Providers and gateway

Providers are the eleventh module, laid out as a two-column workbench: agents on the left, the selected agent’s provider pool on the right (default provider, added, available).

Three modes

Mode	Behaviour	When it fits
Direct	Writes config only, no gateway, zero overhead	One upstream, lowest latency
Routed	Dispatch by model wildcard, fall back by priority	Different models on different channels
Aggregated	Weighted round-robin, failover before first byte, merged model pool	One channel is flaky and needs a backup

The gateway

The built-in proxy binds 127.0.0.1 only (port 43117 by default). One endpoint for everything:

http://127.0.0.1:43117/v1

The bearer token is the agent name — claude, codex, opencode, hermes, gemini, codebuddy. Products that share a config share a token: Claude Code and Claude Desktop both read ~/.claude, so both are claude. A mismatch returns 401 with the available values listed.

The keys each CLI really reads

One wrong key and the config is as good as absent. AgentHub writes the real fields:

• Claude Code — env.ANTHROPIC_BASE_URL, ANTHROPIC_MODEL, AUTH_TOKEN, plus the four ANTHROPIC_DEFAULT_{SONNET,OPUS,HAIKU,FABLE}_MODEL aliases. Without the aliases, choosing opus in /model silently routes back to the official model.
• Codex — root model and model_provider, plus base_url, env_key and wire_api under [model_providers.<id>]. A Chat upstream must declare chat, or requests go out on the responses path and fail.
• OpenCode — npm, name, options and models under provider.<id>. Missing npm or models and OpenCode simply will not load the entry.

Gemini, CodeBuddy and Hermes are explicitly refused, with the reason shown in the UI. No guessed keys, ever.

Secrets

Secrets are stored as references only: env:VAR, keychain:svc/acct, or plaintext you explicitly confirmed. The UI always masks them. Inbound authorization / x-api-key headers are replaced with the upstream secret, which never lands in an agent config.

Privacy boundary

Requests and responses (including SSE) stream through unmodified and unbuffered. The request log records metadata only: status code, latency, time to first byte, retry count. Payloads are never recorded and the log clears on restart.