[Enhancement]: Add aimlapi.com as a first-class LLM provider

Target Component

External Integrations (LLM/Search APIs)

Enhancement Description

Hi! I'm Hugo from aimlapi.com — an AI aggregator that gives access to 1000+ models in one API, trusted by 400k+ users.

We'd love to be available as a verified provider option inside PentAGI — so we went ahead and did all the technical work on our side.

To build our partnership, we offer a 50/50 revenue share on all traffic from this integration. (P.S.: tracking starts as soon as this release goes live, so no earnings will be lost during setup)

My contacts: [email protected] (email / Slack), Telegram: @hug0the

---

The integration is already built and tested in our fork: https://github.com/aimlapi/pentagi-aimlapi A PR-ready branch is prepared on top of current main (39 files, +1979/-14) — we can open the PR as soon as you say go.

Problem: Reaching aimlapi.com today means configuring the generic custom provider by hand — one endpoint, one key, no model catalog, no per-agent defaults, no price metadata for cost accounting, and no entry in the installer wizard or the Settings UI.

Proposed Solution: Add aimlapi as a first-class provider on the existing openaicompat base — the same shape minimax, kimi and deepseek already use, so it costs a registry entry and a config rather than a new client:

• backend/pkg/providers/aimlapi with embedded config.yml (all 13 agent roles) and models.yml (6 vendor-namespaced models with USD/1M prices)
• AIMLAPI_API_KEY / AIMLAPI_SERVER_URL / AIMLAPI_PROVIDER, goose migration for the PROVIDER_TYPE enum, GraphQL plumbing, installer wizard entry, Settings UI icon and label
• README / config.md sections and examples/tests/aimlapi-report.md from a full ctester run: 292/299 (97.66%) across all 13 roles

Expected Benefits: One key and one endpoint in front of DeepSeek, GLM, MiniMax and Kimi instead of four vendor accounts, with an offensive-security roster preselected per role and working price accounting.

Technical Details

Implementation Approach:

• Architecture Changes: none. The gateway is OpenAI-compatible, so the provider is built on the existing openaicompat base and registered in providers/registry.go exactly like minimax.
• New Components: backend/pkg/providers/aimlapi — provider spec, embedded config.yml/models.yml, an attribution RoundTripper, and unit tests.
• Dependencies: none added.

Integration Points:

• AI Agents: a default model per role for all 13 roles. The enricher stays on deepseek/deepseek-v4-flash because minimax/minimax-m3 ignores both reasoning_effort: "none" and extra_body.thinking.type: "disabled" through this gateway and returns the chain inline in content.
• Memory System: unchanged.
• Monitoring: unchanged; prices in models.yml feed the existing per-flow cost accounting.
• Database: one goose migration adds aimlapi to the PROVIDER_TYPE enum, with a Down that reverts it.

Model roster: The defaults deliberately skip the OpenAI/Anthropic/Google models the gateway also carries — their guardrails false-positive on legitimate exploit-development content. This is the same reasoning already recorded in examples/configs/openrouter.provider.yml, and the role/model mapping mirrors it. Any other catalog id can still be selected per role.

Security Considerations:

• AIMLAPI_API_KEY is added to GetSecretPatterns() and to the installer's masked/critical variable maps, so it is redacted like every other provider key.
• Requests to api.aimlapi.com carry HTTP-Referer, X-Title, X-AIMLAPI-Source and X-AIMLAPI-Partner-ID identifying PentAGI as the calling application. They are attached by a RoundTripper wrapping a copy of the shared HTTP client (the process-wide client is never mutated), scoped to aimlapi.com and re-checked per request — so pointing AIMLAPI_SERVER_URL at a LiteLLM proxy or a self-hosted gateway disables attribution rather than tagging another operator's traffic through a redirect. A header already set by the caller is never overwritten.
• The provider is inert unless AIMLAPI_API_KEY is set; no other provider's behaviour changes.

Designs and Mockups

No response

Alternative Solutions

No response

Verification

• I have checked that this enhancement hasn't been already proposed
• This enhancement aligns with PentAGI's goal of autonomous penetration testing
• I have considered the security implications of this enhancement
• I have provided clear use cases and benefits