Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat: add a Nebius Token Factory example provider profile

Open Beginner friendly
  • Is something wrong?
#4,856 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
rust, yaml
Domain
devtools, security

Research direction

Read the existing example profiles under providers/ and the expected-ID list in list_provider_profiles_returns_built_in_profile_categories. Add providers/nebius-token-factory.yaml in the same format, allowing the listed inference routes while excluding the management routes named in the issue. Done when the profile lints and imports, and the profile category test includes its ID.

Written by the indexing model from the issue text.

Description

state:triage-needed

User Story

I use OpenShell to run coding and research agents in sandboxes, and my models are served by Nebius Token Factory through its OpenAI-compatible API at https://api.tokenfactory.nebius.com/v1. Today I have to hand-write a provider profile for it, and the obvious copy of the openai profile with the host swapped would hand my agents a key that can also create dedicated endpoints and fine-tuning jobs on my account.

Problem Statement

providers/ has no example profile for Nebius Token Factory. Operators who use it have to write one from scratch and decide on their own which parts of the Token Factory API a sandboxed agent should reach.

Impact / Why This Matters

A Token Factory API key works on more than inference. On the same host it can list, upload, and delete files and datasets, start fine-tuning jobs and batch operations, and create, update, or delete dedicated endpoints, which are billable GPU deployments. A profile that grants the whole host, like the existing openai, nvidia, and deepinfra examples, lets a sandboxed agent use the injected key for all of that. Operators who don't read the API reference closely will not notice.

Proposed Design

Add providers/nebius-token-factory.yaml, following the format of the other example profiles:

id: nebius-token-factory
display_name: Nebius Token Factory
category: inference
inference_capable: true
credentials:
  - name: api_key
    env_vars: [NEBIUS_API_KEY]
    auth_style: bearer
    header_name: authorization
endpoints:
  - host: api.tokenfactory.nebius.com
    port: 443
    protocol: rest
    enforcement: enforce
    rules:
      - allow: { method: POST, path: "/v1/chat/completions" }
      - allow: { method: POST, path: "/v1/completions" }
      - allow: { method: POST, path: "/v1/embeddings" }
      - allow: { method: POST, path: "/v1/rerank" }
      - allow: { method: POST, path: "/v1/responses" }
      - allow: { method: GET, path: "/v1/models" }
binaries: [/usr/bin/curl, /usr/local/bin/curl]

Workflow:

openshell provider profile import -f providers/nebius-token-factory.yaml --global
openshell provider create --name nebius --type nebius-token-factory --credential NEBIUS_API_KEY
openshell sandbox create --provider nebius -- curl -sS https://api.tokenfactory.nebius.com/v1/models

NEBIUS_API_KEY matches the variable name in the Token Factory documentation.

Acceptance Criteria

  • providers/nebius-token-factory.yaml lints and imports, and has the same header block as the other examples (client binaries, reference layout, credential scope, endpoint access, smoke test).
  • A sandbox with the provider attached can call chat completions (streaming included), completions, embeddings, rerank, the Responses API, and the model list.
  • In that sandbox, requests to the files, datasets, fine-tuning, operations, and dedicated-endpoint APIs are denied by the proxy.
  • No telemetry or provider-table changes are needed, in line with #3906.

Alternatives Considered

  • Leave it to operators to copy the openai profile and change the host. That gives agents the whole Token Factory API, as described above.
  • Grant /v1/** read-write. This is simpler, but it still allows file, dataset, fine-tuning, and operation calls, and it would allow new management routes added under /v1 later.
  • An endpointless profile bound per sandbox from policy. That suits per-deployment hosts, but Token Factory has a single public host, so a fixed endpoint is simpler for operators.

Agent Investigation

  • Profiles are import-only examples under providers/. Adding one changes only the YAML and the expected-ID list in list_provider_profiles_returns_built_in_profile_categories, as in #3904.
  • I listed the routes from Token Factory's published OpenAPI spec (https://api.tokenfactory.nebius.com/openapi.json). Inference routes are the ones above. Management routes are under /v1/files, /v1/datasets, /v1/fine_tuning, /v1/operations, and /v0/dedicated_endpoints.
Dominant language
Rust
Stars
17.1k
Forks
1.8k
Avg merge
2d 8h
Merged PRs (30d)
370

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from NVIDIA/OpenShell

All issues in NVIDIA/OpenShell

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.