Qwen Code CLI with Verdictan

Add your Verdictan gateway as a model provider in Qwen Code, and the model requests it makes while it works on your code go through your policies. You can also add the Verdictan MCP server so that Qwen Code can search your request history. Set up the model first and check it, then add MCP if you want it.

Before you start

• A gateway on http://127.0.0.1:41002 with at least one provider target. See Gateway Setup for IDEs.
• A client API token. See API Tokens for IDEs.
• One model ID from the gateway's authenticated GET /v1/models response.
• Qwen Code installed, with the qwen command on your path.
• For MCP only: a published gateway hostname. MCP is not served on 127.0.0.1:41002.

Configure Qwen Code

1. Export the token in the terminal where you run Qwen Code:

   export VERDICTAN_CLIENT_TOKEN="<client-api-token>"

   You can put it in ~/.qwen/.env instead. Qwen Code loads only the first .env file it finds: .qwen/.env or .env in the current folder or a parent folder, then ~/.qwen/.env. A variable that is already set in the shell wins.

2. Add a provider entry to ~/.qwen/settings.json, and keep your other settings:

   ~/.qwen/settings.json

   {
     "modelProviders": {
       "openai": [
         {
           "id": "your-model-id",
           "name": "Verdictan",
           "baseUrl": "http://127.0.0.1:41002/v1",
           "envKey": "VERDICTAN_CLIENT_TOKEN",
           "wireApi": "chat-completions"
         }
       ]
     },
     "security": { "auth": { "selectedType": "openai" } },
     "model": { "name": "your-model-id" }
   }

3. Replace both your-model-id values with an id from GET /v1/models. model.name must match the id of the entry.

4. Run qwen from that terminal.

envKey names the variable that holds the token. The file never contains the token itself. Qwen Code's env setting can hold a key too, but it stores the key in plain text, so don't use it for the client token.

wireApi can also be responses; the gateway serves both /v1/chat/completions and /v1/responses. Policy controls run on both. See Runtime Request Families. For the other fields, see Qwen Code authentication.

Add the Verdictan MCP server (optional)

1. Add a verdictan entry under mcpServers in ~/.qwen/settings.json:

   ~/.qwen/settings.json

   {
     "mcpServers": {
       "verdictan": {
         "httpUrl": "https://<published-hostname>/mcp",
         "headers": {
           "Authorization": "Bearer $VERDICTAN_CLIENT_TOKEN"
         }
       }
     }
   }

2. Restart Qwen Code, then run /mcp and check that verdictan lists tools such as history_search.

Qwen Code replaces $VERDICTAN_CLIENT_TOKEN with the variable's value when it loads the settings, so the file holds only the variable name. Remote MCP servers get five seconds for discovery by default. If the relay is slow, raise discoveryTimeoutMs on the entry. See Qwen Code MCP.

MCP adds tools only. It does not route model requests; the provider entry does that.

Verify

1. Check the token and the model list:

   curl -fsS \
     -H "Authorization: Bearer $VERDICTAN_CLIENT_TOKEN" \
     http://127.0.0.1:41002/v1/models

2. In Qwen Code, send a small prompt before any code task, and check that the reply shows:

   Reply with Hello. Do not read or change files or run commands.

3. In a second shell, read the recent events:

   verdictan events tail --since 10m --json

4. Check that the newest event has a timestamp from the moment you sent the prompt. Qwen Code can send more than one model request for a prompt, so expect one event or more. Event delivery can take a few seconds, so run the command again if the event is not there yet.

5. If you added MCP, ask Qwen Code to use history_search for the last ten minutes without changing anything. An empty result without an error means the tool ran.

An event proves that a model request went through the gateway. A working MCP tool proves MCP access only.

Model-traffic boundary

Only models from the Verdictan provider entry use the gateway. If you pick another model with /model or qwen --model, its requests go to that model's provider. Run /model to see the active model.

Some Qwen Code features can use a different model from the main one: fastModel, advisorModel, visionModel, and compactionModel. Leave them empty to use the main model, or set them to a model from a Verdictan provider entry. If one names a model from another provider, that work goes to that provider and not through Verdictan.

The gateway governs model requests. Qwen Code runs file edits and shell commands on your machine, and its tools.approvalMode setting decides which ones need your approval.

Troubleshooting

Symptom	Cause	Fix
Connection refused	The gateway is not running on port 41002	Start it, and check /healthz with curl.
401 with missing_api_key	VERDICTAN_CLIENT_TOKEN is not set for Qwen Code, or the value is not a vdt_ token	Start qwen from a shell that exports it, or check ~/.qwen/.env. Don't use the gateway runtime token.
401 with invalid_api_token or tokens.expired	The token is revoked or expired	Check the token on the Console API Tokens page.
422 with no_matching_provider	The entry's id does not match anything the gateway serves	Use an id from GET /v1/models, in both id and model.name.
A reply but no event	The active model is not the Verdictan entry	Run /model and pick the Verdictan entry. Then see IDE Integration Troubleshooting.
The verdictan MCP server shows as disconnected	The URL is not a published hostname, the token is not set, or discovery timed out	Use https://<published-hostname>/mcp, check the variable, and raise discoveryTimeoutMs. A local listener answers 404 with mcp_publication_required.
Streamed text arrives late	An output policy needs the whole response before it sends any text	Expected for those policies. See Streaming SSE.

Next steps

• Configure Policies for IDE Traffic: controls for the prompts Qwen Code sends.
• Monitor IDE AI Usage: Qwen Code traffic in events, History, and Usage.
• Gateway MCP Surface: every tool and resource on the MCP endpoint.