LGTM × Anthropic
BYOK with Anthropic on LGTM: connect your console.anthropic.com key, encrypted with AES-256-GCM, decrypted only in worker memory. Use Claude Opus 4.7, Sonnet 4.6, or Haiku 4.5 per repo.
How LGTM uses your Anthropic key
Settings → AI Providers → Anthropic. Paste your key from console.anthropic.com/settings/keys. LGTM validates by sending a minimal /v1/messages request (single message, max_tokens=10) — if Anthropic returns 200 with a response, the key is accepted; otherwise the error gets surfaced verbatim ("invalid_api_key", "permission_error", "overloaded_error").
Storage: AES-256-GCM encryption, master key in Fly Secrets, encrypted blob in MongoDB alongside your user record. Identical encryption pattern as OpenAI / Gemini — provider doesn't change the storage model.
Per-review: worker decrypts the key into memory, makes the Anthropic call, drops plaintext after response. Anthropic's Messages API supports streaming; LGTM uses non-streaming for code review because the synthesizer needs the full response. The token cost goes to your Anthropic console.
Supported Claude models
LGTM's Anthropic catalog: Claude Opus 4.7 (highest quality, expensive — for security + critical-bug agents), Claude Sonnet 4.6 (balanced — general-purpose flagship choice), Claude Haiku 4.5 (cheap, fast — good for readability/docs agents). Older Claude 3.x models also work if your account has access.
Each agent in LGTM's 6-agent pipeline can be assigned a different Claude model. Default mix: Opus on Bugs + Security, Sonnet on Performance + Best-Practices, Haiku on Readability + Documentation. The mix is tunable per-repo on Pro.
Anthropic's quotas are tier-based (1, 2, 3, 4 with progressive limits). LGTM auto-detects your tier via /v1/messages response headers and adjusts concurrent agent calls accordingly. Hitting a tier limit triggers a single retry with backoff; if it fails again, that agent reports the error gracefully.
Cost — Claude vs OpenAI math
Token cost flows directly from Anthropic to your console.anthropic.com bill. LGTM markup: zero. A 300-line PR review on Claude Sonnet 4.6 costs $0.05-$0.12. On Haiku 4.5: $0.005-$0.015. On Opus 4.7: $0.15-$0.40 (use sparingly).
Comparable to OpenAI: Sonnet 4.6 ≈ gpt-5.4-mini in cost, Haiku 4.5 ≈ gpt-4.1-mini, Opus 4.7 > gpt-5.4-pro. Pick by model strength + your account preference.
Multi-provider strategy: many LGTM users keep both OpenAI and Anthropic keys configured, route different agents to different providers. E.g., Claude Opus for the Security agent (Anthropic's safety-trained models tend to flag patterns OpenAI misses), gpt-5.4 for the Bugs agent (broader corpus).
Privacy + data handling
Anthropic's API terms exclude API inputs from training by default. Inputs flowing through your BYOK key are governed by the API agreement you have with Anthropic, NOT LGTM's separate vendor contract with Anthropic (there is none).
LGTM-side persistence: same as OpenAI — diff and context bodies are NOT persisted, only the LLM-generated review output. Findings are hard-deleted on request within 24h. Logs include timing + model + token count, never content.
If you need DPA / BAA / data residency commitments, those go through your direct Anthropic account, not via LGTM. We're the orchestration layer; your Anthropic contract governs the LLM relationship.
Setup
(1) Sign in to LGTM via GitHub OAuth at app.looksgoodtomeow.in. (2) Settings → AI Providers → Anthropic. (3) Paste your key from console.anthropic.com. (4) Click Validate. (5) Pick a default model (Sonnet 4.6 if available on your tier).
Per-agent model selection: Settings → Agent Models. Bugs agent can use Claude Opus 4.7 while Readability uses Haiku 4.5 — single key, multiple models, different costs per pipeline stage.
Per-repo overrides (Pro): Repo settings → Override Models. A critical payments repo can use Opus on all agents; a marketing site can use Haiku exclusively.
Implementation examples
async function validateAnthropicKey(key: string) {
const res = await fetch('https://api.anthropic.com/v1/messages', {
method: 'POST',
headers: {
'x-api-key': key,
'anthropic-version': '2023-06-01',
'content-type': 'application/json',
},
body: JSON.stringify({
model: 'claude-haiku-4-5',
max_tokens: 10,
messages: [{ role: 'user', content: 'ping' }],
}),
});
if (res.status === 401) throw new Error('invalid_key');
if (res.status === 429) throw new Error('rate_limited');
if (!res.ok) throw new Error('provider_error');
return encryptKey(key);
}Configure Anthropic on LGTM
Opus 4.7 / Sonnet 4.6 / Haiku 4.5 · BYOK · per-repo overrides
Go to the product pageAnthropic integration FAQs
Does Anthropic train on my code via BYOK?
No. Anthropic's API terms exclude API inputs from training. Only Claude.ai consumer chats are training-eligible by default. BYOK uses the API path, so your code isn't training data.
Which Claude model is best for code review?
Claude Sonnet 4.6 is the cost/quality sweet spot for most agents. Opus 4.7 is worth it for Security and complex Bugs detection on high-stakes repos. Haiku 4.5 handles Readability + Documentation cheaply.
Can I use Anthropic + OpenAI simultaneously?
Yes. Pro plan lets you assign different agents to different providers. Common pattern: Claude Opus for Security (Anthropic's safety training catches more), gpt-5.4 for Bugs (OpenAI's broader corpus), Haiku for everything else. Single PR review uses both providers in parallel.
Anthropic vs OpenAI for which kinds of bugs?
Empirical: Claude tends to be more cautious / more false-positives on security; OpenAI tends to be more confident / occasional misses on subtle issues. Running both as a 'consensus' (a finding both flag is high-confidence) is a power pattern for high-stakes repos.
What's the tier-limit story?
Anthropic tiers (1-4) cap concurrent requests and daily spend. LGTM auto-detects tier from response headers and self-throttles to avoid 429s. If you're on Tier 1 and have a busy team, you'll hit limits — upgrade Anthropic tier (it's automatic based on spend history) or add OpenAI/Gemini as fallback.
Related across LGTM
Other integrations
OpenAI
BYOK with OpenAI on LGTM: paste your platform.openai.com key, we encrypt with AES-256-GCM, decrypt only inside worker memory at review time. Zero markup, your bill, your model choice.
Google Gemini
BYOK with Google Gemini on LGTM: paste your ai.google.dev key, AES-256-GCM at rest, decrypt only in worker memory. Use Gemini 2.5 Pro or Flash for review.
GitHub
LGTM's GitHub App: 4 permissions (contents:read, pull-requests:write, checks:write, metadata:read), webhook subscriptions on pull_request + push + installation. No access to secrets, can't push code.