LLM providers

MergeJudge is bring-your-own-LLM. The default and recommended setup is an API key for a pay-as-you-go provider, stored as a key in the hosted manager panel. Without a key, MergeJudge runs rules-only and still works.

Model names below are examples; they change often, so check your provider's docs.

API keys (recommended)

Pick the provider in .mergejudge.yml (read from the base branch). The key is read from the secret named by api_key_env, or the default below.

On the hosted Worker, Worker secrets are limited to ANTHROPIC_API_KEY, OPENAI_API_KEY, GLM_API_KEY, ZAI_API_KEY and OPENROUTER_API_KEY, and each is sent only to its provider's official host (api.anthropic.com, api.openai.com, api.z.ai, openrouter.ai). For any other base_url, add your own key in the panel; otherwise the review runs rules-only.

type	API	Default key name	Notes
anthropic	Messages API (/v1/messages)	ANTHROPIC_API_KEY
openai	Chat Completions, or Responses with api: responses	OPENAI_API_KEY
zai	z.ai, OpenAI-compatible	ZAI_API_KEY	endpoint: paygo (default) or endpoint: coding
openai-compatible	Any Chat Completions endpoint	OPENAI_API_KEY	needs base_url
workers-ai	Cloudflare Workers AI AI binding	none	hosted Worker only

# Anthropic
provider: { type: anthropic, model: claude-sonnet-5-5 }

# OpenAI, Chat Completions (default) or Responses API
provider: { type: openai, model: gpt-5-mini }
provider: { type: openai, api: responses, model: gpt-5-mini }

# z.ai GLM, pay-as-you-go
provider: { type: zai, model: glm-5.3 }

# Any OpenAI-compatible endpoint
provider: { type: openai-compatible, base_url: https://openrouter.ai/api/v1, model: openai/gpt-5-mini, api_key_env: OPENROUTER_API_KEY }

# Cloudflare Workers AI (Worker only, no key; billed to the Cloudflare account)
provider: { type: workers-ai, model: "@cf/zai-org/glm-4.7-flash" }

Every adapter goes through the same JSON check: if the reply isn't valid JSON, MergeJudge retries once with the parse error (and JSON mode where the API has one), then falls back to rules only.

On the Worker, only model keys are visible to provider selection. The GitHub App key and webhook secret are never passed to a provider, even if api_key_env names them.

Other OpenAI-compatible endpoints

• OpenRouter: base_url: https://openrouter.ai/api/v1, one key for many models.
• AWS Bedrock: via an OpenAI-compatible gateway or Bedrock's OpenAI-compatible endpoint for your region.

Model names above are examples and change often; check your provider's docs.

Subscriptions (Claude, ChatGPT, coding subscriptions)

Consumer and coding subscriptions are not API keys, and their conditions of use generally don't allow using them as a backend for automated CI services. MergeJudge does not support plugging a subscription token into its provider.

If you want to use a subscription in CI, use the vendor's official integration, alongside MergeJudge in rules-only mode.

z.ai coding plan

type: zai, endpoint: coding points at the z.ai coding-plan endpoint. It is supported because some owners use it for their own repos, but it's a subscription meant for coding tools: read z.ai's conditions of use before using it for automated reviews, and prefer the pay-as-you-go endpoint (endpoint: paygo) for anything shared.

Cost and safety

• diff and context modes: one LLM call per PR run (plus at most one JSON repair retry).
• deep mode: a bounded tool loop, capped by deep.max_steps, deep.max_tokens and deep.max_seconds. It needs a provider that can call tools (anthropic, openai, zai, openai-compatible with a tool-capable model); workers-ai falls back to context. See Review modes.
• budget.max_tokens_per_pr caps the prompt; patches are truncated to fit. budget.max_output_tokens caps the reply (default: 8000 for reasoning models such as glm-5.x, gpt-5 and o-series, else 2500; a reply cut off at the limit is retried once with 2x and compact JSON, then falls back to rules-only).
• Keys are read from the env var named in api_key_env and are never logged or posted.
• PR content is sent inside <untrusted_pr_data> delimiters and the model is told to ignore instructions in it.