~/.xynthis by default. Set XYNTHIS_HOME to relocate the whole data directory with one lever; every path below resolves through it.
Directory layout
bmc/, alongside the memory store itself, the brain also keeps
identity.ed25519 (the local signing identity for witnessed memory,
mode 0600) and witness.log (the append-only Merkle log of confirmed
facts).
The brain is the only process that writes bmc/. Everything else (the CLI, the daemon, the app, MCP clients) goes through brain.sock.
config.toml
Two sections:[models] selects what runs, [providers.<name>] defines how to reach each backend. Missing files are replaced by defaults, so a brand-new machine works without any config.
[models]
[providers.<name>]
The
kind values map to how xynthis reaches the backend: openai-chat covers OpenAI, Ollama, llama.cpp, Groq, DeepSeek, Gemini, xAI, LM Studio, and anything else implementing the standard. subprocess pipes through an external CLI like claude or codex using that CLI’s own auth. codex-oauth and claude-oauth call the respective backends directly with tokens from an existing Codex or Claude Code login. xynthis-llm targets the local model server on http://127.0.0.1:8080/v1. echo is a deterministic network-free fallback.
Twenty-one providers are pre-registered on first save: echo, anthropic, openai, ollama, xynthis-llm, llamacpp, groq, deepseek, gemini, xai, claude-code, codex, codex-oauth, claude-oauth, claude-fable, codex-5-6, apfel, minicpm, llama-1b, qwen-05b, and qwen-3b. xynthis models list --all shows them.
API keys
Keys never live inconfig.toml. Lookup order per provider: the macOS Keychain (service com.xynthis.app, account <provider>-api-key; this is where the app’s Settings writes), then ~/.xynthis/auth.json (written by xynthis login and xynthis auth apply, mode 0600).