# How SecureDesign Establishes and Manages Connections with Local AI Models (LM Studio and Ollama)

> Learn how SecureDesign connects to local AI models like LM Studio and Ollama using VS Code's secret storage and a standardized interface for seamless integration.

- Repository: [Harold Martin/secure-design](https://github.com/hbmartin/secure-design)
- Tags: 
- Published: 2026-03-03

---

**SecureDesign treats LM Studio and Ollama as provider implementations of the abstract `AIProvider` interface, storing their configuration in VS Code's secret storage via `SecureStorageService`, and instantiating them through the `getSdkLanguageModel` function which returns a standardized `LanguageModelV2` object for streaming text.**

The SecureDesign VS Code extension enables developers to interact with locally-hosted AI models through a unified provider architecture. By abstracting LM Studio and Ollama behind a common interface defined in [`src/providers/types.ts`](https://github.com/hbmartin/secure-design/blob/main/src/providers/types.ts), the extension seamlessly integrates local inference engines into its agentic workflow without requiring API-key credentials.

## The Provider Abstraction Layer

In [`src/providers/types.ts`](https://github.com/hbmartin/secure-design/blob/main/src/providers/types.ts), SecureDesign defines an abstract `AIProvider` class that standardizes how all model providers interact with the extension. For local providers, the `hasCredentials` method (lines 70-76) returns `true` unconditionally, eliminating the need for API keys while maintaining interface consistency. This abstraction allows the `CustomAgentService` to treat local and remote providers identically when orchestrating chat requests.

### Credential Handling for Local Models

Unlike cloud providers that require authentication tokens, LM Studio and Ollama connections rely solely on base URL configuration. The `AIProvider.hasCredentials` implementation signals that these providers are always "authenticated" by virtue of running locally, bypassing the secret key validation required for services like OpenAI or Anthropic.

## Secure Configuration Storage

When users add a local provider through the **"+ Add Model Provider"** UI, SecureDesign persists settings using the `SecureStorageService` class defined in [`src/services/secureStorageService.ts`](https://github.com/hbmartin/secure-design/blob/main/src/services/secureStorageService.ts). This wrapper encrypts and stores the provider's base URL and optional API key within VS Code's built-in secret storage, ensuring sensitive connection details never reside in plaintext configuration files.

### Storage Implementation Details

The `SecureStorageService` implements a `StorageAdapter` interface with `set` and `get` methods that serialize configuration objects as JSON strings. For Ollama, the storage key `"ollama"` maps to a record containing `baseUrl` and optionally `apiKey`, while LM Studio uses the key `"lmstudio"` with similar structure.

```typescript
// src/services/secureStorageService.ts
export class SecureStorageService implements StorageAdapter {
  constructor(private readonly secrets: vscode.SecretStorage) {}

  async set(key: string, value: Record<string, string>) {
    await this.secrets.store(key, JSON.stringify(value));
  }

  async get(key: string) {
    const raw = await this.secrets.get(key);
    return raw ? JSON.parse(raw) : undefined;
  }
}

```

## Model Instantiation and Streaming

During active chat sessions, `CustomAgentService.query` (in [`src/services/customAgentService.ts`](https://github.com/hbmartin/secure-design/blob/main/src/services/customAgentService.ts)) instantiates the actual model object by invoking `getSdkLanguageModel(this.storage)` from the **ai-sdk-react-model-picker** library. This function retrieves the encrypted configuration from `SecureStorageService`, dynamically loads the appropriate provider plugin—either `ollama-ai-provider-v2` for Ollama or the LM Studio provider—and returns a `LanguageModelV2` instance compatible with the Vercel AI SDK.

### The Streaming Pipeline

Once instantiated, the local model connects through a unified streaming interface. The extension calls `streamText` with the `LanguageModelV2` object, enabling real-time token generation from localhost endpoints exactly as it would for remote APIs.

```typescript
// src/services/customAgentService.ts
import { getSdkLanguageModel } from 'ai-sdk-react-model-picker';

const model: LanguageModelV2 = await getSdkLanguageModel(this.storage);

const result = streamText({
  model,
  system: this.getSystemPrompt(),
  messages: conversationHistory,
  tools, // File/write/edit tools enabled if supported
  abortSignal: abortController.signal,
});

```

## Required Configuration Parameters

SecureDesign requires specific environment variables to establish localhost connections, configured through the provider addition UI and stored securely.

- **LM Studio**: Requires `LMSTUDIO_BASE_URL` (default: `http://localhost:1234/v1`)
- **Ollama**: Requires `OLLAMA_BASE_URL` (default: `http://localhost:11434/api`), with optional `OLLAMA_API_KEY` for authenticated local instances

## Tool Calling Integration

When a local model advertises `supportsToolCalling` through its provider metadata, `CustomAgentService` automatically enables the extension's full tool-calling workflow. This capability allows locally-hosted models to execute file operations, code edits, and other agentic actions using the same `tools` parameter passed to `streamText`, regardless of whether the inference runs locally or in the cloud.

## Summary

- SecureDesign unifies local and remote AI providers behind the abstract `AIProvider` interface defined in [`src/providers/types.ts`](https://github.com/hbmartin/secure-design/blob/main/src/providers/types.ts).
- Local model configurations persist in VS Code's encrypted secret storage via `SecureStorageService`, eliminating plaintext credential exposure.
- The `getSdkLanguageModel` function from the ai-sdk-react-model-picker library handles dynamic provider plugin loading for both LM Studio and Ollama.
- Connection parameters require only base URL configuration (defaulting to standard localhost ports), with optional API keys for authenticated local setups.
- Local models integrate fully with SecureDesign's tool-calling capabilities when they expose `supportsToolCalling` metadata.

## Frequently Asked Questions

### Does SecureDesign require API keys for LM Studio or Ollama?

No. According to the source code in [`src/providers/types.ts`](https://github.com/hbmartin/secure-design/blob/main/src/providers/types.ts), the `hasCredentials` method returns `true` for all local providers, eliminating API key requirements. However, Ollama supports optional authentication via `OLLAMA_API_KEY` if your local instance requires it.

### How does SecureDesign store connection details for local models?

The extension uses `SecureStorageService` (implemented in [`src/services/secureStorageService.ts`](https://github.com/hbmartin/secure-design/blob/main/src/services/secureStorageService.ts)) to encrypt and store base URLs and optional keys within VS Code's native secret storage, ensuring connection details remain secure and separate from workspace settings.

### Can local models use the same tools as cloud providers in SecureDesign?

Yes. When a local model advertises `supportsToolCalling`, the `CustomAgentService` passes the same tools array to `streamText` regardless of provider type, enabling file operations and code editing through LM Studio or Ollama endpoints.

### What library handles the actual connection to Ollama and LM Studio?

SecureDesign leverages the **ai-sdk-react-model-picker** library's `getSdkLanguageModel` function, which dynamically loads provider-specific plugins like `ollama-ai-provider-v2` (listed in [`package.json`](https://github.com/hbmartin/secure-design/blob/main/package.json)) to establish the connection and return a standardized `LanguageModelV2` object.