feat: add bedrock_mantle as a first-class provider with native-Anthropic and OpenAI-compatible routing

[Pratham-Mishra04]

Summary

Introduces bedrock_mantle as a first-class, standalone provider that owns the Bedrock Mantle surface (bedrock-mantle.{region}.api.aws). Previously, Mantle routing was handled as an internal routing decision inside the existing bedrock provider. The new provider gives operators a dedicated configuration surface for Claude (native Anthropic Messages API), OpenAI-compatible models (gpt-*), and Gemma models served through Mantle, without requiring a full Bedrock setup.

Changes

• Added schemas.BedrockMantle ("bedrock_mantle") as a new ModelProvider constant and registered it in StandardProviders, dynamicallyConfigurableProviders, CanProviderKeyValueBeEmpty, and isKeySkippingAllowed.
• Added BedrockMantleKeyConfig to the Key struct, carrying AWS credentials and region for SigV4 auth against the bedrock-mantle service. The existing BedrockKeyConfig is unchanged.
• Introduced the core/providers/bedrockmantle package implementing the full Provider interface. Chat, streaming chat, Responses, and streaming Responses dispatch by model family: Anthropic-family models use the native Anthropic Messages surface (/anthropic/v1/messages); all others use the OpenAI-compatible surface (/v1 or /openai/v1). All other operations return unsupported-operation errors.
• Refactored signAWSRequest in the bedrock package to accept a *BedrockKeyConfig instead of individual credential fields, eliminating the now-redundant signAWSRequestFromKey wrapper. All call sites updated accordingly.
• Exported SignMantleV4Headers (previously mantleSigV4Headers, a method on BedrockProvider) so the new bedrockmantle package can sign requests without depending on the internal Bedrock provider struct. The function now supports both BedrockKeyConfig and BedrockMantleKeyConfig by mapping the latter into a synthetic BedrockKeyConfig for signing, and correctly handles GET requests (nil body) for the list-models path.
• Extended the Anthropic chat and Responses request builders to convert native structured outputs to tool calls for BedrockMantle, matching the existing Vertex workaround.
• Added BedrockMantle to the comprehensive LLM test harness (ComprehensiveTestAccount) with key config, provider config, and a full test file covering the supported scenarios (chat, streaming, tool calls, vision, structured outputs, prompt caching, reasoning, list models) and explicitly disabling unsupported ones.
• Marked isMantleModel in bedrock/mantle.go as deprecated in favour of the new provider.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

Set AWS credentials and run the new provider test:

export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...   # optional, for temporary credentials
export AWS_REGION=us-east-1

go test ./core/providers/bedrockmantle/... -v -run TestBedrockMantle

To run the full suite (skips Bedrock Mantle automatically when credentials are absent):

go test ./...

Configure a bedrock_mantle provider by supplying a BedrockMantleKeyConfig (or a Bearer API key in Value) with the desired region. The region can also be embedded as a prefix in the model ID (e.g. us-west-2/anthropic.claude-haiku-4-5) or set at the alias level via AliasConfig.Region.

Breaking changes

• Yes
• No

The signAWSRequest signature change is internal to the bedrock package and does not affect any public API. The isMantleModel function is deprecated but not removed.

Security considerations

AWS credentials for BedrockMantleKeyConfig follow the same SecretVar resolution pattern used by BedrockKeyConfig (env-var references, never inlined literals). SigV4 signing is performed per-request on the exact body bytes that are sent, so the signature always covers what is transmitted. When a Bearer API key is present it takes precedence and no AWS credentials are required.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[Pratham-Mishra04]

• tests: add bedrock_mantle provider capabilities and Postman environment config #4739
• feat: add AWS Bedrock Mantle provider docs #4738
• feat: add bedrock_mantle provider with SigV4 key config, DB migration, and UI support #4737
• feat: add bedrock_mantle as a first-class provider with native-Anthropic and OpenAI-compatible routing #4736 👈 (View in Graphite)
• refactor: replace pre-built SigV4 body signing with lazy BodySigner closure passed through request handlers #4735
• refactor: introduce BearerAuthHeader helper and migrate OpenAI-compatible providers from schemas.Key to map[string]string auth header param #4425 : 1 other dependent PR (#4709 )
• refactor: extract HandleAnthropicChatCompletionRequest / HandleAnthropicResponsesRequest and make completeRequest a package-level func shared by Anthropic, Azure, and Bedrock providers #4394
• refactor: centralize Anthropic request building into BuildAnthropicChatRequestBody and AnthropicProviderRequestDefaultsMap #3309 : 1 other dependent PR (#4360 )
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Confidence Score: 4/5

Safe to merge for Bearer-auth users; SigV4 list-models needs the empty-Accept guard before shipping to production SigV4 users.

The new provider is well-structured and the Anthropic/OpenAI dispatch, streaming client separation, and ExtraHeaders cloning are all correct. The one concrete defect is in listModelsByKey: passing accept = "" to SignMantleV4Headers causes an empty Accept header to enter the SigV4 canonical request and be returned in the signed headers map, while the existing bedrock provider's GET signing omits Accept entirely. If fasthttp doesn't emit a zero-length Accept on the wire, the signature check fails for every SigV4 list-models call on the new provider. The fix is a one-line guard in SignMantleV4Headers. The companion inline comment also misstates that signAWSRequest defaults Accept to application/json (it only defaults Content-Type), which could mislead future maintainers.

core/providers/bedrock/mantle.go (SignMantleV4Headers Accept handling and comment) and core/providers/bedrockmantle/bedrockmantle.go (listModelsByKey accept argument).

Important Files Changed

Filename	Overview
core/providers/bedrockmantle/bedrockmantle.go	New BedrockMantleProvider implementing the full Provider interface; correctly uses mantleStreamingClient for streaming paths and mantleClient for unary paths. The listModelsByKey function signs the GET /v1/models request with accept = "", which adds an empty Accept header to the SigV4 canonical request — this can break signature verification if fasthttp omits empty-value headers on the wire.
core/providers/bedrock/mantle.go	Exports SignMantleV4Headers and adds GET support (nil body → GET method). The inline comment on the returned headers map incorrectly describes the Accept defaulting behavior, and the unconditional req.Header.Set("Accept", accept) with an empty string for GET calls introduces a silent SigV4 signing issue.
core/providers/bedrock/bedrock.go	Refactors signAWSRequest to accept *BedrockKeyConfig instead of individual fields and removes the signAWSRequestFromKey wrapper. All call sites updated correctly; nil config falls back to the ambient credential chain as before.
core/providers/anthropic/types.go	Adds schemas.BedrockMantle to ProviderFeatures with correct feature flags: Nova-specific tools (WebSearchNova, CodeExecNova) intentionally disabled, matching the native-Anthropic surface vs. the Bedrock Converse surface.
core/providers/anthropic/requestbuilder.go	Adds schemas.BedrockMantle to AnthropicProviderRequestDefaultsMap with RemapToolVersions: true, giving BedrockMantle its own feature surface independent of Bedrock's Converse path.
core/providers/anthropic/chat.go	Extends the structured-output → tool conversion to cover BedrockMantle alongside Vertex; correct and symmetric with the same change in responses.go.
core/providers/bedrockmantle/utils.go	Region resolution and Anthropic header utilities. addAnthropicHeaders correctly clones the shared ExtraHeaders map before mutating it, preventing cross-request header leakage.
core/schemas/account.go	Adds BedrockMantleKeyConfig struct and BedrockMantleKeyConfig field to Key. The new struct mirrors BedrockKeyConfig without the inference-profile ARN and batch S3 fields that don't apply to the Mantle surface.
core/schemas/bifrost.go	Adds BedrockMantle ModelProvider = "bedrock_mantle" constant and registers it in StandardProviders.
core/utils.go	Registers BedrockMantle in dynamicallyConfigurableProviders, CanProviderKeyValueBeEmpty, and isKeySkippingAllowed, and adds a validateKey case that safely initializes an empty BedrockMantleKeyConfig for IRSA/ambient credential scenarios.
core/internal/llmtests/account.go	Adds BedrockMantle to the comprehensive test harness with key config, provider config, and scenario matrix. UseForBatchAPI: true is set so unsupported-operation stubs are reachable by the harness batch checks.
core/providers/bedrockmantle/bedrockmantle_test.go	Test file correctly gates on AWS credentials and covers chat, streaming, tool calls, vision, structured outputs, prompt caching, reasoning, and list-models; explicitly disables unsupported operations.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Request: BedrockMantle provider] --> B{IsAnthropicModelFamily?}
    B -- Yes --> C[mantleAnthropicURL\n/anthropic/v1/messages]
    B -- No --> D[mantleOpenAIURL\n/v1 or /openai/v1]

    C --> E{Streaming?}
    D --> F{Streaming?}

    E -- Yes --> G[HandleAnthropicChatCompletionStreaming\nmantleStreamingClient]
    E -- No --> H[HandleAnthropicChatCompletionRequest\nmantleClient]

    F -- Yes --> I[HandleOpenAIChatCompletionStreaming\nmantleStreamingClient]
    F -- No --> J[HandleOpenAIChatCompletionRequest\nmantleClient]

    G & H & I & J --> K{key.Value empty?}
    K -- No --> L[Bearer: Authorization header]
    K -- Yes --> M[SigV4: SignMantleV4Headers\nBedrockMantleKeyConfig → synthetic BedrockKeyConfig]

    M --> N[signAWSRequest\nbedrock-mantle service]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Request: BedrockMantle provider] --> B{IsAnthropicModelFamily?}
    B -- Yes --> C[mantleAnthropicURL\n/anthropic/v1/messages]
    B -- No --> D[mantleOpenAIURL\n/v1 or /openai/v1]

    C --> E{Streaming?}
    D --> F{Streaming?}

    E -- Yes --> G[HandleAnthropicChatCompletionStreaming\nmantleStreamingClient]
    E -- No --> H[HandleAnthropicChatCompletionRequest\nmantleClient]

    F -- Yes --> I[HandleOpenAIChatCompletionStreaming\nmantleStreamingClient]
    F -- No --> J[HandleOpenAIChatCompletionRequest\nmantleClient]

    G & H & I & J --> K{key.Value empty?}
    K -- No --> L[Bearer: Authorization header]
    K -- Yes --> M[SigV4: SignMantleV4Headers\nBedrockMantleKeyConfig → synthetic BedrockKeyConfig]

    M --> N[signAWSRequest\nbedrock-mantle service]

Loading

_{Reviews (8): Last reviewed commit: "feat: adds bedrock-mantle provider" | Re-trigger Greptile}

[coderabbitai]

Warning

Review limit reached

@Pratham-Mishra04, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 11 minutes and 46 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ef028c7-8d94-4ef1-aab4-6605d344d7bc

📥 Commits

Reviewing files that changed from the base of the PR and between 6b56b4d and 8a86083.

📒 Files selected for processing (14)

• core/bifrost.go
• core/internal/llmtests/account.go
• core/providers/anthropic/chat.go
• core/providers/anthropic/requestbuilder.go
• core/providers/anthropic/responses.go
• core/providers/anthropic/types.go
• core/providers/bedrock/bedrock.go
• core/providers/bedrock/mantle.go
• core/providers/bedrockmantle/bedrockmantle.go
• core/providers/bedrockmantle/bedrockmantle_test.go
• core/providers/bedrockmantle/utils.go
• core/schemas/account.go
• core/schemas/bifrost.go
• core/utils.go

📝 Walkthrough

Walkthrough

Adds a bedrock_mantle provider, wires it into provider selection and test configuration, updates Anthropic and Bedrock request handling for Mantle-compatible signing and structured outputs, and adds provider tests.

Changes

Bedrock Mantle provider support

Layer / File(s)	Summary
Provider contract and validation core/schemas/bifrost.go, core/schemas/account.go, core/utils.go	Adds the bedrock_mantle provider constant, BedrockMantleKeyConfig, and key validation/credential handling for the new provider.
Provider registration and test wiring core/bifrost.go, core/internal/llmtests/account.go	Registers BedrockMantleProvider in the main factory and adds it to the test harness provider, key, and config switches.
Anthropic request compatibility core/providers/anthropic/requestbuilder.go, core/providers/anthropic/types.go, core/providers/anthropic/chat.go, core/providers/anthropic/responses.go	Adds Bedrock Mantle defaults and feature flags, and expands structured-output-to-tool handling to include Mantle.
Bedrock signing refactor core/providers/bedrock/bedrock.go	Moves AWS request signing onto signAWSRequest(*BedrockKeyConfig, region, service) and updates Bedrock runtime, listing, S3, and batch call sites.
Mantle header signer core/providers/bedrock/mantle.go	Adds SignMantleV4Headers and rewires Mantle chat and responses requests to use it for JSON and streaming variants.
Bedrock Mantle setup and listing core/providers/bedrockmantle/utils.go, core/providers/bedrockmantle/bedrockmantle.go	Adds region parsing/resolution helpers, provider construction, URL builders, and /v1/models listing.
Bedrock Mantle request routing core/providers/bedrockmantle/bedrockmantle.go	Routes chat and responses requests between native Anthropic and OpenAI-compatible endpoints, and marks the remaining surface unsupported.
Bedrock Mantle tests core/providers/bedrockmantle/bedrockmantle_test.go	Runs the comprehensive AWS-gated harness with supported Mantle scenarios enabled and unsupported ones disabled.

Estimated review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

Possibly related PRs

• maximhq/bifrost#218: Shares the provider key/value handling paths updated here for Bedrock Mantle.
• maximhq/bifrost#3309: Touches the same Anthropic request-defaults plumbing updated here for schemas.BedrockMantle.
• maximhq/bifrost#4677: Also modifies Bedrock Mantle listing and signing-related paths in core/providers/bedrock/bedrock.go.

Suggested reviewers

• akshaydeo
• danpiths
• roroghost17

Poem

A bunny hopped through code at dawn,
and bedrock_mantle softly yawned.
With signed-up sparks and headers bright,
it twitched through chat by day and night.
🐇✨ Hop, hop — the Mantle sings!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the new first-class bedrock_mantle provider and its routing behavior.
Description check	✅ Passed	The description covers the required template sections and includes summary, changes, testing, security, and checklist details.
Docstring Coverage	✅ Passed	Docstring coverage is 93.33% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-26-feat_adds_bedrock-mantle_provider

---

_{Comment @coderabbitai help to get the list of available commands.}

[akshaydeo]

Merge activity

• Jun 27, 3:42 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 27, 3:43 PM UTC: Graphite couldn't merge this pull request because a downstack PR refactor: extract HandleAnthropicChatCompletionRequest / HandleAnthropicResponsesRequest and make completeRequest a package-level func shared by Anthropic, Azure, and Bedrock providers #4394 failed to merge.
• Jun 27, 4:50 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 27, 4:57 PM UTC: Graphite rebased this pull request as part of a merge.
• Jun 27, 4:58 PM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.