Add OrcaRouter pre-configured provider

[jinhaosong-source]

Description of the Change

Problem

PentAGI reaches OpenAI-compatible aggregators (OpenRouter, DeepInfra, Novita) through the
custom LLM endpoint with a pre-built provider config, but has none for OrcaRouter.
OrcaRouter is an OpenAI-compatible model-routing gateway — one
endpoint and API key fronting 150+ models with adaptive per-request routing, plus optional
gateway-level security controls for AI agents.

Solution

Add a pre-configured provider file examples/configs/orcarouter.provider.yml, modeled on the
existing openrouter.provider.yml, mapping each agent role to namespaced OrcaRouter models
(e.g. openai/gpt-5.5, google/gemini-3.5-flash, anthropic/claude-sonnet-4.6). It is used
through the existing custom LLM endpoint — no code changes:

LLM_SERVER_URL=https://api.orcarouter.ai/v1
LLM_SERVER_KEY=sk-orca-...
LLM_SERVER_CONFIG_PATH=/opt/pentagi/conf/orcarouter.provider.yml

README is updated to list OrcaRouter alongside the other pre-configured aggregators (usage
example, .env snippet, and the LiteLLM *_PROVIDER prefix list).

Closes #

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• 🚀 New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Configuration change
• 🧪 Test update
• 🛡️ Security update

Areas Affected

• Core Services (Frontend UI/Backend API)
• AI Agents (Researcher/Developer/Executor)
• Security Tools Integration
• Memory System (Vector Store/Knowledge Base)
• Monitoring Stack (Grafana/OpenTelemetry)
• Analytics Platform (Langfuse)
• External Integrations (LLM/Search APIs)
• Documentation
• Infrastructure/DevOps

Testing and Verification

Test Configuration

PentAGI Version: main
Docker Version: n/a (config + docs only)
Host OS: Linux/Docker
LLM Provider: OrcaRouter (via custom endpoint)
Enabled Features: -

Test Steps

1. Set the custom-endpoint variables above in .env (with a real sk-orca- key).
2. Validate the provider config end-to-end:
   ctester -config /opt/pentagi/conf/orcarouter.provider.yml
3. Start a flow and confirm each agent role resolves to its configured OrcaRouter model.

Test Results

• The config mirrors the structure of the existing, validated openrouter.provider.yml
  (same agent-role keys and value schema).
• Live ctester verification requires an OrcaRouter API key and is expected to be run in a
  live environment.

Security Considerations

• Using OrcaRouter routes agent/pentest traffic through a third-party gateway (same trust model
  as the existing OpenRouter/DeepInfra/Novita configs).
• The API key is supplied via LLM_SERVER_KEY; no key material is committed.

Performance Impact

None. This is a configuration file plus documentation; no code paths change.

Documentation Updates

• README.md updates (pre-configured providers usage, .env example, LiteLLM prefix list)
• API documentation updates
• Configuration documentation updates (examples/configs/orcarouter.provider.yml)
• GraphQL schema updates
• Other:

Deployment Notes

No new first-class provider or migration. OrcaRouter is consumed via the existing custom LLM
endpoint variables: LLM_SERVER_URL, LLM_SERVER_KEY, LLM_SERVER_CONFIG_PATH, and
(optionally) LLM_SERVER_PROVIDER=orcarouter for LiteLLM model prefixing.

Checklist

Code Quality

• My code follows the project's coding standards
• I have added/updated necessary documentation
• I have added tests to cover my changes
• All new and existing tests pass
• I have run go fmt and go vet (for Go code)
• I have run pnpm run lint (for TypeScript/JavaScript code)

Security

• I have considered security implications
• Changes maintain or improve the security model
• Sensitive information has been properly handled

Compatibility

• Changes are backward compatible
• Breaking changes are clearly marked and documented
• Dependencies are properly updated

Documentation

• Documentation is clear and complete
• Comments are added for non-obvious code
• API changes are documented

Additional Notes

Disclosure: I'm an engineer on the OrcaRouter team.

Notes for reviewers:

• Follows the OpenRouter precedent (a *.provider.yml used via the custom endpoint) rather
  than adding a first-class provider.
• Prices in the config are indicative; regenerate from https://www.orcarouter.ai/api/pricing
  before relying on cost figures. OrcaRouter also returns per-request upstream cost.
• Model IDs are namespaced; orcarouter/auto is a virtual adaptive router. For tool-calling
  (agentic) use, pin explicit tool-capable models — which this config does.