Support Gate proxy authentication via ANTHROPIC_API_KEY and ANTHROPIC…#1096
Merged
git-hyagi merged 1 commit intoApr 23, 2026
Merged
Conversation
Contributor
Reviewer's GuideAdds proxy-based Anthropic auth support (via ANTHROPIC_API_KEY/ANTHROPIC_BASE_URL), expands Vertex AI auth options, and introduces a configurable default Claude model for the Splunk agent. Sequence diagram for Claude ModelRun auth path selectionsequenceDiagram
participant Caller
participant Claude
participant AnthropicSDK as AnthropicSDK
participant VertexClient as VertexVertexClient
participant GateProxy as GateProxy
participant AnthropicAPI as AnthropicAPI
Caller->>Claude: ModelRun(ctx, cfg)
Claude->>Claude: Build options with WithModel
alt Proxy mode (APIKey present)
Claude->>AnthropicSDK: New(WithModel, WithToken(APIKey), optional WithBaseURL(BaseURL))
AnthropicSDK-->>Claude: llm client
Claude->>GateProxy: llm request (BaseURL)
GateProxy->>AnthropicAPI: Forward request with real credentials
AnthropicAPI-->>GateProxy: Response
GateProxy-->>Claude: Proxied response
else Vertex AI mode (no APIKey)
Claude->>VertexClient: Init VertexClient(ProjectID, Region, Model, SACredential)
Claude->>AnthropicSDK: New(WithModel, WithToken(vertex-ai), WithHTTPClient(VertexClient))
AnthropicSDK-->>Claude: llm client
Claude->>VertexClient: llm request
VertexClient->>AnthropicAPI: Vertex AI routed request
AnthropicAPI-->>VertexClient: Response
VertexClient-->>Claude: Response
end
Claude-->>Caller: Answer string
Updated class diagram for Claude model configurationclassDiagram
class Claude {
string Model
string ProjectID
string Region
byte[] SACredential
string APIKey
string BaseURL
ModelRun(ctx context.Context, cfg RunConfig) string
}
Flow diagram for auth mode resolution in main.runflowchart TD
A[Start run] --> B[Read ANTHROPIC_API_KEY into apiKey]
B --> C[Read ANTHROPIC_BASE_URL into baseURL]
C --> D[Read VERTEX_SA_JSON into saJSON]
D --> E{saJSON is non empty?}
E -- Yes --> F[Set saCredential from saJSON and log using VERTEX_SA_JSON]
E -- No --> G[saCredential remains empty]
F --> H[Read ANTHROPIC_VERTEX_PROJECT_ID into projectID]
G --> H
H --> I{projectID is empty and saCredential present?}
I -- Yes --> J[Parse saCredential as JSON and extract project_id into projectID]
I -- No --> K[Keep existing projectID]
J --> L{apiKey is empty and projectID is empty?}
K --> L
L -- Yes --> M[[Error: require ANTHROPIC_API_KEY or ANTHROPIC_VERTEX_PROJECT_ID / VERTEX_SA_JSON]]
L -- No --> N{apiKey is non empty?}
N -- Yes --> O[Log using proxy mode with ANTHROPIC_BASE_URL]
N -- No --> P[Proceed with Vertex AI mode]
O --> Q[Read CLOUD_ML_REGION or default us-east5]
P --> Q
Q --> R[Resolve defaultModel from CLAUDE_MODEL env or claude-opus-4-6]
R --> S[Parse flags including -model]
S --> T[Construct Claude with ProjectID, Region, SACredential, APIKey, BaseURL]
T --> U[Continue agent execution]
M --> U
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- When
ANTHROPIC_API_KEYis set butANTHROPIC_BASE_URLis empty, the code silently falls back to the SDK default base URL while still claiming "proxy mode" in the log; consider validating thatANTHROPIC_BASE_URLis non-empty in proxy mode (or clearly defining the intended behavior in that case). - The
-modelflag help string still hardcodesclaude-opus-4-6as the default even thoughCLAUDE_MODELcan change it at runtime; consider formatting the help text using the computeddefaultModelso the CLI output matches actual behavior.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- When `ANTHROPIC_API_KEY` is set but `ANTHROPIC_BASE_URL` is empty, the code silently falls back to the SDK default base URL while still claiming "proxy mode" in the log; consider validating that `ANTHROPIC_BASE_URL` is non-empty in proxy mode (or clearly defining the intended behavior in that case).
- The `-model` flag help string still hardcodes `claude-opus-4-6` as the default even though `CLAUDE_MODEL` can change it at runtime; consider formatting the help text using the computed `defaultModel` so the CLI output matches actual behavior.
## Individual Comments
### Comment 1
<location path="tools/agents/agent-splunk/main.go" line_range="79" />
<code_context>
+ defaultModel = envModel
+ }
+
+ inputModel := flag.String("model", defaultModel, "Define the model (claude-opus-4-6,gemini-2.5-pro). Default: claude-opus-4-6")
inputQuestion := flag.String("question", "", "Question to ask the model")
flag.Parse()
</code_context>
<issue_to_address>
**suggestion:** Flag help text no longer matches the dynamic default model behavior
The description still hardcodes `Default: claude-opus-4-6`, but the actual default can change via `CLAUDE_MODEL`. Please either remove the hardcoded default from the help text or interpolate `defaultModel` so the help remains accurate when the env var is set.
```suggestion
inputModel := flag.String("model", defaultModel, "Define the model (claude-opus-4-6,gemini-2.5-pro). Default: "+defaultModel)
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
…_BASE_URL When running inside Alcove, Gate proxies all LLM traffic and injects real credentials. This change lets agent-splunk use that flow by reading ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL to send requests through Gate instead of authenticating directly to Vertex AI. Also adds CLAUDE_MODEL env var to control the default model, and VERTEX_SA_JSON for direct Vertex AI auth via service account JSON. Three auth modes are now supported: - Proxy: ANTHROPIC_API_KEY + ANTHROPIC_BASE_URL (Alcove/Gate) - Service account: VERTEX_SA_JSON (direct Vertex AI) - ADC: ANTHROPIC_VERTEX_PROJECT_ID (original behavior) Assisted By: claude-opus-4.6
git-hyagi
force-pushed
the
pulp-service-agent-splunk-gcloud-credentials
branch
from
2301d7d to
64e3999
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…_BASE_URL
When running inside Alcove, Gate proxies all LLM traffic and injects real credentials. This change lets agent-splunk use that flow by reading ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL to send requests through Gate instead of authenticating directly to Vertex AI.
Also adds CLAUDE_MODEL env var to control the default model, and VERTEX_SA_JSON for direct Vertex AI auth via service account JSON.
Three auth modes are now supported:
Assisted By: claude-opus-4.6
Summary by Sourcery
Add support for proxy-based Anthropic authentication in agent-splunk alongside existing Vertex AI modes and make the default Claude model configurable via environment variables.
New Features:
Enhancements: