Point Kno at a real provider

The default agent is fake:, free, local, deterministic. The quickstart proves the loop on it. For numbers that mean something, point Kno at the agent you actually use.

Keys come from the environment

Never from a flag, never from kno.yaml:

export OPENAI_API_KEY=sk-...
kno baseline --evals cases.jsonl --agent openai:gpt-4.1 --max-cost-usd 2.00 --yes

OpenAI-compatible endpoints

Any OpenAI-compatible endpoint works via --base-url:

kno baseline --evals cases.jsonl --agent openai:<model> \
  --base-url https://your-endpoint.example/v1

Local runtimes, vLLM, Ollama, llama.cpp, need no key:

kno baseline --evals cases.jsonl --agent openai:llama-3.1-8b \
  --base-url http://localhost:11434/v1

Anthropic

export ANTHROPIC_API_KEY=sk-ant-...
kno baseline --evals cases.jsonl --agent anthropic:claude-sonnet-5 \
  --max-output-tokens 1024 --max-cost-usd 2.00 --yes

--max-output-tokens is required for the Anthropic adapter.

Your own agent behind a shell command

The exec: adapter runs any shell command as the agent, your harness, your model router, anything:

kno baseline --evals cases.jsonl --agent exec:./my-agent.sh

Budget every real run

Pointing at a provider that bills you is exactly when the budget guard matters: --max-cost-usd with --yes makes a run unattended-safe. Kno prices each case from its own table, so the cap binds before the call , not at settlement. See Set a budget.

What ships

openai:, anthropic:, bedrock:, vertex:, exec:, and fake: ship today. Bedrock (Converse, SigV4) and Vertex (:rawPredict) use environment-only credentials, no key flags, ever. The Tuner adapter, with a proxy fine-tuning bridge, arrives in v0.2.