Shakespeare — provider lockdown (BYOK)

Shakespeare is strictly forbidden from using any provider owned by Meta, OpenAI, or xAI. Its bring-your-own-key picker could be pointed at OpenAI or xAI — so Shakespeare is allowed in the catalog only under this binding recipe, which locks the picker to permitted providers and machine-verifies that the excluded ones are unreachable. This is enforcement of the exclusion, not an exemption from it.

Canonical source

Shakespeare lives on GitLab, not GitHub: gitlab.com/soapbox-pub/shakespeare, AGPL-3.0, default branch main. Pinned for this recipe at commit a824677f (12 Jun 2026).

Configure (≈2 minutes)

1. Open Shakespeare at shakespeare.diy.

2. Go to Settings → AI Provider.

3. Choose a permitted provider — one of: Anthropic, DeepSeek, Kimi (Moonshot), OpenRouter, OpenCode Zen, PayPerQ, or local Ollama.

4. Paste your own API key for that provider (BYOK). It’s stored locally in your browser’s IndexedDB — it is not sent to Shakespeare’s servers.

5. Do not select OpenAI or xAI.

Verify (≈5 minutes)

The configuration is only trustworthy if you confirm it. Watch the network while you use the app:

# In the browser devtools Network tab, or via a proxy/inspector,
# exercise Shakespeare for ~5 minutes and confirm NO requests to:
#   api.openai.com
#   api.x.ai

If you picked Anthropic, you should see traffic to api.anthropic.com and nothing to any excluded host. If you picked local Ollama, you should see traffic only to localhost.

A lockdown, not a loophole

This recipe does not make Shakespeare a “trusted” tool, and it grants no permission to touch excluded providers. It is the opposite: a binding constraint that forbids them. The recipe contract requires that every excluded LLM provider appears in must_not_be_one_of and that the verification steps block their endpoints — so a recipe that quietly failed to forbid OpenAI is rejected by CI.

Applying the same pattern elsewhere

Any agent harness you use to build with this catalog — Goose, Claude Code, Aider — should follow the same BYOK discipline: pick a permitted provider, supply your own key, and verify the network. See the quickstart.