIMEOUT_SECONDS, CLAUDE_CODE_TIMEOUT_SECONDS, or ANTIGRAVITY_CLI_TIMEOUT_SECONDS (clamped 30–600 where the adapter supports it).
OpenAI OAuth backend
CODEX_MODEL is unset, OpenSRE omits -m so codex exec uses the CLI’s currently configured model. If CODEX_BIN is unset, the binary is resolved via PATH and known install locations.
Run opensre onboard, /login chatgpt, or opensre auth login chatgpt to launch
OpenSRE-managed Codex browser login on localhost:1455 and persist
LLM_PROVIDER=openai with LLM_AUTH_METHOD=oauth. Existing
LLM_PROVIDER=codex configs still work for backward compatibility.
Anthropic OAuth backend
npm i -g @anthropic-ai/claude-code). If CLAUDE_CODE_MODEL is unset, OpenSRE omits the --model flag and the CLI uses its configured default. If CLAUDE_CODE_BIN is unset, the binary is resolved via PATH and known install locations.
Run opensre onboard, /login claude, or opensre auth login claude to launch
Claude browser login when needed and persist LLM_PROVIDER=anthropic with
LLM_AUTH_METHOD=oauth. Existing LLM_PROVIDER=claude-code configs still work
for backward compatibility.
GitHub Copilot
npm i -g @github/copilot). Login uses the interactive /login slash command or copilot login. OpenSRE detects auth in this order: (1) COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN env, (2) gh auth status when gh is on PATH (including ✓ Logged in to github.com account …, - Active account: true, or a supported - Token: prefix: gho_, github_pat_, ghu_ per Copilot docs — not ghp_), with gh auth status --hostname … when COPILOT_GH_HOST or GH_HOST targets a non-github.com host. It does not read plaintext $COPILOT_HOME/config.json (keychain-backed installs may omit it; mis-parsing arbitrary JSON risks false positives). If nothing matches, detection reports logged_in=None and the runner verifies at invoke time. If COPILOT_MODEL is unset, OpenSRE omits --model. Invocations run as copilot -p PROMPT --no-color --no-ask-user --silent so they never block on user input. BYOK / COPILOT_OFFLINE: GitHub auth may be unnecessary; a None probe can still be fine if Copilot is configured for offline or external providers only.
Google Antigravity CLI
agy) is Google’s successor to Gemini CLI. Install via curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy install to configure your shell PATH. The minimum tested version is 1.0.1 — older builds log a warning via the probe and direct you to agy update.
Why two Google providers? Google’s transition announcement states that on 2026-06-18 Gemini CLI stops serving Pro/Ultra and free users. Paid Gemini Code Assist licences keep Gemini CLI indefinitely. OpenSRE keeps both gemini-cli (deprecated alias with a probe-time notice) and antigravity-cli so either group can run without surprises.
As a best-effort fallback, the probe treats explicit GEMINI_API_KEY / GOOGLE_API_KEY / GOOGLE_APPLICATION_CREDENTIALS env credentials as authenticated (mirroring the Gemini CLI adapter), so users migrating across the two CLIs can keep their existing env-var-based auth without re-running the browser flow.
Invocations run as agy -p PROMPT --print-timeout {N}s. The adapter never passes --continue / --conversation / --sandbox / --dangerously-skip-permissions, keeping every opensre call ephemeral.
xAI Grok Build CLI
grok). Install with
curl -fsSL https://x.ai/cli/install.sh | bash (macOS/Linux) or
irm https://x.ai/cli/install.ps1 | iex (Windows). If GROK_CLI_MODEL is unset, OpenSRE
omits -m and the CLI uses its configured default. The wizard populates the model list live
from grok models at onboarding time so newly released models appear without an OpenSRE update.
Invocations run as grok -p PROMPT --output-format plain, so each opensre call is a single
non-interactive turn. The adapter deliberately omits --always-approve: OpenSRE drives its own
tools, so Grok is used purely as a text responder and never auto-executes shell commands or file edits.
Auth detection: auth is probed via grok models (~0.5 s, no LLM call), which prints
“You are logged in” on success. XAI_API_KEY is treated as an authenticated fallback for
headless / CI runs even when the probe result is unclear. XAI_API_KEY is forwarded only
to the Grok subprocess (never via the shared CLI env allowlist), so it cannot leak into other
CLI adapters.
Not to be confused withgroq. Thegrok-cliprovider is xAI’s Grok Build CLI. The separategroqprovider is the Groq HTTP API (a different company); the two are unrelated.
Pi CLI
npm i -g @earendil-works/pi-coding-agent). Pi is
bring-your-own-key across ~30 providers, so PI_MODEL uses the provider/model form
(for example google/gemini-2.5-flash-lite, anthropic/claude-haiku-4-5, openai/gpt-4o-mini);
run pi --list-models for the full catalog. If PI_MODEL is unset, OpenSRE omits --model
and Pi uses its configured default. If PI_BIN is unset, the binary is resolved via PATH
and known install locations.
Invocations run as pi -p PROMPT (non-interactive print mode), so each OpenSRE call is a
single headless turn with no TTY.
Auth detection: Pi has no non-interactive auth-status command, so OpenSRE detects auth
from state: (1) a supported provider API key in the environment (GEMINI_API_KEY,
ANTHROPIC_API_KEY, OPENAI_API_KEY, …) → authenticated; (2) otherwise, credentials stored
in ~/.pi/agent/auth.json (written by pi’s /login, covering OAuth subscriptions and
stored keys) → authenticated; (3) neither → not authenticated. Provider API keys are forwarded
only to the Pi subprocess, never via the shared CLI env allowlist, so they cannot leak into
other CLI adapters.
See integrations/llm_cli/AGENTS.md for the adapter pattern used to add new CLI providers.
Reasoning effort (interactive shell)
In the TTY REPL (opensre with no subcommand), /effort stores a session preference for how strongly reasoning models should think before answering. It applies only when LLM_PROVIDER is openai (HTTP API) or codex (Codex CLI); other providers ignore the setting and the shell notes that.
| Input | Sent to the model |
|---|---|
low, medium, high, xhigh | same string |
max | xhigh |
/effort alone to show the current choice (or (default) when unset) and the usage line. /new starts a fresh session but keeps /effort (and trust mode), consistent with other session prefs.
Outside the REPL, optional defaults use the environment variable:
/effort overrides this for interactive runs. Implementation: config/llm_reasoning_effort.py.
Provider diagnostics
OpenSRE does not silently switch LLM providers when the provider inLLM_PROVIDER is missing credentials. It keeps the configured provider selected and reports missing or stale auth status before starting LLM work.
-
opensre authand/auth statusshow prompt-safe status from environment variables, provider metadata, CLI probes, or ambient/local config. -
opensre auth verify <provider>intentionally checks request-time credentials and refreshes metadata. -
opensre config llmandopensre doctorreport the configured provider plus credential status without resolving secrets. -
Provider errors are prefixed with the configured provider that served the request:
opensre auth login <provider>, or change LLM_PROVIDER to a provider you have configured.
Switching providers at runtime
OpenSRE caches LLM clients on first use. To switch providers within a single process (tests, benchmarks), callreset_llm_singletons() from core.llm.llm_client after updating the env vars; otherwise a fresh process picks up the new LLM_PROVIDER automatically.
Where this lives in the code
- Provider literals and defaults:
config/config.py(LLMProvider,LLMSettings). - Runtime routing:
core/llm/llm_client.py(_create_llm_client). - API-backed provider guide:
core/llm/AGENTS.md. - CLI-backed provider guide:
integrations/llm_cli/AGENTS.md.