LLM_PROVIDER environment variable, with LLM_AUTH_METHOD selecting API-key or OAuth auth where both are supported. Defaults are tracked in config/config.py and routing lives in core/llm/factory.py.
Quick reference
OpenSRE distinguishes two model slots per provider:
- Reasoning model — full-capability model used for diagnosis, claim validation, and multi-step analysis.
- Toolcall model — lightweight, lower-cost model used for tool selection and routing.
Selecting a provider
SetLLM_PROVIDER (default: anthropic) in your environment or .env file:
.env:
ANTHROPIC_API_KEY. OpenSRE keeps the provider as
anthropic or openai; LLM_AUTH_METHOD=oauth selects the OAuth-backed runtime.
OAuth browser login, token storage, refresh, and logout are delegated to the
vendor CLI that owns that account session. OpenSRE owns the onboarding UX and
does not persist OAuth tokens directly.
In the interactive shell, /model shows curated quick-pick choices for common models. Providers
with fast-changing or account-gated catalogs (OpenAI, OpenRouter, Gemini, NVIDIA, Bedrock, local
CLIs, Ollama, and DeepSeek) also accept custom model IDs:
gpt-5.6-sol (flagship), gpt-5.6-terra (balanced),
and gpt-5.6-luna (cost-efficient). The bare gpt-5.6 alias is routed to Sol by OpenAI.
Override the default model for a slot via env vars:
LLM_MAX_TOKENS (default 4096) controls the response token budget for every provider.
LiteLLM transport
OpenSRE can route hosted API providers through LiteLLM instead of native vendor SDKs. This is opt-in for most providers and required for Azure OpenAI.
CLI-backed providers (
codex, claude-code, copilot, pi, etc.) always use their subprocess path — LiteLLM does not affect them.
Providers supported via LiteLLM
WhenOPENSRE_LLM_TRANSPORT=litellm (or when using LLM_PROVIDER=azure-openai), OpenSRE builds investigation tool schemas the same way as the SDK path and passes them to litellm.completion(..., tools=..., tool_choice="auto"). LiteLLM handles provider routing; OpenSRE keeps schema normalization, retries, and message replay.
The native OpenAI SDK transport uses the Responses API for GPT-5.6 agent tool calls, including
replaying reasoning and function-call items between tool steps. Older OpenAI models and
OpenAI-compatible providers continue to use Chat Completions.
For providers beyond this list, LiteLLM supports 100+ backends. OpenSRE only wires the slugs above today — use one of them, or open an issue if you need another first-class provider.
Login and secret storage
Useopensre auth for provider login without writing secrets to .env:
opensre auth login never reads browser cookies, browser profiles, browser local storage, or IndexedDB. API-key providers use hidden paste prompts plus keyring storage. OpenAI OAuth is handled by OpenSRE’s local Codex-compatible callback server; other subscription providers delegate OAuth/session handling to the vendor CLI that owns the browser login flow.
opensre auth and /auth status are prompt-safe: they do not read API-key secrets from Keychain. For API-key providers they inspect environment variables plus non-secret metadata in ~/.opensre/llm-auth.json. If a key was deleted directly from Keychain, status may show the old metadata until you run opensre auth verify <provider> or start a request; that verification marks the provider stale when the secret is gone.
For Codex CLI auth, status checks do not run codex login status by default,
because some Codex versions can open browser OAuth while checking a session.
Run /login chatgpt or opensre auth login chatgpt from an interactive
terminal when you need to refresh the browser login. OpenSRE starts its own
temporary callback server on http://localhost:1455/auth/callback, exchanges
the short-lived OAuth code, and writes Codex-compatible tokens to the local
Codex auth store before redirecting the browser to the Codex-style
/success?id_token=... completion page. If a browser flow reaches /success
with token material directly, OpenSRE stores that token material instead of
dropping the callback. Use codex login only as a direct CLI fallback.
Inside the interactive shell, use the same flows through /auth or /login:
API providers
Anthropic
claude-fable-5), Anthropic’s most capable model, is also selectable
(/model set claude-fable-5, or via the onboarding wizard and the Claude Code CLI
provider). It is priced above the Opus tier, so the defaults stay unchanged — opt in
explicitly when you want it.
OpenAI
o1, o3, o4, gpt-5*) automatically use max_completion_tokens instead of max_tokens.
Azure OpenAI
Azure OpenAI routes through LiteLLM. Model env vars hold deployment names from your Azure resource, not public OpenAI model IDs.AZURE_OPENAI_API_VERSION=2024-10-21 and OPENSRE_LLM_TRANSPORT=litellm automatically unless you override them in .env.
In the REPL, switch provider or deployment like any other API provider:
/openai/models.
OpenRouter
https://openrouter.ai/api/v1.
DeepSeek
https://api.deepseek.com.
Run opensre auth login deepseek for browser-assisted key setup and secure local storage.
Google Gemini
https://generativelanguage.googleapis.com/v1beta/openai/. Get an API key at aistudio.google.com.
NVIDIA NIM
https://integrate.api.nvidia.com/v1. Browse available models on build.nvidia.com.
MiniMax
https://api.minimax.io/v1. Temperature is fixed to 1.0 to match MiniMax recommendations.
Groq
https://api.groq.com/openai/v1.
Amazon Bedrock
InvokeModel / Converse access scoped to those resources in IAM).
Model routing:
- Anthropic Claude on Bedrock (
anthropic.claude-*,us.anthropic.claude-*, and foundation-model ARNs that containanthropic.claude) use the existing AnthropicBedrock SDK path. - Other Bedrock foundation models (for example Mistral, Meta Llama, Amazon Titan IDs you enable in your account) use the Bedrock Converse API via
boto3, so you can setBEDROCK_REASONING_MODELto a non-Claude model ID when your use case requires it. - Application inference profile ARNs (
…:application-inference-profile/…) do not encode the vendor in the ID; those are always sent through Converse, which works for any backing model in the profile.
config/config.py are US cross-region inference profile IDs for Anthropic Claude; override with IDs or ARNs that are inference-access enabled in your account and region.
Google Vertex AI
gcloud auth application-default login, or set GOOGLE_APPLICATION_CREDENTIALS
to a service-account key file, or rely on the ambient GCE/GKE metadata server.
Your principal needs the Vertex AI User IAM role (or equivalent) in the
configured project.
Always routed through LiteLLM (like Azure OpenAI) as vertex_ai/<model>. Curated
model choices are Gemini models served via Vertex; any other Vertex-supported
model ID also works by typing it directly (allow_custom_models).
The default (gemini-2.5-pro/-flash/-flash-lite) is the GA Gemini generation.
Gemini 3.x (gemini-3.1-pro-preview, gemini-3-flash-preview,
gemini-3.1-flash-lite-preview) is selectable in the wizard but is Preview-only
in Vertex Model Garden as of mid-2026 — expect availability and pricing to change.
Ollama (local)
${OLLAMA_HOST}/v1.
CLI providers (subprocess)
CLI-backed providers shell out to a vendor CLI instead of an HTTP API during inference. OpenSRE detects the binary onPATH (or via an explicit env var) and reuses the existing session. OpenAI OAuth is stored by OpenSRE in Codex-compatible auth format; other CLI-backed providers authenticate via the vendor’s own login command.
Investigation timeouts: Each ReAct turn runs one full CLI subprocess with the system prompt, tool schemas, and conversation history. The shared default subprocess budget is 300 seconds (Python adds a small buffer). Override per provider when needed, for example GEMINI_CLI_TIMEOUT_SECONDS, CLAUDE_CODE_TIMEOUT_SECONDS, or ANTIGRAVITY_CLI_TIMEOUT_SECONDS (clamped 30–600 where the adapter supports it).
OpenAI OAuth backend
CODEX_MODEL is unset, OpenSRE omits -m so codex exec uses the CLI’s currently configured model. If CODEX_BIN is unset, the binary is resolved via PATH and known install locations.
Run opensre onboard, /login chatgpt, or opensre auth login chatgpt to launch
OpenSRE-managed Codex browser login on localhost:1455 and persist
LLM_PROVIDER=openai with LLM_AUTH_METHOD=oauth. Existing
LLM_PROVIDER=codex configs still work for backward compatibility.
Anthropic OAuth backend
npm i -g @anthropic-ai/claude-code). If CLAUDE_CODE_MODEL is unset, OpenSRE omits the --model flag and the CLI uses its configured default. If CLAUDE_CODE_BIN is unset, the binary is resolved via PATH and known install locations.
Run opensre onboard, /login claude, or opensre auth login claude to launch
Claude browser login when needed and persist LLM_PROVIDER=anthropic with
LLM_AUTH_METHOD=oauth. Existing LLM_PROVIDER=claude-code configs still work
for backward compatibility.
GitHub Copilot
npm i -g @github/copilot). Login uses the interactive /login slash command or copilot login. OpenSRE detects auth in this order: (1) COPILOT_GITHUB_TOKEN / GH_TOKEN / GITHUB_TOKEN env, (2) gh auth status when gh is on PATH (including ✓ Logged in to github.com account …, - Active account: true, or a supported - Token: prefix: gho_, github_pat_, ghu_ per Copilot docs — not ghp_), with gh auth status --hostname … when COPILOT_GH_HOST or GH_HOST targets a non-github.com host. It does not read plaintext $COPILOT_HOME/config.json (keychain-backed installs may omit it; mis-parsing arbitrary JSON risks false positives). If nothing matches, detection reports logged_in=None and the runner verifies at invoke time. If COPILOT_MODEL is unset, OpenSRE omits --model. Invocations run as copilot -p PROMPT --no-color --no-ask-user --silent so they never block on user input. BYOK / COPILOT_OFFLINE: GitHub auth may be unnecessary; a None probe can still be fine if Copilot is configured for offline or external providers only.
Google Antigravity CLI
agy) is Google’s successor to Gemini CLI. Install via curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy install to configure your shell PATH. The minimum tested version is 1.0.1 — older builds log a warning via the probe and direct you to agy update.
Why two Google providers? Google’s transition announcement states that on 2026-06-18 Gemini CLI stops serving Pro/Ultra and free users. Paid Gemini Code Assist licences keep Gemini CLI indefinitely. OpenSRE keeps both gemini-cli (deprecated alias with a probe-time notice) and antigravity-cli so either group can run without surprises.
As a best-effort fallback, the probe treats explicit GEMINI_API_KEY / GOOGLE_API_KEY / GOOGLE_APPLICATION_CREDENTIALS env credentials as authenticated (mirroring the Gemini CLI adapter), so users migrating across the two CLIs can keep their existing env-var-based auth without re-running the browser flow.
Invocations run as agy -p PROMPT --print-timeout {N}s. The adapter never passes --continue / --conversation / --sandbox / --dangerously-skip-permissions, keeping every opensre call ephemeral.
xAI Grok Build CLI
grok). Install with
curl -fsSL https://x.ai/cli/install.sh | bash (macOS/Linux) or
irm https://x.ai/cli/install.ps1 | iex (Windows). If GROK_CLI_MODEL is unset, OpenSRE
omits -m and the CLI uses its configured default. The wizard populates the model list live
from grok models at onboarding time so newly released models appear without an OpenSRE update.
Invocations run as grok -p PROMPT --output-format plain, so each opensre call is a single
non-interactive turn. The adapter deliberately omits --always-approve: OpenSRE drives its own
tools, so Grok is used purely as a text responder and never auto-executes shell commands or file edits.
Auth detection: auth is probed via grok models (~0.5 s, no LLM call), which prints
“You are logged in” on success. XAI_API_KEY is treated as an authenticated fallback for
headless / CI runs even when the probe result is unclear. XAI_API_KEY is forwarded only
to the Grok subprocess (never via the shared CLI env allowlist), so it cannot leak into other
CLI adapters.
Not to be confused withgroq. Thegrok-cliprovider is xAI’s Grok Build CLI. The separategroqprovider is the Groq HTTP API (a different company); the two are unrelated.
Pi CLI
npm i -g @earendil-works/pi-coding-agent). Pi is
bring-your-own-key across ~30 providers, so PI_MODEL uses the provider/model form
(for example google/gemini-2.5-flash-lite, anthropic/claude-haiku-4-5, openai/gpt-4o-mini);
run pi --list-models for the full catalog. If PI_MODEL is unset, OpenSRE omits --model
and Pi uses its configured default. If PI_BIN is unset, the binary is resolved via PATH
and known install locations.
Invocations run as pi -p PROMPT (non-interactive print mode), so each OpenSRE call is a
single headless turn with no TTY.
Auth detection: Pi has no non-interactive auth-status command, so OpenSRE detects auth
from state: (1) a supported provider API key in the environment (GEMINI_API_KEY,
ANTHROPIC_API_KEY, OPENAI_API_KEY, …) → authenticated; (2) otherwise, credentials stored
in ~/.pi/agent/auth.json (written by pi’s /login, covering OAuth subscriptions and
stored keys) → authenticated; (3) neither → not authenticated. Provider API keys are forwarded
only to the Pi subprocess, never via the shared CLI env allowlist, so they cannot leak into
other CLI adapters.
See integrations/llm_cli/AGENTS.md for the adapter pattern used to add new CLI providers.
Reasoning effort (interactive shell)
In the TTY REPL (opensre with no subcommand), /effort stores a session preference for how strongly reasoning models should think before answering. It applies only when LLM_PROVIDER is openai (HTTP API) or codex (Codex CLI); other providers ignore the setting and the shell notes that.
Run
/effort alone to show the current choice (or (default) when unset) and the usage line. /new starts a fresh session but keeps /effort (and trust mode), consistent with other session prefs.
Outside the REPL, optional defaults use the environment variable:
/effort overrides this for interactive runs. Implementation: config/llm_reasoning_effort.py.
Provider diagnostics
OpenSRE does not silently switch LLM providers when the provider inLLM_PROVIDER is missing credentials. It keeps the configured provider selected and reports missing or stale auth status before starting LLM work.
-
opensre authand/auth statusshow prompt-safe status from environment variables, provider metadata, CLI probes, or ambient/local config. -
opensre auth verify <provider>intentionally checks request-time credentials and refreshes metadata. -
opensre config llmandopensre doctorreport the configured provider plus credential status without resolving secrets. -
Provider errors are prefixed with the configured provider that served the request:
opensre auth login <provider>, or change LLM_PROVIDER to a provider you have configured.
Switching providers at runtime
OpenSRE caches LLM clients on first use. To switch providers within a single process (tests, benchmarks), callreset_llm_clients() from core.llm.factory after updating the env vars; otherwise a fresh process picks up the new LLM_PROVIDER automatically.
Where this lives in the code
- Provider literals and defaults:
config/config.py(LLMProvider,LLMSettings). - Runtime routing:
core/llm/factory.py(resolve_llm_route,get_llm) and client construction incore/llm/client_builders.py. - LiteLLM routing (when enabled):
core/llm/transports/litellm/routing.py. - Investigation tool-calling adapters: Investigation tool calling.
- API-backed provider guide:
core/llm/AGENTS.md. - CLI-backed provider guide:
integrations/llm_cli/AGENTS.md.