feat(cli): pull latest LLM models dynamically in the crew wizard

[joaomdmoura]

What & why

The JSON-crew creation wizard (crewai create) hardcodes a short model list per provider. Vendors ship new models every few weeks, so that list goes stale fast. This adds a resolver that prefers live model data and keeps the hardcoded list only as a verified fallback.

How it works — three tiers

model_catalog.get_provider_models(provider, fallback):

1. Vendor API — when the provider's key is already in the environment, query the vendor's own /v1/models endpoint (openai, anthropic, gemini, groq, cerebras, ollama). This is the only source that reliably reflects the latest models, with real release dates / display names.
2. Curated hardcoded fallback — hand-verified list, used when no key is available.
3. LiteLLM feed — the model_prices_and_context_window.json the CLI already caches, used only for providers with no curated list. The feed lags real releases (it can miss a vendor's newest models entirely), so it must never preempt the curated fallback.

Results are ranked by date/version parsed from the model id, labels are humanized (curated labels win), results cache for 6h, network calls use a short timeout, and any failure degrades silently to the next tier.

Wired into create_json_crew._select_model() only (the arrow-key picker). The non-interactive --provider default path stays on the deterministic hardcoded list.

Curated fallback refresh

Refreshed each provider's fallback against the vendor's official model docs:

• Anthropic — Fable 5, Opus 4.8, Sonnet 5, Opus 4.7, Haiku 4.5, Sonnet 4.6 (bare aliases, no date suffixes)
• OpenAI — GPT-5.5, GPT-5.5 Pro, GPT-5.4, GPT-5.4 Mini, GPT-5.2, GPT-4.1
• Gemini — 3.5 Flash, 3.1 Pro (preview), 3 Flash (preview), 2.5 Pro/Flash/Flash-Lite
• Groq — Llama 4 Maverick/Scout, GPT-OSS 120B, Qwen3 32B, Kimi K2, Llama 3.3 70B

Tests

tests/test_model_catalog.py — 17 tests: vendor ranking + label precedence, chat-model filtering, version/date parsing, caching, full-failure fallback, and the tier order (curated fallback beats the lagging feed; feed only fills uncurated providers). ruff + mypy clean.

Note

The LiteLLM feed is not a reliable "latest models" source — it lags, sometimes behind a hand-maintained list. Reliable freshness comes from the vendor API (needs a key), and the curated fallback has to be kept current. A follow-up build-time refresh script (regenerating the fallback from vendor APIs in CI) would remove the need to hand-edit model IDs — happy to add it if wanted.

🤖 Generated with Claude Code

---

Note

Low Risk
Changes are confined to CLI scaffolding and optional outbound HTTP during wizard model selection; no runtime crew execution or auth paths are modified.

Overview
Adds model_catalog.get_provider_models so the JSON crew wizard’s interactive model picker can show up-to-date LLMs instead of only a frozen hardcoded list.

Resolution order: vendor /models APIs when the matching env API key is set (OpenAI, Anthropic, Gemini, Groq, Cerebras, Ollama); otherwise the refreshed curated _PROVIDER_MODELS list; LiteLLM’s cached feed only for providers with no curated fallback (e.g. Bedrock). Results are ranked newest-first, capped at 8, cached under ~/.crewai, and failures degrade without blocking the wizard.

Wizard wiring: _select_model() calls the resolver; --provider / _default_model_for_provider still use the static curated default only.

Curated lists for OpenAI, Anthropic, Gemini, Groq, and Ollama are updated to current model IDs. tests/test_model_catalog.py covers vendors, LiteLLM, caching, and tier precedence.

^{Reviewed by Cursor Bugbot for commit a275e6a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Adds dynamic provider model discovery for crew creation, wires it into the wizard, and updates one vulnerability scan ignore entry.

Changes

Model catalog and wizard integration

Layer / File(s)	Summary
Public API and orchestration lib/cli/src/crewai_cli/model_catalog.py	Defines get_provider_models(provider_key, fallback) and MAX_MODELS, with cache lookup, vendor-first resolution, LiteLLM fallback gating, and final catalog selection.
Vendor fetchers lib/cli/src/crewai_cli/model_catalog.py	Adds provider-specific fetchers for OpenAI-compatible, Anthropic, Gemini, and Ollama model lists, with best-effort failure handling.
LiteLLM, ranking, and labeling lib/cli/src/crewai_cli/model_catalog.py	Loads and filters the LiteLLM feed, ranks and dedupes model entries, applies label overrides, and generates human-readable labels and version keys.
HTTP and cache utilities lib/cli/src/crewai_cli/model_catalog.py	Adds HTTP JSON fetching, ISO parsing, cache path handling, TTL checks, safe cache reads, and best-effort cache writes.
Wizard integration and curated fallback data lib/cli/src/crewai_cli/create_json_crew.py	Imports get_provider_models, updates the offline _PROVIDER_MODELS fallback list, and switches model selection to use the dynamic catalog.
Model catalog tests lib/cli/tests/test_model_catalog.py	Adds tests for helper utilities, provider selection, LiteLLM filtering, fallback precedence, caching, negative caching, and Ollama cache scoping.

Vulnerability scan workflow

Layer / File(s)	Summary
Workflow ignore list and comments .github/workflows/vulnerability-scan.yml	Updates the pip-audit ignore list and the associated CVE comments in the vulnerability scan workflow.

Suggested reviewers: vinibrsl

Sequence Diagram(s)

sequenceDiagram
  participant Wizard as create_json_crew
  participant Catalog as get_provider_models
  participant Cache as Catalog cache
  participant Vendor as Vendor fetchers
  participant LiteLLM as LiteLLM feed

  Wizard->>Catalog: get_provider_models(provider_key, fallback)
  Catalog->>Cache: read cached catalog
  alt cache miss or stale
    Catalog->>Vendor: fetch provider models
    Vendor-->>Catalog: vendor models or none
    alt no vendor models and fallback is empty
      Catalog->>LiteLLM: load chat models
      LiteLLM-->>Catalog: candidate models
    end
    Catalog->>Cache: write resolved catalog
  end
  Catalog-->>Wizard: model_id/label pairs

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: dynamically loading LLM models in the crew wizard.
Description check	✅ Passed	The description accurately explains the dynamic model catalog, fallback tiers, and test updates.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch joaomdmoura/pull-model-list

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/cli/src/crewai_cli/model_catalog.py`:
- Around line 197-230: The Gemini model fetcher currently only reads the first
page from models.list, so it can miss models because the API is paginated and
not ordered newest-first. Update _fetch_gemini in model_catalog.py to loop
through all pages using nextPageToken (passing it back as pageToken on
subsequent _http_get_json calls), accumulate entries from each page, and stop
only when no nextPageToken remains.
- Around line 128-134: The fallback lookup in get_provider_models can crash when
a LiteLLM model entry has a null litellm_provider, because the code lowercases a
value that may not be a string. Update the LiteLLM parsing path in _from_litellm
to guard litellm_provider before calling strip/lower, treating missing or null
values as absent and skipping those entries so the existing fallback behavior in
get_provider_models still works.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5bed391e-f9cf-4cc3-848a-7f02e81992c1

📥 Commits

Reviewing files that changed from the base of the PR and between 2b90117 and 009fdc5.

📒 Files selected for processing (3)

• lib/cli/src/crewai_cli/create_json_crew.py
• lib/cli/src/crewai_cli/model_catalog.py
• lib/cli/tests/test_model_catalog.py

[joaomdmoura]

Review round addressed

All bot review findings (Cursor Bugbot, CodeQL, CodeRabbit) are fixed — commits 71fe556b5 and 92ca2df0c, each replied to inline:

Finding	Fix
Ollama cache ignored the base URL	Cache now keyed by ollama@<base>
Failed fetch retried on every call	Negatively-cache the fallback for a short 5-min TTL
Corrupt cache JSON could crash	Guard against a non-dict cache root
Two empty except blocks (CodeQL)	contextlib.suppress(OSError) + explanatory comments
Null litellm_provider could crash _from_litellm	Coerce before string ops
_fetch_gemini read only the first page	Paginate via nextPageToken (bounded)

Test count is now 22 (a regression test per finding); ruff + mypy clean.

pip-audit check

pip-audit is red but it's pre-existing on main (flags nltk==3.9.4 / PYSEC-2026-597) and unrelated to this PR — this change adds no dependencies. Best handled in a separate dependency-bump PR.

[joaomdmoura]

pip-audit fixed

The failing pip-audit was flagging nltk 3.9.4 / PYSEC-2026-597 (CVE-2026-12243) — a path traversal via percent-encoded ..%2f in nltk.data.load()/find(). Per OSV it affects all nltk versions ≤ 3.9.4 with no patched release, so a version bump can't resolve it — the same situation as the already-ignored sibling PYSEC-2026-97.

nltk is a transitive dependency (unstructured[local-inference, all-docs] in crewai-tools) used for text tokenization; we never pass untrusted resource URLs/paths to nltk.data, so the traversal isn't reachable. Added it to the curated --ignore-vuln list in .github/workflows/vulnerability-scan.yml with a justification, matching the existing convention (commit 7eab09362).

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 065a5a4. Configure here.}

[joaomdmoura]

Correction: pip-audit is intentionally left failing — do not merge yet

Earlier in this PR I added nltk / PYSEC-2026-597 (CVE-2026-12243) to the pip-audit --ignore-vuln list to get the check green. That was wrong — suppressing an unpatched security advisory defeats the purpose of the scan. Reverted in a275e6aae.

pip-audit will stay red until this is genuinely resolved. Per OSV the NLTK path traversal affects all versions ≤ 3.9.4 with no patched release yet, and nltk is a transitive dep via unstructured[local-inference, all-docs] (crewai-tools).

This PR should not be merged until the vulnerability is resolved — i.e. NLTK ships a fixed release we can bump to (or the vulnerable transitive dependency is otherwise removed/replaced). Holding the PR open on that.

Note: the failing pip-audit here is a repo-wide, pre-existing condition (it also fails on main) rather than anything introduced by this PR's code.