Skip to main content
OpenSRE works with many model providers. You choose which one with LLM_PROVIDER. Hosted providers use an API key stored in ~/.opensre/credentials.json (or the process environment). Default model IDs are defined in config/config.py. Routing is in core/llm/factory.py. Each provider has two model roles:
  • Reasoning — used for diagnosis, claim checks, and multi-step analysis
  • Toolcall — a lighter model used for tool selection and routing

​
Quick reference

​
Selecting a provider

Set LLM_PROVIDER (default: anthropic) in your environment or .env file:
Or use the onboarding wizard, which writes the same values to .env:
Onboarding always collects an API key for hosted providers. In the interactive shell, /model lists common models. Some providers also accept custom model IDs (OpenAI, OpenRouter, TrustedRouter, Gemini, NVIDIA, Bedrock, local CLIs, Ollama, and DeepSeek):
GPT-5.6 has three tiers: gpt-5.6-sol (flagship), gpt-5.6-terra (balanced), and gpt-5.6-luna (lower cost). The bare gpt-5.6 name maps to Sol. Override defaults with env vars:
LLM_MAX_TOKENS (default 4096) sets the response token budget for all providers.

​
LiteLLM transport

You can send hosted API providers through LiteLLM instead of the native vendor SDK. This is optional for most providers and required for Azure OpenAI. CLI providers (codex, claude-code, copilot, pi, cursor, opencode, kimi, and others) always run as a subprocess. LiteLLM does not apply to them.

​
Providers supported via LiteLLM

When OPENSRE_LLM_TRANSPORT=litellm (or LLM_PROVIDER=azure-openai), OpenSRE builds the same investigation tool schemas as the SDK path and passes them to litellm.completion(..., tools=..., tool_choice="auto"). LiteLLM routes the request; OpenSRE still handles schema cleanup, retries, and message replay.
For GPT-5.6 agent tool calls, the native OpenAI SDK uses the Responses API and replays reasoning and function-call items between steps. Older OpenAI models and OpenAI-compatible providers still use Chat Completions. LiteLLM supports many more backends. OpenSRE only wires the providers listed above. Use one of those, or open an issue if you need another first-class provider.

​
Login and secret storage

Use opensre auth to log in and persist an API key: opensre auth login uses a hidden paste prompt and writes the key to .env and ~/.opensre/credentials.json. opensre auth and /auth status are safe to show in prompts: they do not read stored secrets. For API-key providers they check environment variables and non-secret metadata in ~/.opensre/llm-auth.json. If you delete a key from the credentials file directly, status may look stale until you run opensre auth verify <provider> or make a request. Verification marks the provider stale when the secret is gone. In the interactive shell:

​
API providers

Open a provider for environment variables and setup notes.
Default provider. Uses the Anthropic Python SDK. Get an API key at console.anthropic.com.Claude Fable 5 (claude-fable-5) is also available (/model set claude-fable-5, onboarding, or the Claude Code CLI provider). It costs more than Opus, so it is not the default — select it only when you want it.
Uses the OpenAI SDK. Reasoning models (o1, o3, o4, gpt-5*) use max_completion_tokens instead of max_tokens.
Azure OpenAI always goes through LiteLLM. Model env vars are deployment names from your Azure resource, not public OpenAI model IDs.
Quick setup:
Onboarding asks for your resource URL, API key, then lists deployments for you to pick. OpenSRE sets AZURE_OPENAI_API_VERSION=2024-10-21 and OPENSRE_LLM_TRANSPORT=litellm unless you override them in .env.In the REPL:
If deployment discovery fails during onboarding, enter the deployment name by hand. It must match a deployment in your Azure resource, not a model ID from /openai/models.
Point OpenSRE at an arbitrary base URL — a LiteLLM proxy, vLLM, LocalAI, or an internal model gateway — when direct calls to the public APIs are not allowed.custom-openai reuses the OpenAI-compatible client:
custom-anthropic uses the Anthropic SDK with a base-URL override:
Both require the base URL and a model — onboarding and startup fail if either is missing, rather than reaching a wrong endpoint mid-investigation.
  • The base URL is used verbatim. Include the API path yourself (for example /v1 for OpenAI-compatible gateways). OpenSRE never appends a path.
  • custom-anthropic is SDK-only. It ignores OPENSRE_LLM_TRANSPORT=litellm and errors if you force it; use custom-openai for a LiteLLM-proxied OpenAI-compatible endpoint.
  • Run with opensre --debug (or set TRACER_VERBOSE=1) to print the resolved provider, redacted base URL (host only — never a token), and model.
Quick setup:
OpenAI-compatible proxy. Pick any model on openrouter.ai/models. Base URL: https://openrouter.ai/api/v1.
OpenAI-compatible proxy. Base URL: https://api.trustedrouter.com/v1; keys at trustedrouter.com/keys.Model ids are namespaced (anthropic/claude-opus-4-7, openai/gpt-5.4-mini) — a bare gpt-5.4-mini is rejected. Ids under trustedrouter/ are routing policies rather than single models: each picks an upstream per request and fails over if it is down.The full catalog is at api.trustedrouter.com/v1/models.
Uses DeepSeek’s OpenAI-compatible API at https://api.deepseek.com. Run opensre auth login deepseek for guided key setup and secure local storage.
Uses Google’s OpenAI-compatible endpoint at https://generativelanguage.googleapis.com/v1beta/openai/. Get an API key at aistudio.google.com.
Uses NVIDIA’s OpenAI-compatible API at https://integrate.api.nvidia.com/v1. Browse models on build.nvidia.com.
OpenAI-compatible endpoint at https://api.minimax.io/v1. Temperature is fixed at 1.0 to match MiniMax guidance.
Uses Groq’s OpenAI-compatible API at https://api.groq.com/openai/v1.
No API key. Auth uses the AWS credential chain (environment variables, shared credentials file, or IAM role). Your principal needs permission to invoke the model IDs you configure (for example Bedrock InvokeModel / Converse access for those resources).Model routing:
  • Anthropic Claude on Bedrock (anthropic.claude-*, us.anthropic.claude-*, and foundation-model ARNs that contain anthropic.claude) use the AnthropicBedrock SDK path.
  • Other Bedrock foundation models (for example Mistral, Meta Llama, or Amazon Titan IDs enabled in your account) use the Bedrock Converse API via boto3. You can set BEDROCK_REASONING_MODEL to a non-Claude model ID when needed.
  • Application inference profile ARNs (…:application-inference-profile/…) do not encode the vendor in the ID. Those always use Converse, which works for any model behind the profile.
Defaults in config/config.py are US cross-region inference profile IDs for Anthropic Claude. Override with IDs or ARNs that are enabled for inference in your account and region.
No API key. Auth uses Google Application Default Credentials (ADC): run gcloud auth application-default login, set GOOGLE_APPLICATION_CREDENTIALS to a service-account key file, or use the GCE/GKE metadata server. Your principal needs the Vertex AI User role (or equivalent) on the project.Always routed through LiteLLM as vertex_ai/<model> (same pattern as Azure OpenAI). The wizard lists Gemini models; you can also type any other Vertex-supported model ID (allow_custom_models).Defaults (gemini-2.5-pro / -flash / -flash-lite) are the GA Gemini generation. Gemini 3.x (gemini-3.1-pro-preview, gemini-3-flash-preview, gemini-3.1-flash-lite-preview) is selectable in the wizard but is Preview-only in Vertex Model Garden as of mid-2026 — availability and pricing can change.
Run any local model from an Ollama daemon. No API key. OpenSRE calls Ollama’s OpenAI-compatible endpoint at ${OLLAMA_HOST}/v1.

​
CLI providers (subprocess)

CLI providers run a vendor CLI instead of calling an HTTP API. OpenSRE finds the binary on PATH (or via an explicit env var) and reuses the existing session. CLI providers authenticate with the vendor’s own login command. OpenSRE does not start that login. Investigation timeouts: Each ReAct turn runs one full CLI subprocess with the system prompt, tool schemas, and conversation history. The default budget is 300 seconds (Python adds a small buffer). Override per provider when needed, for example GEMINI_CLI_TIMEOUT_SECONDS, CLAUDE_CODE_TIMEOUT_SECONDS, or ANTIGRAVITY_CLI_TIMEOUT_SECONDS (clamped 30–600 where supported). Open a CLI provider for install, auth, and env overrides.
Requires the GitHub Copilot CLI (npm i -g @github/copilot). Login with /login inside Copilot or copilot login.OpenSRE checks auth in this order:
  1. COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN in the environment
  2. gh auth status when gh is on PATH (including ✓ Logged in to github.com account …, - Active account: true, or a supported - Token: prefix: gho_, github_pat_, ghu_ — not ghp_). For a non-github.com host, it runs gh auth status --hostname … when COPILOT_GH_HOST or GH_HOST is set.
It does not read plaintext $COPILOT_HOME/config.json (keychain-backed installs may omit that file; parsing arbitrary JSON risks false positives). If nothing matches, detection reports logged_in=None and the runner checks again at invoke time. If COPILOT_MODEL is unset, OpenSRE omits --model. Invocations run as copilot -p PROMPT --no-color --no-ask-user --silent so they never wait for user input. BYOK / COPILOT_OFFLINE: GitHub auth may not be required; a None probe can still be fine if Copilot is set up for offline or external providers only.
Requires @google/gemini-cli (npm i -g @google/gemini-cli). If GEMINI_CLI_MODEL is unset, OpenSRE omits --model and the CLI uses its default. If GEMINI_CLI_BIN is unset, the binary is resolved from PATH and known install locations.Google is moving Gemini CLI users to Antigravity CLI (see below). OpenSRE keeps gemini-cli so existing setups still work; the probe may note deprecation. Prefer antigravity-cli for new Google CLI setups unless you have a paid Gemini Code Assist licence that keeps Gemini CLI available.
Antigravity CLI (agy) is Google’s successor to Gemini CLI. Install with curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy install to set your shell PATH. Minimum tested version is 1.0.1 — older builds warn and point you to agy update.Why two Google providers? Google’s transition announcement says that on 2026-06-18 Gemini CLI stops serving Pro/Ultra and free users. Paid Gemini Code Assist licences keep Gemini CLI. OpenSRE keeps both gemini-cli (deprecated alias with a probe notice) and antigravity-cli so either group can run.As a fallback, the probe treats GEMINI_API_KEY / GOOGLE_API_KEY / GOOGLE_APPLICATION_CREDENTIALS as authenticated (same idea as the Gemini CLI adapter), so you can keep env-based auth when migrating without repeating the browser flow.Invocations run as agy -p PROMPT --print-timeout {N}s. The adapter never passes --continue / --conversation / --sandbox / --dangerously-skip-permissions, so each OpenSRE call stays ephemeral.
Requires the Cursor Agent CLI (agent). Install with curl https://cursor.com/install -fsS | bash. If CURSOR_MODEL is unset, OpenSRE omits the model flag and the CLI uses its default. If CURSOR_BIN is unset, the binary is resolved from PATH and known install locations. Invocations use non-interactive agent --print.
Requires the OpenCode CLI. Auth is checked with opencode auth list after --version (file credentials and/or environment provider keys). If OPENCODE_MODEL is unset, OpenSRE omits the model flag. If OPENCODE_BIN is unset, the binary is resolved from PATH and known install locations.
Requires the Kimi Code CLI (kimi). Auth is checked with kimi login status, then falls back to KIMI_API_KEY or keys in ~/.kimi/config.toml (or KIMI_SHARE_DIR). If KIMI_MODEL is unset, OpenSRE omits the model flag. Invocations use non-interactive kimi --print / -p mode.
Requires the xAI Grok Build CLI (binary: grok). Install with curl -fsSL https://x.ai/cli/install.sh | bash (macOS/Linux) or irm https://x.ai/cli/install.ps1 | iex (Windows). If GROK_CLI_MODEL is unset, OpenSRE omits -m and the CLI uses its default. The wizard loads models from grok models at onboarding time so new models appear without an OpenSRE update.Invocations run as grok -p PROMPT --output-format plain (one non-interactive turn). The adapter does not pass --always-approve: OpenSRE owns its own tools, so Grok is used as a text responder only and does not auto-run shell commands or file edits.Auth detection: OpenSRE runs grok models (~0.5 s, no LLM call). Success output includes “You are logged in”. XAI_API_KEY counts as authenticated for headless / CI even when the probe is unclear. XAI_API_KEY is forwarded only to the Grok subprocess (not via the shared CLI env allowlist), so it cannot leak into other CLI adapters.
Not the same as groq. grok-cli is xAI’s Grok Build CLI. groq is the Groq HTTP API (a different company).
Requires the Pi CLI (npm i -g @earendil-works/pi-coding-agent). Pi is bring-your-own-key across about 30 providers, so PI_MODEL uses the provider/model form (for example google/gemini-2.5-flash-lite, anthropic/claude-haiku-4-5, openai/gpt-4o-mini). Run pi --list-models for the full list. If PI_MODEL is unset, OpenSRE omits --model and Pi uses its default. If PI_BIN is unset, the binary is resolved from PATH and known install locations.Invocations run as pi -p PROMPT (non-interactive print mode).Auth detection: Pi has no non-interactive auth-status command, so OpenSRE infers auth from state:
  1. A supported provider API key in the environment (GEMINI_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, …) → authenticated
  2. Otherwise, credentials in ~/.pi/agent/auth.json (from pi /login) → authenticated
  3. Neither → not authenticated
Provider API keys are forwarded only to the Pi subprocess, never via the shared CLI env allowlist, so they cannot leak into other CLI adapters.See integrations/llm_cli/AGENTS.md for how to add new CLI providers.

​
Reasoning effort (interactive shell)

In the interactive shell (opensre with no subcommand), /effort sets a session preference for how hard reasoning models should think before answering. It applies only when LLM_PROVIDER is openai (HTTP API) or codex (Codex CLI). Other providers ignore it, and the shell tells you so. Run /effort alone to see the current value (or (default) when unset). /new starts a new session but keeps /effort (and trust mode), like other session preferences. Outside the REPL, set a default with:
Session /effort overrides this for interactive runs. Implementation: config/llm_reasoning_effort.py.

​
Provider diagnostics

OpenSRE does not silently switch providers when credentials are missing. It keeps the configured provider and reports missing or stale auth before LLM work starts.
  • opensre auth and /auth status show status from environment variables, provider metadata, CLI probes, or local config — without exposing secrets.
  • opensre auth verify <provider> checks credentials at request time and refreshes metadata.
  • opensre config llm and opensre doctor report the configured provider and credential status without resolving secrets.
  • Provider errors include the configured provider name:
If credentials are missing, set the provider API key, run opensre auth login <provider>, or change LLM_PROVIDER to a provider you have configured.

​
Switching providers at runtime

OpenSRE caches LLM clients on first use. To switch providers in the same process (tests, benchmarks), call reset_llm_clients() from core.llm.factory after updating env vars. A new process picks up the new LLM_PROVIDER automatically.

​
Where this lives in the code