# Connect your models

Use the subscriptions you already pay for, your own API keys, or models on your own Mac, and choose which model does which job.

Warden doesn't sell model access. You connect what you already have, in **Settings → Models**, and the same rules apply whichever you pick.

## Your subscriptions

Sign in once with each tool's own CLI, as you do today. Warden then drives the agent over ACP (the Agent Client Protocol). There are no API keys to manage and no metered bill on top.

| Agent | How Warden runs it |
|---|---|
| **Claude Code** | Through the Claude ACP adapter: `npm install -g @agentclientprotocol/claude-agent-acp` |
| **Codex / ChatGPT** | **Sign in online** with your ChatGPT account (no install, several accounts), or **Use ACP** with `npm install -g @agentclientprotocol/codex-acp` |
| **GitHub Copilot** | `copilot --acp` |
| **Devin** | `devin acp` |
| **Kimi** | `kimi acp` |

If Warden can't find an agent you have installed, open it under **Settings → Models** and press **Locate** to point at it.

> [!NOTE] How closely each agent is checked
> Claude Code is checked before every action. With Codex, Copilot, Devin and Kimi, anything the agent asks permission for is checked before it runs. A tool one of them runs *without* asking is checked as it starts, so it may already have run, but a blocked result is thrown away before the agent sees it. A CLI Warden can't check at all is shown as unavailable while your rules are on. See [Known limitations](limitations).

## Your API keys

Bring a key for hosted frontier and open-weight models, run by Warden's built-in agent: Amazon Bedrock, Azure OpenAI, Google Gemini, OpenAI, Anthropic, OpenRouter, xAI, Groq, Mistral, DeepSeek and more. Keys are kept in the macOS keychain. Routers (OpenRouter, DigitalOcean) give you many models behind one key.

With an API key or a local model, every tool call is checked before it runs.

### Several accounts for one provider

Keep work and personal keys apart: on a connected provider, choose **Add account** and give it a name (*Work*, *Personal*). Each account appears as its own group in the model picker. A project's **Models** tab can **Use**, **Prefer** or **Never** use each account. ChatGPT has its own account switcher, so several ChatGPT sign-ins can sit side by side.

## Models on your own Mac

Run open-weight models locally and your code never leaves your Mac:

- **Ollama**: its own section under **Settings → Models**.
- **LM Studio**: connect to its local server (by default `http://localhost:1234`).
- **llama.cpp**: through **Llama Swap**.

## A model for each job

A project's **Models** tab (or {{kbd:⌘+K}} → **Models** for all projects) decides which model does what. Each role can be **Pinned** to one model, left to **Warden** to pick from your allow-list, or sent to a **Router**:

| Role | Used for |
|---|---|
| **Planning & architecture** | Plans, specs, Factory triage and shaping |
| **Code generation** | Building, including Factory builds |
| **Bug fixing** | Factory builds of bugs |
| **Code review · the grader** | Independent review and grading. It should differ from the model that wrote the code, and Warden warns you when it doesn't |
| **General & chat** | Everything else |

The same tab holds the **Allow-list** (which models may be used at all), **Skill models** (run a skill such as a review skill on a particular model), **Accounts**, and **Route each turn to the right model**, which picks a role for each message you send.

> [!TIP] Rules can follow the model
> Warden tells the policy engine which model is in use, so a rule can keep production data on models you trust:
>
> `deny: { tool: "*" }` with `when: { env: prod }` and `unless: { model_route: ["aws_bedrock/*"] }`
>
> See [Rule recipes](rule-recipes#keep-production-data-on-approved-models).