Providers

No provider is needed for indexing, context, impact, verify or coverage. Providers matter only for live missions, tournaments and handoffs. This page records observations, not endorsements.

Matrix

Coding agents and repo-ai, as of 2026-10-31

Provider	Label	Isolated execution (repo-ai do)	Host (repo-ai init)	Cost reporting
OpenAI Codex CLI--agent codex	EXECUTION	Live, independently re-verified change through repo-ai do on the published 0.10.0 wheel (2026-10-30, hidden oracle 17/17, undo byte-exact), with the 0.10.0 sandbox that hides the rest of HOME. Runs inside repo-ai's outer sandbox with Codex's own sandbox bypassed, only once the outer one is confirmed. Disclosed: the login token copied into its sandbox is readable by a model with shell access; use a separate repo-ai login (repo-ai agents setup codex). Opt-in from 0.11.3 (REPO_AI_CODEX_BROKER=1, macOS): a credential broker keeps the token outside the sandbox and limits Codex to one loopback port. It was live-verified on 2026-10-31 with a ChatGPT login on a development build (two runs; an API-key login is not yet verified).2026-10-30 · version 0.165.0 · n = 1 per journey · macOS (seatbelt) verified live; Linux bubblewrap path covered by tests, no live mission this cycle · evidence for OpenAI Codex CLI	Not wired as a host by repo-ai init.	UNKNOWN under subscription; a positive --max-cost-usd is refused (no hard USD flag)
Google Antigravity (agy)--agent agy	EXECUTION	Live, independently re-verified change through repo-ai do on the published 0.10.0 wheel (2026-10-30, hidden oracle 17/17, undo byte-exact); earlier tournament and handoff journeys on 0.9.0. Must read the encrypted login keychain files to authenticate; refused on other platforms.2026-10-30 · version 1.4.9 · n = 1 per journey · macOS only · evidence for Google Antigravity (agy)	Not wired as a host by repo-ai init.	UNKNOWN under subscription
IBM Bob--agent bob	EXECUTION	Live, model-generated changes independently re-verified through repo-ai do on an earlier pre-release (including abc-v1). Not re-run on 0.9.0 or 0.10.0; account entitlement not re-checked.2026-10 · version 2.0.9 · small tasks, small n (abc-v1: 4 tasks, one run per cell) · macOS · evidence for IBM Bob	repo-ai init --agent bob (also the default when --agent is omitted) writes .bob/ skills, rules, commands and hooks and an AGENTS.md block.	Provider-reported USD; hard cap through Bob's own flag
Claude Code--agent claude	EXECUTION	Live, independently re-verified changes through repo-ai do on the published 0.10.0 wheel (2026-10-30): mission PASS, hidden oracle 17/17, apply and undo byte-exact, and a hostile-repository run whose injected instructions were not followed. Uses Claude Code's own login, nothing copied: a separate repo-ai login (live-verified) or CLAUDE_CODE_OAUTH_TOKEN from claude setup-token (not yet live-verified). The model gets file tools only, and every live run first checks, at no cost, that the session would load nothing else.2026-10-30 · version 2.1.314 · n = 1 per journey (2 journeys on 0.10.0) · macOS (seatbelt) verified live; Linux bubblewrap profile covered by tests, not live-verified · evidence for Claude Code	Fully supported as a host: repo-ai init --agent claude writes a marked CLAUDE.md block, path-scoped rules, curated skills and hooks that attach ranked context to prompts.	Claude's own USD cap via --max-cost-usd, checked between turns (one turn of overshoot observed); on a subscription the reported cost is notional
OpenCode (local model)--agent opencode	EXECUTION	OpenCode against a local, loopback-only model endpoint (Ollama), account-free. On the published 0.10.0 wheel (2026-10-30) with qwen3:8b: one attempt refused (broken edit), one PASS of the visible tests that a hidden case failed (the model dropped a docstring requirement no test pinned); on development builds 1 of 4 passed. repo-ai refused every broken candidate. Deny-by-default tools, network to loopback only.2026-10-30 · version 2.2.1 with qwen3:8b via Ollama 0.40 · 7 attempts across builds · macOS only (no tested restriction elsewhere: refused) · evidence for OpenCode (local model)	Reads repo-ai-installed skills from .agents/skills (observed 2026-10-30).	$0 (local model); cloud-routed models are refused
OpenCode over ACP (local model)--agent opencode-acp	EXECUTION	OpenCode driven over the Agent Client Protocol (`opencode acp`) under exactly the opencode isolation: seatbelt, scratch HOME, deny-by-default inline config, loopback-only network. The ACP client stays outside the sandbox and serves file reads and writes only within the run's paths. Any protocol problem, refusal, timeout or stop reason other than end_turn fails the run, and OpenCode's own edit is still checked. Live $0 on a development build (2026-10-31, qwen3:8b): PASS on a scratch fixture in 60 s.2026-10-31 · version 2.2.1 with qwen3:8b via Ollama · n = 1 · macOS only (as opencode) · evidence for OpenCode over ACP (local model)	Same binary as opencode; a live tournament refuses the pair (not independent).	$0 (local model, loopback only); a positive --max-cost-usd is refused
Gemini CLI--agent gemini	BLOCKED	Rejected for the tested account (exit 41, authentication) on 2026-10-30. From 0.10.0 repo-ai no longer copies ~/.gemini into the sandbox; live Gemini needs GEMINI_API_KEY or GOOGLE_API_KEY.2026-10-30 · version 0.65.0 · 1 bounded retry · macOS · evidence for Gemini CLI	Not wired as a host by repo-ai init.	—

EXECUTION

repo-ai runs it as an isolated mission provider (repo-ai do), and a live, independently re-verified change has been observed.

HOST ONLY

repo-ai wires context, rules, skills and hooks into it (repo-ai init), but cannot run it as an isolated provider.

CONTEXT SKILLS ONLY

repo-ai writes context and skills files the tool can read; no hooks and no isolated execution.

PLANNED

Intended, not implemented. Nothing on this site claims it works.

BLOCKED

Tried, and stopped by an external blocker (authentication, account or terms) that is named.

UNSUPPORTED

Not supported, and not planned for now.

The table is rendered from site/src/data/providers.json in the source tree. Every EXECUTION row rests on small samples: n = 1 per journey, synthetic tasks, macOS. For Claude Code, Codex, agy and OpenCode the latest journeys ran on the published 0.10.0 wheel; Bob’s on an earlier pre-release. It says the path functions, not that results are good or better than using the provider directly (one OpenCode run passed the visible tests and failed a hidden case). The claims behind it are also in the Evidence Lab.

Claude Code as a host

Claude Code is fully usable as a host for repo-ai’s context: repo-ai init --agent claude writes a marked CLAUDE.md block, path-scoped rules, curated skills and hooks that attach ranked context to prompts. From 0.10.0 repo-ai can also launch Claude as an isolated mission provider (see the notes below); the two are independent.

Checking providers locally

repo-ai agents list      # is an executable present? no subprocess, no model call
repo-ai agents doctor    # sandboxed --help/--version probes; no login check, no model call
repo-ai agents route     # what --agent auto would choose, with a status class
repo-ai agents setup claude|opencode|codex   # how that provider authenticates inside repo-ai; no model call
repo-ai agents catalog   # 24 coding agents and what repo-ai can honestly do with each

agents route reports a status_class such as NOT_INSTALLED, NOT_AUTHORIZED, BLOCKED_AUTH, BLOCKED_QUOTA, BLOCKED_SANDBOX, UNSUPPORTED or ISOLATED_READY. There is no “host ready” state: repo-ai has no un-isolated execution path. Routing checks offline whether a provider has any login repo-ai’s isolation can use (SETUP_REQUIRED, reported as BLOCKED_AUTH) without reading credentials; it does not check quota before a live run.

Per-provider notes

IBM Bob

Last live-verified on an earlier pre-release; not re-run on 0.9.0 or 0.10.0, and its account entitlement was not re-checked. Install and log in to Bob as its documentation describes. repo-ai passes your --max-cost-usd to Bob’s own cost cap, so a positive ceiling is enforced by the provider. Cost figures are provider-reported, not billing records. repo-ai copies your ~/.bob/settings directory into the run’s scratch HOME and passes BOB_API_KEY if it is set; both are readable inside the run.

Codex CLI

Log in with Codex’s own flow; better, give repo-ai a separate login (CODEX_HOME=<dir> codex login, see repo-ai agents setup codex). repo-ai runs Codex with a scratch HOME holding only that login’s token and the model-selection keys of your config (no MCP servers or notify), under repo-ai’s outer sandbox, which from 0.10.0 hides the rest of your HOME. The token copy itself is readable by Codex’s model, which has a shell and the network: a prompt-injected repository could try to send it out, which is why a separate, revocable login is recommended. Because nested sandboxes are not supported on macOS, repo-ai passes Codex’s --dangerously-bypass-approvals-and-sandbox only after confirming its outer sandbox is active for that run; if it is not, the run is refused. The outer sandbox is then the only write boundary. Codex has no hard USD flag, so a positive --max-cost-usd is refused and cost is recorded as UNKNOWN, never 0. Bound runs with --max-seconds.

Experimental: credential broker (REPO_AI_CODEX_BROKER=1, macOS only; live-verified with a ChatGPT login on Codex 0.165, not yet with an API-key login). With the broker, no token is copied into the sandbox at all:

• Codex gets a per-run dummy key and a model provider pointing at a loopback proxy inside repo-ai.

• The proxy accepts only POST /v1/responses with that dummy key, swaps in the login’s credential, and forwards the request upstream without following redirects.

• Codex’s sandbox can reach that one loopback port and nothing else, and it cannot read the login’s directory, even one outside your HOME. A prompt-injected repository has no token to read and no host to send one to.

• The model can read the dummy key and send its own requests, so each request is vetted:

  • only tools that Codex runs locally are forwarded;
  • the hosted web search is removed;
  • a remote image or file URL is refused, because the upstream would fetch it;
  • the model is pinned to the one named in Codex’s first request;
  • stored server-side state (a stored prompt, conversation or response, or a background run) is refused.

  As a result, a Codex sub-agent on a different model, or any Codex endpoint other than /v1/responses, is refused in brokered runs.

• An expired ChatGPT token is refused, never refreshed: run codex login for that login.

• A run whose upstream rejects the credential, or that sends nothing through the broker, is a failure.

Offline tests cover all of this. Two live runs on 2026-10-31 confirmed that the ChatGPT backend accepts the forwarded requests; a run’s codex_broker record shows the mode, model, request count and statuses, never a credential.

Antigravity (agy, macOS only)

agy has no scratch-HOME login, so it runs with the real HOME, but the seatbelt profile denies reads under HOME except its own state directory (minus history), ~/.gemini/config, ~/.local and the two keychain database files it needs to authenticate. Those files are encrypted, but the agy process can read them and has network access. repo-ai runs it headless with edits only, shell actions denied, and never with --dangerously-skip-permissions. If that exposure is unacceptable to you, do not use --agent agy.

Claude Code

From 0.10.0 an isolated mission provider (macOS live-verified; Linux by tests only). It uses Claude Code’s own login and nothing is copied: either CLAUDE_CODE_OAUTH_TOKEN (from claude setup-token; not yet live-verified) or a separate repo-ai login (CLAUDE_CONFIG_DIR=<dir> claude auth login; repo-ai agents setup claude prints the exact command). The model gets file tools only, with no shell, web, MCP, skills or hooks; before every live run repo-ai starts the session once with a model name Claude Code rejects locally and refuses the run if anything else would load (an account can sync plugins and connectors into every login). --max-cost-usd maps to Claude’s own cap, which is checked between turns: one turn of overshoot was observed. Claude is also a host (repo-ai init --agent claude).

OpenCode (local model, macOS only)

Account-free: OpenCode runs against a loopback model endpoint such as Ollama (ollama pull qwen3:8b, then export REPO_AI_OPENCODE_MODEL=qwen3:8b; repo-ai agents setup opencode). The sandbox allows network to loopback only, a deny-by-default tool policy allows read, edit, glob, grep and list, project configuration is ignored and cloud-routed models are refused. Small local models are weak at this: in recorded journeys several attempts failed (repo-ai refused them) and one passed the visible tests while dropping a requirement that no test pinned.

Gemini CLI

The tested account was rejected (exit 41, 2026-10-30). From 0.10.0 repo-ai no longer copies ~/.gemini into the sandbox; live Gemini needs GEMINI_API_KEY or GOOGLE_API_KEY.

What every live run shares

• Live calls happen only with --run --allow-live-provider.
• The task text and the workspace files the agent opens go to that provider, under that provider’s terms.
• Network is allowed for the provider process (the model API needs it), so it can send what it can read.
• Subscription quota and unknown dollar cost are separate from any spending ceiling you set.

Details: Security & privacy.