LLM providers — PentAGI

Connect PentAGI to built-in providers such as OpenAI, Anthropic, Gemini, Bedrock and Ollama, or to any OpenAI-compatible endpoint, with failover.

PentAGI needs at least one language model provider. Credentials are set on the server in .env; each flow then picks the provider it runs on, and every agent type can use its own model settings.

Built-in providers

Provider	Key variable	Endpoint override
OpenAI	`OPEN_AI_KEY`	`OPEN_AI_SERVER_URL`
Anthropic	`ANTHROPIC_API_KEY`	`ANTHROPIC_SERVER_URL`
Google AI (Gemini)	`GEMINI_API_KEY`	`GEMINI_SERVER_URL`
AWS Bedrock	`BEDROCK_REGION` + one auth method	`BEDROCK_SERVER_URL`
Ollama	`OLLAMA_SERVER_URL` (`OLLAMA_SERVER_API_KEY` for Ollama Cloud)	—
DeepSeek	`DEEPSEEK_API_KEY`	`DEEPSEEK_SERVER_URL`
GLM (Zhipu AI)	`GLM_API_KEY`	`GLM_SERVER_URL`
Kimi (Moonshot AI)	`KIMI_API_KEY`	`KIMI_SERVER_URL`
Qwen (Alibaba Cloud)	`QWEN_API_KEY`	`QWEN_SERVER_URL`
MiniMax	`MINIMAX_API_KEY`	`MINIMAX_SERVER_URL`
Mistral	`MISTRAL_API_KEY`	`MISTRAL_SERVER_URL`
xAI (Grok)	`XAI_API_KEY`	`XAI_SERVER_URL`

AWS Bedrock authentication

Set BEDROCK_REGION and choose one method:

BEDROCK_DEFAULT_AUTH=true          # AWS SDK default credential chain (EC2/ECS roles)
# BEDROCK_BEARER_TOKEN=...         # bearer token
# BEDROCK_ACCESS_KEY_ID=...        # static credentials
# BEDROCK_SECRET_ACCESS_KEY=...

Anthropic without a long-lived key

Instead of ANTHROPIC_API_KEY, Anthropic can be used with Workload Identity Federation through ANTHROPIC_FEDERATION_RULE_ID, ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID and an identity token (ANTHROPIC_IDENTITY_TOKEN or ANTHROPIC_IDENTITY_TOKEN_FILE).

Custom and OpenAI-compatible endpoints

Any OpenAI-compatible API — vLLM, LiteLLM, OpenRouter, DeepInfra, Atlas Cloud, the OpenCode Go plan or an Azure OpenAI deployment — is connected as the custom provider:

LLM_SERVER_URL=https://your-endpoint/v1
LLM_SERVER_KEY=your_key
LLM_SERVER_MODEL=model-name
LLM_SERVER_CONFIG_PATH=/opt/pentagi/conf/custom.provider.yml

LLM_SERVER_KEY is required: for a server without authentication, such as vLLM by default, set any non-empty value — with an empty key the custom provider is disabled. LLM_SERVER_API_TYPE=azure switches the custom provider to Azure OpenAI. A provider config file lets you assign a model and parameters per agent type; start from examples/configs/custom-openai.provider.yml in the repository and replace its o3-mini, which OpenAI retires on 23 October 2026.

Configured providers in Settings → Providers

Failover

LLM_FALLBACK_PROVIDER names a second provider: a built-in one with credentials in .env, such as anthropic, or a provider the flow's owner saved in Settings → Providers. A model call that fails is repeated once on it and the switch is recorded in the trace; the next call starts on the flow's own provider again.

Choosing models

Use your strongest model for primary_agent, pentester and adviser; lighter models work for searcher, enricher and summarization.
For open models under 32B parameters, enable execution monitoring and task planning.
Settings → Providers holds the provider profiles you create on top of the configured types — Create Provider offers only the types with credentials in .env — and the profile form tests a configuration before you save it.