Model providers
Agent Zero supports native OpenAI, Anthropic, and Google Generative AI adapters, Vercel AI Gateway, and arbitrary OpenAI-compatible endpoints — all behind one ModelProvider contract in packages/models, sharing one structured-output, usage-accounting, timeout, and error-redaction path.
Select a provider
The transport is selected in repository policy; the credential comes only from the environment:
model:
provider: anthropic
name: claude-sonnet-4-5
model.provider | Credential environment variable | Model example |
|---|---|---|
ai-gateway | AI_GATEWAY_API_KEY or Vercel OIDC | anthropic/claude-sonnet-4.5 |
anthropic | ANTHROPIC_API_KEY | claude-sonnet-4-5 |
google | GOOGLE_GENERATIVE_AI_API_KEY | gemini-2.5-pro |
openai | OPENAI_API_KEY | gpt-5 |
openai-compatible | OPENAI_COMPATIBLE_API_KEY (or legacy OPENAI_API_KEY) | provider-specific |
The AI Gateway accepts provider/model identifiers and exposes the broader AI SDK provider catalog without adding provider-specific logic to the Agent Zero runtime.
Custom endpoints
AGENT_ZERO_MODEL_BASE_URL is an optional operator environment variable for custom gateways and self-hosted endpoints. Endpoint URLs and credentials cannot be named or embedded in .agent-zero.yml, so untrusted repository policy cannot redirect a provider secret.
Cost accounting
To record cost, configure explicit rates — Agent Zero never guesses provider pricing:
model:
provider: openai-compatible
name: gpt-5
inputCostPerMillionTokens: 1.25
outputCostPerMillionTokens: 10
Usage (tokens and, when configured, cost) is accounted per run and carried in the task result.
Guarantees
- Credentials are read only from the provider's documented environment variable and are never persisted with task evidence.
- The agent runtime sees neither SDK objects nor credentials —
packages/modelskeeps AI SDK types behind the adapter boundary. - Errors are redacted before they surface, so a provider exception cannot leak a credential into logs or evidence.
CLI
The zero CLI is the local entry point: it parses arguments with @bomb.sh/args and renders with @clack/prompts. Inside the repository, run it as aube run zero <command>.
Source-control providers
Agent Zero integrates with source-control platforms through packages/source-control: a provider-neutral boundary with one adapter per platform. The agent runtime consumes only shared contracts (ReviewInput, FeedbackItem, PullRequestRef); provider payload shapes, URLs, IDs, event names, and credentials never cross the boundary. One deployment may connect repositories from several providers at once: inbound deliveries are routed to the adapter that recognizes their headers, and each configured provider keeps its own webhook secret.