---
title: "Models"
---

# Models

How the Editor, the Agents app and the CLI reach models: your organisation's models through Neural Inverse Govern, providers you connect yourself, and local models.

The Build apps reach models in three ways: your organisation's models through Neural Inverse Govern, providers you connect yourself, and models that run on your own machine. Your organisation decides which of these you may use.

## Your organisation's models (Editor and Agents app)

In the Editor and the Agents app, choose the provider **Organization models (Keystone)** on the Models page. It has no fields to fill in:

- the address is your signed-in session's verified Govern deployment;
- the credential is your own sign-in, refreshed once if it is rejected.

Neither can be typed in, so a settings file or an agent cannot point it elsewhere. The token is only sent over HTTPS.

Calls go through Govern's model gateway, which is compatible with the OpenAI and Anthropic APIs. In Govern, administrators decide what the gateway allows:

- every model is denied until it is allowed, for the organisation, a team or a project;
- data loss prevention applies by data classification;
- budgets and rate limits apply;
- every request is audited.

Because this is enforced by Govern, it holds whichever client calls the gateway. See [Govern](https://neuralinverse.com/docs/govern/) for how administrators configure model access.

## Providers you connect

You can also connect a provider with your own key, subject to your organisation's policy. The Editor and the Agents app share the same providers, models and credentials, because model calls run in the shared agent host.

| In the Editor and the Agents app | In the CLI |
|---|---|
| Anthropic, OpenAI, Google Gemini, Azure OpenAI, Google Vertex AI, AWS Bedrock, OpenRouter, Groq, xAI, Mistral, DeepSeek, GitHub Models, Fireworks AI, Cerebras, Qwen (Alibaba Cloud), Moonshot (Kimi), LiteLLM, and any OpenAI-compatible endpoint | Anthropic, OpenAI (Chat Completions and Responses), Google Gemini, AWS Bedrock, Claude on Vertex AI, Azure OpenAI, and any OpenAI-compatible server (for example OpenRouter, Groq, DeepSeek, Mistral, xAI) |

### In the CLI

Models are named `provider/model`, for example `anthropic/claude-sonnet-5-5` or `ollama/qwen3-coder`. Choose one with `--model`, the `model` setting or `/model`.

These providers work with no configuration when their credentials are present:

| Provider id | Credentials |
|---|---|
| `anthropic` | `ANTHROPIC_API_KEY` |
| `openai` | `OPENAI_API_KEY` |
| `gemini` | `GEMINI_API_KEY` or `GOOGLE_API_KEY` |
| `bedrock` | `AWS_REGION` plus AWS credentials, or `AWS_BEARER_TOKEN_BEDROCK` |
| `vertex` | `ANTHROPIC_VERTEX_PROJECT_ID` or `GOOGLE_CLOUD_PROJECT`, `CLOUD_ML_REGION`, Google application-default credentials |
| `openrouter`, `deepseek`, `groq`, `mistral`, `xai` | `OPENROUTER_API_KEY`, `DEEPSEEK_API_KEY`, `GROQ_API_KEY`, `MISTRAL_API_KEY`, `XAI_API_KEY` |
| `ollama` | None; uses `OLLAMA_HOST` or `http://localhost:11434` |

`neuralinverse setup [provider]` connects a provider interactively. The key is checked live with a model listing before anything is saved, and stored in the operating system's keychain (macOS Keychain, the Secret Service on Linux, PowerShell SecretManagement on Windows), never in `settings.json`. Settings refer to it with `apiKeyCommand`.

Other providers are configured under `providers` in the settings:

```jsonc
{
  "model": "gpu/qwen3-coder-480b",
  "providers": {
    "gpu": {
      "kind": "openai",
      "baseUrl": "https://vllm.internal.example.com/v1",
      "apiKeyCommand": "op read op://eng/vllm/token"
    }
  }
}
```

`kind` is one of `anthropic`, `openai`, `openai-responses`, `gemini`, `bedrock` or `vertex-anthropic`. Prefer `apiKeyEnv`, `apiKeyCommand` or `apiKeyFile` to a literal key in any file that might be shared.

## Local models

Models that run on your own machine need no key.

- **Editor and Agents app:** Ollama, LM Studio and vLLM are offered as local providers.
- **CLI:** Ollama is detected automatically; any other local server that speaks the OpenAI API can be added as a provider with its `baseUrl`.

```bash
ollama pull qwen3-coder
neuralinverse --model ollama/qwen3-coder
```

## What your organisation controls

- **Govern** decides which organisation models each person may use, and enforces data loss prevention, budgets and audit at the gateway.
- **Organisation policy** in the Editor and the Agents app can deny or require approval for models; the apps apply these rules on the device. See [Policy, approvals and audit](https://neuralinverse.com/docs/build/governance/).
- **CLI managed policy** can fix the providers and the model, for example to route all model traffic through an internal gateway. See [the CLI's managed policy](https://neuralinverse.com/docs/cli/enterprise/#managed-settings-file).