Providers & Models — the guide

Every AI feature of a MeshWeaver installation — chat, agents, search, summaries — ends at a model provider: an endpoint, a credential and the models it exposes. This package is the administration surface for them. It answers the question that is otherwise hard to answer on a running installation: where does this credential, this model, this search path actually come from — and where do I change it safely?

It is for administrators of an installation and for anyone who keeps their own provider keys.

Key concepts

• ModelProvider node — the one home of a credential. Each provider is a mesh node holding its label, endpoint, authentication method and key. Configuration of the deployment is only a seed into that node, never a second live source: on every start an empty key on the node is filled from the provider's configuration section and stored encrypted. Once the node holds a key, the node wins — changing the configured secret does not replace it. Rotate an existing key on the node's setup form, never by changing configuration alone.
• Encrypted at rest. A key is stored in protected form (tagged enc:v1:), never as cleartext in node content. The provenance view shows, per credential, whether the value at rest is protected.
• Models and tiers. An agent asks for a tier — such as utility, chat, reasoning or coding — rather than a model name; the resolver picks the lowest-ordered model that carries the tier. A tier that no model carries is a miss that falls back to the deployment default. That is valid, but easy to miss: the app does not compute it for you, so compare the tier list with the tiers your models carry.
• Three layers. Providers and models exist globally (Provider/{Name}), per space ({space}/Provider/{Name}) and per person ({you}/_Memex/{Name}). Agents and skills are found under each package's Agent and Skill folders and in your own space.

What the app shows

The overview puts the whole picture on one page:

• the providers of this installation, global ones and your own side by side;
• the provenance of each credential — which configuration key seeded it and whether the stored value is encrypted;
• the models and the tier registry, side by side, so you can check each tier against the models that carry it;
• the search paths: where this installation looks for providers, models, agents and skills.

Set up a provider

Set up AI providers shows one card per provider you can see, with the fields it actually needs — label, endpoint, authentication method (apiKey, oauth or authToken), the key and an optional key for its MCP endpoint — and the list of models it exposes. The form is the sanctioned way to write a key:

1. Paste the key and press Save.
2. The value is encrypted before it is written. If the installation cannot encrypt, the form refuses the write and says so — nothing is stored rather than a key in cleartext.
3. Non-secret fields prefill from what is stored; secret fields always start empty, and a blank secret on Save means keep the stored one, so correcting an endpoint can never wipe a key.
4. A stored key is never shown again. The label says only whether one is set and in which state — not even its last characters.

The write runs under your own identity, so the installation's access rules decide which providers you may change. A raw edit of the node through other tools does not encrypt, which is why the form is the only recommended path.

The same page also lists the personal execution harnesses you can add — command-line agent engines such as OpenCode that run your chat rounds — each with its own install step from its package.

A typical task

• Rotate a key: open the provider's card, paste the new key, Save, and check the label now reads as set and encrypted.
• Find out why an agent used an unexpected model: open the overview, find the tier the agent asks for in the tier registry, and check by hand whether any model carries it; if none does, give a model that tier.
• Bring your own key: add a provider under your own layer; it is used for you only.

The package also ships the /providers skill, so an assistant can walk you through the same steps and never touches a key by hand.

What you get

The package is in the free tier and is filed under Administration. Getting it adds the overview and the setup form described above.