agent-opfor/.env.example at master · KeyValueSoftwareSystems/agent-opfor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
# Opfor — environment variables
# Copy this file to .env and fill in the keys you need.
# You only need one LLM provider key to run Opfor.
# .env is gitignored — never commit your real keys.

# ── LLM providers — the attacker LLM for `opfor run` ─────────────────────────
# Any one of these is enough. NOTE: `opfor hunt` does not use these — its agents
# run on Claude only. See "Autonomous hunt" below.

# Groq (fast, free tier available — good default for getting started)
# GROQ_API_KEY=

# OpenAI
# OPENAI_API_KEY=

# Anthropic
# ANTHROPIC_API_KEY=

# Google Gemini
# GOOGLE_GENERATIVE_AI_API_KEY=

# ── OpenAI-compatible endpoints (provider: "openai-compatible") ───────────────
# LiteLLM, OpenRouter, Azure, Ollama, etc. Set the base URL in your opfor config;
# put the API key here if the endpoint requires one.
# OPFOR_API_KEY=

# ── Autonomous hunt (`opfor hunt`) — the attacker agents ─────────────────────
# The commander/operator/scout agents run on the Claude Agent SDK, so they are
# Claude-only regardless of which provider key you set above. Your TARGET can
# still be any model or agent.
#
# Credentials are resolved in this order — the first match wins:
#
#   1. ANTHROPIC_API_KEY                      pay-per-token API key
#   2. ANTHROPIC_BASE_URL + ANTHROPIC_AUTH_TOKEN   gateway (LiteLLM, proxy, …)
#   3. CLAUDE_CODE_OAUTH_TOKEN                from `claude setup-token`
#   4. ~/.claude/.credentials.json            from `claude login` (Pro/Max)
#
# ANTHROPIC_API_KEY=

# Gateway / self-hosted proxy — SET BOTH OR NEITHER.
# ANTHROPIC_AUTH_TOKEN on its own is ignored (it is indistinguishable from a token
# inherited from a parent Claude Code session), and the run silently falls through
# to option 3 or 4 — e.g. billing your personal subscription instead of the gateway.
# ANTHROPIC_BASE_URL=https://your-gateway.example.com
# ANTHROPIC_AUTH_TOKEN=

# Subscription token, if you are not using an API key or gateway.
# CLAUDE_CODE_OAUTH_TOKEN=

# Optional — pin the `haiku` / `sonnet` / `opus` aliases to specific snapshots.
# Applies to --model / --operator-model / --scout-model and the --ui model pickers.
# ANTHROPIC_DEFAULT_HAIKU_MODEL=
# ANTHROPIC_DEFAULT_SONNET_MODEL=
# ANTHROPIC_DEFAULT_OPUS_MODEL=

# ── Target authentication (the system under test) ────────────────────────────
# Separate from everything above — this is the credential Opfor sends TO your
# target, not one it uses itself. Reference the variable NAME via
# `opfor hunt --target-key-env`, `apiKeyEnv` in a config, or the --ui setup form.
# TARGET_API_KEY=

# ── Telemetry enrichment (optional) ──────────────────────────────────────────

# Langfuse — pulls production traces to ground attack prompts
# LANGFUSE_PUBLIC_KEY=
# LANGFUSE_SECRET_KEY=
# LANGFUSE_BASE_URL=https://cloud.langfuse.com

# Netra
# NETRA_API_KEY=

# ── MCP server authentication (optional) ─────────────────────────────────────
# If your MCP server requires a bearer token, set it here and reference the
# variable name in your opfor config under mcp.server.headers:
#   "headers": { "Authorization": "Bearer ${MCP_AUTH_TOKEN}" }
# MCP_AUTH_TOKEN=