Choose your AI model

Crowsnest works with no AI model at all. If you add one, it helps with two jobs: choosing which checks to run on a project, and writing up what the checks found. You can pick the provider you already pay for, or one that runs on your own machine.

How do I set it up?

1. Start the setup. From the Crowsnest folder, run:

   python -m packages.core.llm setup

2. Pick a provider from the numbered list.
3. Paste your key. It is hidden as you type. Local providers such as Ollama need none.
4. Choose a model, or press Enter to keep the suggested one. It then makes one real test call, and saves to .env only if the test worked.
5. Restart Crowsnest so it picks up the change.

Prefer to edit the file yourself? Set the usual key for your provider and nothing else:

OPENAI_API_KEY=sk-...

Crowsnest looks for these keys in this order and uses the first it finds: ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY, OPENROUTER_API_KEY, GROQ_API_KEY, MISTRAL_API_KEY, DEEPSEEK_API_KEY, TOGETHER_API_KEY, XAI_API_KEY. If you have more than one set, name the one you want:

CROWSNEST_LLM_PROVIDER=groq
CROWSNEST_LLM_MODEL=llama-3.1-8b-instant   # optional

Anyone who already had ANTHROPIC_API_KEY set sees no change.

Which providers work?

python -m packages.core.llm list prints the same list. For custom, also set CROWSNEST_LLM_BASE_URL (for example http://localhost:8080/v1) and CROWSNEST_LLM_MODEL.

How do I keep everything on my own machine?

Install Ollama, pull a model (ollama pull llama3.1), and set:

CROWSNEST_LLM_PROVIDER=ollama
CROWSNEST_LLM_MODEL=llama3.1

Nothing then leaves your computer for the model step. Smaller local models follow instructions less reliably. Crowsnest checks everything a model writes, so a poor answer is corrected or replaced by the fixed rules, but a stronger model gives better write-ups.

How do I check what is in use?

Run python -m packages.core.llm test for one real test call (it uses a few tokens of your provider's allowance). Or open http://localhost:8000/api/llm, which shows the provider and model in use and never shows a key.

What does a model never get to decide?

• Whether a package exists. Every package a model names must appear in the findings. Invented names are dropped, and if that leaves nothing, the finding is written by the fixed rules instead.
• The label on a known-bad match. A package on a known-bad list is always the most serious level.
• Anything outside the allowed values. An unknown attack type or severity is replaced by the one the check itself implies.

A model that is down, slow, out of credit or wrong never stops a scan. Crowsnest falls back to fixed rules for that step.

What this does not do

• It does not choose the cheapest model for you. The suggested models are small and fast, and any model your provider offers can be named instead.
• It does not send your source code. The model sees the project folder path, the GitHub organisation name if you set one, and the findings from the checks: package names, versions, registry details, and the paths of projects that use an affected package.
• It does not store keys safely. They sit in a plain text .env file, so keep it out of version control.

Related pages: Configuration, Troubleshooting and the Slack bot.

No model is a fine place to start.