This page describes Corbits Code, the app. It does not describe credentials or grants held by the control plane, and it does not speak for the shared agent runtime.
Global settings live in
~/.corbits/settings.json (providers and credentials). A per-repo .corbits/settings.json chooses the provider, model, and reasoning effort, and may also register MCP servers and set environment variables for the shell the agent runs commands in. An MCP server entry may carry its own env map, including a token needed by that server. Outside those entries, Corbits Code ignores credential-like top-level keys and reports a diagnostic. Codex tokens live in ~/.corbits/codex-auth.json and xAI tokens live in ~/.corbits/xai-auth.json; neither is ever written to settings.json. (MCP entry schema; local credential-key guard)--provider and --model, or point at an alternate definitions file with --config.
Most providers are reached over the OpenAI-compatible protocol, and Corbits Code also selects the runtime’s native Anthropic Messages path when the configured provider declares it. (inference routing; provider catalog)
Provider credentials are read only from the settings files and the OAuth token stores. There is no environment-variable override for them and .env files are not loaded, so a stale or exported key can never silently shadow the configured provider. Both settings.json files sit on the secret-guard denylist, so the agent cannot read its own API-key credentials through a file tool. A shell command that names one stops for an operator prompt instead. The OAuth token files are not on that denylist. (settings schema; secret path guard)
Support
Help Center
Join hundreds of developers building with Corbits and speak with the team directly.