Configuring LLM Providers

This guide covers the setup and configuration of Large Language Model (LLM) providers for AI-powered features in sfp:

• AI Assisted Architecture Analysis - Architectural review of pull request changes
• AI Assisted Insight Reports - On-demand project analysis reports
• AI-Assisted Error Analysis - Intelligent validation error analysis

All three features are exclusive to sfp-pro and share the single provider configuration described on this page — configure a provider once and every AI feature can use it.

Prerequisites

• sfp-pro installed.
• Credentials for at least one supported provider: an API key (Anthropic, OpenAI), an AWS Bedrock bearer token, a GitHub Copilot OAuth token, or — for Claude on Google Vertex — a Google Cloud project with a service account.
• No separate runtime to install — sfp bundles the OpenCode agent that talks to the providers.

Supported LLM Providers

sfp currently supports the following LLM providers through the bundled OpenCode runtime:

Provider Configuration

Anthropic (Claude) - Recommended

Anthropic's Claude models provide the best understanding of Salesforce and Flxbl framework patterns. The default model used is claude-sonnet-4-5-20250929 which offers optimal balance between performance and cost.

Setup

Step 1: Environment Variable

# Add to your shell profile (.bashrc, .zshrc, etc.)
export ANTHROPIC_API_KEY="sk-ant-xxxxxxxxxxxxx"

# Verify the configuration works
sfp ai test --provider anthropic

Step 2: Configuration File Create or edit config/ai-assist.yaml:

enabled: true
provider: anthropic
# Model is optional - uses claude-sonnet-4-5-20250929 by default

Getting an Anthropic API Key

1. Visit console.anthropic.com
2. Sign up or log in to your account
3. Navigate to API Keys section
4. Create a new API key for sfp usage
5. Copy the key (starts with sk-ant-)

OpenAI

OpenAI provides access to GPT models with good code analysis capabilities.

Setup

Step 1: Environment Variable

export OPENAI_API_KEY="sk-xxxxxxxxxxxxx"

# Verify the configuration works
sfp ai test --provider openai

Step 2: Configuration File

# In config/ai-assist.yaml
enabled: true
provider: openai
# Model is optional - uses gpt-4o by default

Getting an OpenAI API Key

1. Visit platform.openai.com
2. Sign up or log in
3. Go to API Keys section
4. Create a new secret key
5. Copy the key (starts with sk-)

Amazon Bedrock

Amazon Bedrock is ideal for enterprise environments already using AWS infrastructure. It provides access to Claude models through AWS.

Setup

Step 1: AWS Profile

# Set both required environment variables
export AWS_BEARER_TOKEN_BEDROCK="your-bearer-token"
export AWS_REGION="us-east-1"

# Both variables must be set for authentication to work
# Verify the configuration works
sfp ai test --provider amazon-bedrock

STEP 3: Configuration File

# In config/ai-assist.yaml
enabled: true
provider: amazon-bedrock
model: anthropic.claude-sonnet-4-5-20250929-v1:0  # Default model

Regional Considerations

Bedrock automatically handles model prefixes based on your AWS region:

• US Regions: Models may require us. prefix
• EU Regions: Models may require eu. prefix
• AP Regions: Models may require apac. prefix

The OpenCode SDK handles this automatically based on your AWS_REGION.

GitHub Copilot

GitHub Copilot can be used with a paid Copilot plan (Pro, Pro+, Business or Enterprise). sfp reads the token from COPILOT_TOKEN, or from GITHUB_TOKEN when COPILOT_TOKEN is not set.

Supported tokens

GitHub's Copilot API accepts OAuth tokens. It refuses personal access tokens from clients other than GitHub's own, so a personal access token fails with Personal Access Tokens are not supported for this endpoint, whatever its permissions.

Setup Methods

Method 1: OpenCode sign-in (Recommended)

OpenCode's GitHub Copilot sign-in is a GitHub device login that GitHub supports for paid Copilot plans. It asks only to read your profile.

# Install OpenCode (or: brew install anomalyco/tap/opencode, npm install -g opencode-ai)
curl -fsSL https://opencode.ai/install | bash

# Sign in: pick GitHub.com, open https://github.com/login/device and enter the code it prints
opencode auth login --provider github-copilot

# Read the token from OpenCode's credentials file (opencode auth list prints its path)
export COPILOT_TOKEN="$(jq -r '."github-copilot".refresh' ~/.local/share/opencode/auth.json)"

# Verify the configuration works
sfp ai test --provider github-copilot

The same steps, with screenshots of each, are on the codev GitHub Copilot page.

Method 2: Environment Variable (CI/CD)

For CI/CD pipelines, store the token as a secret and expose it as COPILOT_TOKEN:

# Add to your shell profile or CI/CD secrets
export COPILOT_TOKEN="gho_xxxxxxxxxxxx"

In GitHub Actions:

jobs:
  analyze:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run AI Analysis
        env:
          COPILOT_TOKEN: ${{ secrets.COPILOT_TOKEN }}
        run: |
          sfp project:analyze --provider github-copilot

How sfp Uses the Token

sfp passes a gho_ token to GitHub Copilot unchanged. Any other token is refused before a request is made, with: "This token can't be used for GitHub Copilot. Paste an OAuth token from OpenCode's GitHub Copilot sign-in (see the setup steps)."

Configuration File

# In config/ai-assist.yaml
enabled: true
provider: github-copilot
# Model is optional - uses claude-sonnet-5 by default for GitHub Copilot

Available Models

GitHub Copilot provides access to various models. The default is claude-sonnet-5:

Claude on Google Vertex

Claude on Google Vertex serves Anthropic Claude models through your own Google Cloud project, so model traffic and billing stay inside your Google Cloud agreement. It is normally connected in the codev UI under Settings → Integrations → AI Providers, where the credentials are stored on the sfp server and every connected pipeline reuses them — see AI Providers. The one-time Google Cloud setup (enable the Vertex AI API, enable the Claude models in Model Garden, create a service account with the Vertex AI User role, and confirm the project has model quota) is covered in Claude on Vertex AI.

Setup

Vertex uses Google IAM auth, not an API key. To run the sfp CLI directly against Vertex, use Google Application Default Credentials:

export GOOGLE_CLOUD_PROJECT="my-project-123456"
export GOOGLE_CLOUD_LOCATION="us"          # us, eu, or global (default: global)
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"

# Verify the configuration works
sfp ai test --provider google-vertex-anthropic

# In config/ai-assist.yaml
enabled: true
provider: google-vertex-anthropic
# Model is optional - uses the latest available Claude by default

Configuration File Reference

The AI features are configured through config/ai-assist.yaml in your project root:

# Enable/disable AI features
enabled: true

# Provider Configuration
provider: anthropic  # anthropic, openai, amazon-bedrock, github-copilot, google-vertex-anthropic

# Model Configuration (Optional - uses provider defaults if not specified)
# Default models:
# - anthropic: claude-sonnet-4-5-20250929
# - openai: gpt-4o
# - github-copilot: claude-sonnet-5
# - amazon-bedrock: set an explicit Bedrock model id (e.g. anthropic.claude-sonnet-4-5-20250929-v1:0)
# - google-vertex-anthropic: uses the latest available Claude by default
model: claude-sonnet-4-5-20250929  # Override default model

# Architectural Patterns to Check (for PR Linter)
patterns:
  - singleton
  - factory
  - repository
  - service-layer

# Architecture Principles
principles:
  - separation-of-concerns
  - single-responsibility
  - dependency-inversion

# Focus Areas for Analysis
focusAreas:
  - security
  - performance
  - maintainability
  - testability

# Additional Context Files
contextFiles:
  - ARCHITECTURE.md
  - docs/patterns.md
  - docs/coding-standards.md

Testing Provider Configuration

The test command performs a complete health check:

• Authentication: Verifies credentials are available
• Connectivity: Confirms the provider endpoint is reachable
• Response: Validates the model returns a valid response

Testing Commands

sfp ai test requires the --provider flag — there is no "test all" mode. Each run tests one provider end to end.

# Test a provider with its default model
sfp ai test --provider anthropic

# Test a specific model
sfp ai test --provider openai --model gpt-4o

# Test Amazon Bedrock (default model: anthropic.claude-3-sonnet-20240229-v1:0)
sfp ai test --provider amazon-bedrock

# Test GitHub Copilot (default model: claude-sonnet-5)
sfp ai test --provider github-copilot

# Test Claude on Google Vertex (requires GOOGLE_CLOUD_PROJECT + GOOGLE_APPLICATION_CREDENTIALS)
sfp ai test --provider google-vertex-anthropic

# Send a custom prompt / raise the timeout / emit JSON
sfp ai test --provider anthropic --prompt "What is 2+2?" --timeout 90 --json

This command performs a simple inference test to verify:

• Authentication is configured correctly
• The provider is accessible
• Model inference is working
• Response time and performance

Usage Priority

sfp resolves provider credentials in this order:

1. Server-managed credentials — when sfp is connected to an sfp server (server URL + application token present), it fetches the provider credentials from the server first. See Server-Managed Credentials.
2. Environment variables — ANTHROPIC_API_KEY, OPENAI_API_KEY, AWS_BEARER_TOKEN_BEDROCK + AWS_REGION, COPILOT_TOKEN / GITHUB_TOKEN, or GOOGLE_CLOUD_PROJECT + GOOGLE_APPLICATION_CREDENTIALS for Vertex. Recommended for local use and self-managed CI/CD.
3. Configuration file — config/ai-assist.yaml selects the provider and model; it does not store secrets.

Server-Managed Credentials

When sfp runs with an sfp server connection — either via the --sfp-server-url and --application-token flags, or the SFP_SERVER_URL and SFP_SERVER_TOKEN environment variables — AI commands such as sfp project:report and sfp project:analyze fetch provider credentials from the server instead of requiring them in the pipeline environment. If the server has no credentials for the requested provider, sfp falls back to the local environment variables listed above.

This keeps API keys out of individual CI/CD pipelines: configure a provider once on the server, and every connected repository and pipeline can use it.

Troubleshooting

Provider Not Available

# Verify environment variables
echo $ANTHROPIC_API_KEY

# For AWS Bedrock - check both required variables
echo $AWS_BEARER_TOKEN_BEDROCK
echo $AWS_REGION

# For GitHub Copilot
echo $COPILOT_TOKEN

# Test provider connectivity
sfp ai test --provider <provider-name>

AWS Bedrock Specific Issues

Both Environment Variables Required

# This will NOT work (missing region)
export AWS_BEARER_TOKEN_BEDROCK="token"

# This will work (both variables set)
export AWS_BEARER_TOKEN_BEDROCK="token"
export AWS_REGION="us-east-1"

Authentication Failed

• Verify both AWS_BEARER_TOKEN_BEDROCK and AWS_REGION are set
• Check that your bearer token is valid and not expired
• Ensure your AWS account has access to Claude models in Bedrock

API Rate Limits

If you encounter rate limits:

• Anthropic: Check your usage at console.anthropic.com
• OpenAI: Monitor at platform.openai.com/usage
• Bedrock: Check AWS CloudWatch metrics

Model Not Found

Ensure you're using the correct model identifier for your provider:

# Anthropic
model: claude-sonnet-4-5-20250929

# OpenAI
model: gpt-4o

# GitHub Copilot
model: gpt-4o

# Amazon Bedrock
model: anthropic.claude-sonnet-4-5-20250929-v1:0