Connect a model
Provider setup for grith run and the built-in REPL. Not needed if you only supervise other agents with grith exec.
This page only matters for grith run and the bare grith REPL, which use a model of
their own. If you are supervising an existing agent with grith exec, skip it - that
agent talks to its own provider with its own credentials, and grith needs none of this.
The default
Shipped defaults, from grith config
[llm]
default_provider = "ollama"
[llm.ollama]
base_url = "http://localhost:11434"
model = "llama3.1:8b"Ollama out of the box, so nothing needs a card on file and nothing leaves the machine. If
you have Ollama running with a different model, point llm.ollama.model at it:
$ grith config set llm.ollama.model qwen2.5-coder:7bCloud providers
Four providers are accepted: ollama, openai, anthropic, openrouter. Anything else
is a config validation error.
| Provider | Default model | Key from |
|---|---|---|
ollama | llama3.1:8b | none |
openai | gpt-4o-mini | OPENAI_API_KEY |
anthropic | claude-sonnet-4-5-20250514 | ANTHROPIC_API_KEY |
openrouter | anthropic/claude-sonnet-4-5-20250514 | OPENROUTER_API_KEY |
Switch provider and model with grith config set:
$ grith config set llm.default_provider anthropicgrith setup does the same thing interactively, and reads the key from the environment
variable rather than asking you to paste it. There is no per-invocation provider flag -
the config decides.
Where the key comes from
Three sources, in order:
api_keyunder the provider's section inconfig.toml.- The environment variable named by
api_key_env-OPENAI_API_KEY,ANTHROPIC_API_KEY,OPENROUTER_API_KEYby default. - Provider keys pulled down by
grith pro sync, for teams that manage them centrally.
A key you set locally stays local. Team-managed keys travel the other way: grith pro sync pulls them down and they are decrypted on your machine.
⚠️Do not hand-write a sparse config file
Config layers are merged whole. A file containing only an [llm] block re-asserts every other key
at its Rust default, which is not always the shipped default - and an empty
supervisor.default_profile is a fatal validation error. Start from what grith init wrote, or
use grith config set.
grith config set accepts llm.default_provider, llm.ollama.model,
llm.ollama.base_url, llm.openai.model and llm.anthropic.model. The OpenRouter model
and any api_key value have to be edited in config.toml directly.
Provider hosts and egress
api.anthropic.com, api.openai.com and openrouter.ai are trusted outbound
destinations in the shipped egress policy - the filter scores them at -1.0 rather than
flagging them - so an agent talking to its own provider does not raise prompts for it. A
self-hosted or unusual endpoint is an unknown destination and scores like one. Check any
host with grith proxy test.
See also
[llm]configuration - every key in the section.grith run- the REPL, and its slash commands.