Skip to main content
Every model call your organization makes goes through the AI Gateway. Agents, apps and the coding tools people run (Claude Code, Codex and OpenCode) call it with an xpander key or session token, never a provider key.

​
What happens to each call

Prompt and response text is saved encrypted, unless an admin turns off Saved prompt text. Calls xpander makes for you, such as conversation summaries, show in Logs with a System badge.

​
Agent runs

An agent session holds no provider key. Its harness gets ANTHROPIC_BASE_URL (Claude Code) or OPENAI_BASE_URL (Codex) pointing at a model relay on its own executor, and only a placeholder for the run’s session token. The relay puts the token on each model call and forwards it to the LLM proxy on the Agent Controller, so the commands and skills the agent runs never see a credential.
No executor, workspace or harness holds a provider key. For each call, the proxy resolves the credential, applies the model policy and budget, records the call under the person who asked, and forwards it (through the in-cluster AI Gateway on a self-hosted install). It carries:
  • Every turn of an agent on Claude Code, Codex or OpenCode.
  • xpander’s own model calls: thread titles, context compaction, evaluation judges, and the gateway model that filters entries ahead of the agent’s model.
  • Guardrail moderation, when enabled.

​
Any model on any harness

The gateway translates between harness and provider APIs, so Claude Code, Codex and OpenCode can each run any model your organization allows, including your own (such as vLLM on your GPUs on Air-Gapped). Pick it in the composer’s Harness and model picker.
  • Claude Code and Codex list their own vendor’s models, plus a model from another vendor that passed xpander’s test on that harness: chat, a tool call, streaming and long context. OpenCode lists every catalog model except a pair the test showed as broken.
  • A model from your own provider is listed for a harness after an admin runs Test model on it for that harness and it passes (Model testing).
  • Each turn is recorded in Platform > AI governance > Logs with the model that ran it.
  • A personal Claude plan applies only to Claude models from Anthropic. A model from another vendor runs on the organization’s providers.

​
Cloud, Hybrid and Air-Gapped

On xpander cloud the gateway runs in xpander cloud at https://llm-gw.xpander.ai. On Hybrid it runs in your install for your agents, while people’s coding tools use xpander cloud. On Air-Gapped everything runs in your install, at https://llm-gw.<your domain>.
On Hybrid and Air-Gapped the gateway is always on, and every provider your agents use needs a key. See Self-hosted.

​
Where each setting lives

Admins work under Platform > AI governance: Models, Budgets, Policies, Usage, Logs and Audit log.
People’s own keys, coding tool setup and spend are in xpander Chat: AI models & keys and Usage. On a self-hosted install, use your own addresses.

​
Get started

  1. In Models, choose Add provider and add a key (on xpander cloud you can start on the models included with xpander), then tick the models people may use. Who may use it… limits one to groups. Optionally add an alias, such as default-coding with a fallback.
  2. Set Budgets and Policies.
  3. In AI models & keys, choose a client and Copy setup command (steps). Your first request shows at the top of Logs.

​
Next steps

Fix a refused call

Messages and fixes.

See what is stored

Security of gateway records.