Skip to content
BugTraceAI Docs

Provider Selection

Provider Selection

Select the CLI provider before starting a scan. Each scanner slot draws its model from the selected preset, with optional per-slot overrides. Provider failover depends on the preset and reporting policy described below.

Supported Providers

ProviderWire formatKeyNotes
OpenRouterOpenAI-compatible /chat/completionsOPENROUTER_API_KEYDefault and recommended. One key, 200+ models across many upstream providers — pick the best model per task
Anthropic (direct)Anthropic Messages APIANTHROPIC_API_KEYDirect Claude API via x-api-key. Single-provider option (CLI 3.7.5 / WEB 1.5.33)
Z.aiOpenAI-compatible /chat/completionsGLM_API_KEYDirect Z.ai API using the GLM model family. Single-provider option
Amazon Bedrock (beta)Bedrock ConverseAWS role/profile; optional AWS_BEARER_TOKEN_BEDROCKCLI and its WEB configuration panel; real AWS validation pending

Each provider ships as a preset: selecting it auto-configures the model for every scanner slot. You can still override individual slot models afterward.

OpenRouter (Default)

OpenRouter is the recommended provider. A single OpenRouter key gives access to 200+ models from multiple upstream providers, so each scanner slot can use the best-suited model for its task (a diverse mutation model, a precise skeptical model, and so on).

OPENROUTER_API_KEY="sk-or-v1-..."

The recommended OpenRouter preset is tuned against an anti-BS benchmark for the security-reasoning slots.

Anthropic (Direct API)

Anthropic is a first-class provider using an API key (x-api-key) against the Claude Messages API. Selecting the anthropic preset routes generation, threaded generation, vision, and connectivity checks to the Messages API.

ANTHROPIC_API_KEY="sk-ant-..."

The api_format Field

Anthropic uses a different HTTP wire format than the OpenAI-compatible providers. A preset field named api_format (apiFormat in the WEB provider config) decouples the wire format from the base URL, so the client knows to build Anthropic-style requests (x-api-key header, top-level system, content[] blocks) instead of an OpenAI-style chat-completions body. OpenRouter and Z.ai keep the openai wire format; Anthropic uses anthropic.

This API-key provider is distinct from an OAuth-based Claude mode. To use the API-key provider, select the anthropic preset and supply ANTHROPIC_API_KEY.

Z.ai (GLM Family)

Z.ai is a direct, single-provider option using the GLM model family (for example glm-4.7-flash, glm-4.6, glm-4.5). It uses the OpenAI-compatible wire format.

GLM_API_KEY="..."

Amazon Bedrock (Beta)

CLI 4.0.34-beta adds Bedrock Converse for text, conversation history, vision and connectivity checks. WEB 2.0.37-beta adds the source-region control to its CLI Provider panel, including region-only edits and connection tests without a key. The CLI runtime uses its AWS role/profile credential chain, or an optional Bedrock API key from AWS_BEARER_TOKEN_BEDROCK. A host AWS profile must be made available explicitly when the CLI runs in a container.

Set BEDROCK_REGION or use the runtime’s AWS region/profile configuration. Models and inference profiles must be approved for your account; a source region does not guarantee processing stays in that region. The preset uses amazon.nova-pro-v1:0; explicit [LLM_MODELS] overrides must use AWS-compatible IDs.

Bedrock has no external provider fallback by default. Reporting fallback also requires the explicit BEDROCK_ALLOW_EXTERNAL_REPORTING_FAILOVER=true opt-in before sending reporting data to another provider.

Validation: offline tests cover the real minimum SDK serializer and bearer/ SigV4 authentication with network requests intercepted. Live AWS access, model permissions, quotas and credential renewal remain unverified. See the setup and account-validation guide. The separate BugTraceAI-API engine, WEB assistant and ModelLab are outside this delivery.

Selecting a Provider

In BugTraceAI-WEB

Use the Provider tab:

  1. Select a provider preset.
  2. Enter the provider’s API key and click Test to validate it (the correct wire format is used per provider, so a valid Anthropic key is not misreported as invalid).
  3. Click Save.

Switching providers at runtime re-applies the full provider configuration — base URL, key, api_format, and every provider-scoped attribute — as a single unit, so no stale wire format is left behind.

In the CLI Configuration

The active provider is set in the [PROVIDER] section of bugtraceaicli.conf:

[PROVIDER]
# openrouter (recommended) | zai | anthropic
ACTIVE = openrouter

Changing the provider auto-configures all slot models from that provider’s preset. Provider API keys are read from the environment (.env): OPENROUTER_API_KEY, GLM_API_KEY, or ANTHROPIC_API_KEY.

One Provider Per Scan

A scan uses a single active provider from start to finish. BugTraceAI does not mix providers mid-scan, and switching providers does not affect a scan already in progress.

The one scoped exception is reporting/enrichment failover: if a PoC or CVSS enrichment call fails or degrades at reporting time, the reporting layer can fall back to a secondary provider for that single enrichment call only. This never changes the scan’s active provider or mixes providers during detection. It is configurable via REPORTING_FAILOVER_ENABLED and REPORTING_FAILOVER_PROVIDER (default: enabled, falling back to anthropic). See Report Generation for details.

Per-Slot Model Configuration

Within the active provider, each scanner slot draws its own model. Presets set sensible defaults; you can override any slot in the [LLM_MODELS] configuration section. The slots that Model Lab benchmarks map directly to these keys:

SlotConfig keyRole
MUTATIONMUTATION_MODELPayload mutation / WAF bypass generation
SKEPTICALSKEPTICAL_MODELPer-finding skeptical review
ANALYSISANALYSIS_MODELDASTySAST high-volume per-URL analysis
REPORTINGREPORTING_MODELReport enrichment (CVSS + PoC)

Other slots include DEFAULT_MODEL (orchestration and strategy), CODE_MODEL (payload/bypass logic), and VISION_MODEL (screenshot validation).

Use Model Lab to benchmark candidate models per slot before committing to an assignment.

Parent: Configuration

See also: Model Lab | Configuration | Report Generation