Bring Your Own Foundation (BWOF)
Buril Community ships no bundled provider keys. You supply your own foundation. As of 1.5.0, the product supports 13 chat providers across three families:
Family 1 — HTTP API (BYOK)
You paste an API key. Billed against your account.
| Provider | Cost shape | Best for |
|---|---|---|
| Anthropic (Claude) | Per-token | Long-horizon agentic work, multi-step tool calls, vision feedback |
| OpenAI (GPT) | Per-token | Mixed text + image input, structured outputs, vision feedback |
| Google Gemini | Per-token | Vision, very long context, multimodal pipelines |
| Ollama | Free, local | Offline use, fully air-gapped workflows |
| LM Studio | Free, local | Same as Ollama, with a GUI for picking models |
Family 2 — Subprocess CLI (Bring Your Own CLI)
You already have a vendor CLI installed and signed in. Buril runs it as a subprocess. Your subscription pays for inference. No fresh API key. No double billing. Buril never sees the credential.
| Provider | Binary | Status |
|---|---|---|
| Claude Code (FLAGSHIP) | claude | Production, supports MCP for full Buril tool access |
| OpenAI Codex | codex | Production (GA 2026-04 with codex exec --json) |
| GitHub Copilot CLI | copilot | Production (GA 2026-02-25 as autonomous coding agent) |
Setup: install the vendor CLI, sign in (whatever flow the vendor uses — usually claude setup-token, gh auth login, etc.), then pick the provider from Buril Settings. The "CLI path override" field is optional — Buril auto-detects the binary on PATH and in /opt/homebrew/bin, ~/.local/bin, ~/bin, ~/.cargo/bin, ~/.bun/bin, ~/.antigravity/bin, plus Windows equivalents.
Family 3 — Cloud HTTP (Bring Your Own Cloud)
Your organization already pays for one of the big-three enterprise clouds. Buril talks to its OpenAI-compatible endpoint with your existing enterprise auth.
| Provider | Auth | Endpoint |
|---|---|---|
| Azure OpenAI | api-key header | {resource}.openai.azure.com/openai/deployments/{deployment} |
| AWS Bedrock (Mantle) | SigV4 signing | bedrock-runtime.{region}.amazonaws.com/openai/v1 |
| Google Vertex AI | Service-account JWT → 1h bearer | {region}-aiplatform.googleapis.com/v1beta1/.../openapi |
All three are OpenAI-compatible — same request shape as openai.api. Buril ships pure-C# implementations of SigV4 and Google service-account JWT exchange (no AWS or Google SDK pulled into the Unity package).
Where credentials are stored
All credentials live in two places, in order of precedence:
- Environment variable — if set, this wins. Use this for CI/CD and per-machine secrets.
BURIL_ANTHROPIC_API_KEY,BURIL_OPENAI_API_KEY,BURIL_GEMINI_API_KEY- HTTP API providers only — subprocess providers use the vendor CLI's own OAuth store.
- OS keychain via EditorPrefs — for everything not covered above (cloud credentials, multi-field secrets like the AWS access-key-id / secret pair, service-account JSON blobs). Stored in:
- macOS Keychain
- Windows Credential Manager
- libsecret (Linux)
Per-user, not per-project. Buril does not read .env files, gcloud auth, or shell history.
Vision feedback (which providers support it)
Vision feedback is the 1.5.0 killer feature — after every mutating tool, the agent captures a SceneView screenshot, the model SEES the result, and self-corrects. This requires a vision-capable model. Per-provider support:
| Provider | SupportsVision | Notes |
|---|---|---|
| Anthropic | ✅ | Claude Opus 4.7, Sonnet 4.6, Haiku 4.5 all native |
| OpenAI | ✅ | gpt-5, gpt-5-mini, gpt-4.1, gpt-4o, o1 |
| Gemini | ✅ | gemini-2.5-pro / flash, gemini-2.0-flash |
| Claude Code CLI | ✅ | Backend = Claude models |
| Codex CLI | ✅ | Backend = gpt-5 / o1 |
| Azure OpenAI | ✅ | Deployment-dependent (most current deployments support vision) |
| Bedrock | ✅ | Claude on Bedrock + Llama 4 + Nova all support vision |
| Vertex AI | ✅ | Gemini + Claude on Vertex + Llama 4 |
| Ollama / LM Studio | ❌ | Model-dependent; default false (safe) |
| Copilot CLI | ❌ | Plain-text output passthrough — would silently lose images |
| Gemini CLI | ❌ | Same as above |
When you pick a non-vision provider, Buril skips screenshot capture entirely (no token waste).
Wiring a provider in the Editor
- Open Edit → Project Settings → Buril → Providers.
- Pick the active provider from the dropdown.
- Configure per the family above:
- HTTP API: paste API key.
- Subprocess CLI: confirm the binary is detected (green ✓ next to "CLI path"). Override the path if needed.
- Cloud HTTP: paste the credentials fields (resource + deployment + api-key for Azure; access-key + secret + region for Bedrock; service-account JSON + project + region for Vertex).
- Pick a model from the dropdown.
External Claude Code → Buril MCP
Already in a Claude Code terminal session? Connect Claude Code to Buril's MCP server in one command — your subscription, Buril's 3,691 ITools:
claude mcp add buril \
--url http://127.0.0.1:8766/rpc \
--header "Authorization: Bearer $(security find-generic-password -s 'buril-mcp-token' -w)" \
--transport http
The bearer token is generated automatically when you enable the Buril MCP HTTP transport (Edit → Project Settings → Buril → HTTP Authentication).
Cost guardrails
Buril does not enforce spend limits — that's the provider's job. Recommended:
- Set a monthly cap in your provider dashboard.
- Use Sonnet / GPT-4o-mini / Gemini Flash for routine work, escalate to Opus / GPT-5 / Gemini Pro only when needed.
- Watch the Cost column in the chat panel — Buril reports per-message token counts and an estimated USD figure.
- For subprocess CLI providers, the vendor handles billing — no Buril-side counter (your subscription dashboard is the source of truth).
Troubleshooting
| Symptom | Fix |
|---|---|
| "401 Unauthorized" | Key is wrong or expired. Re-paste in Settings. |
| "Model not found" | Provider sunset that model. Update the model field. |
| "Tool calls disabled" | The model you picked doesn't support function calling. Switch to a tool-calling model. |
| "binary not found on PATH" (subprocess) | Install the vendor CLI, sign in, then click "Auto-detect" in Settings. |
| "Subprocess exited with code 1" | Vendor's OAuth session may have expired. Run claude setup-token / codex login / equivalent. |
| Vision feedback not working | (a) Active provider must have SupportsVision = ✅. (b) Setting toggle must be ON. (c) Only mutating tools trigger capture — read-only tools skip it. |
| Bedrock "403 SignatureDoesNotMatch" | Clock skew >15min. Sync system time. |
| Vertex AI "401 invalid_grant" | Service-account JSON expired or malformed. Re-download from Google Cloud Console. |
| Ollama "connection refused" | Daemon not running. Run ollama serve (or open the Ollama app). |