AI Providers

Cyberstrike supports 25+ AI providers. The model catalog is pulled live from models.dev — new models appear automatically. Run /models in the TUI to see what’s available. For a complete list of supported models, capabilities, and configuration details, see AI Models.

Supported Providers

First-Party SDKs (Bundled)

These providers have dedicated AI SDK packages bundled into CyberStrike. Set the API key and go.

Additional Providers (Custom Loaders)

These have dedicated integration code for authentication and routing:

Adding Credentials

Three ways, in priority order:

1. Environment Variables

export ANTHROPIC_API_KEY="sk-ant-..."
export OPENAI_API_KEY="sk-..."

2. TUI Login

Run /connect in the TUI to open the provider dialog. Select your provider and enter your API key or authorize via OAuth.

Credentials are stored in ~/.local/share/cyberstrike/auth.json.

3. Configuration File

{
  "provider": {
    "anthropic": {
      "options": {
        "apiKey": "{env:ANTHROPIC_API_KEY}"
      }
    }
  }
}

Provider Configuration

Each provider entry in cyberstrike.json can set:

{
  "provider": {
    "<provider-id>": {
      "name": "Display Name",
      "api": "https://api.example.com/v1",
      "npm": "@ai-sdk/openai-compatible",
      "env": ["MY_API_KEY"],
      "options": {},
      "models": {
        "model-id": {
          "name": "Model Name",
          "id": "api-model-id"
        }
      },
      "blacklist": ["model-to-hide"],
      "whitelist": ["only-these-models"]
    }
  }
}

Model Selection

Use provider-id/model-id format everywhere:

{
  "model": "anthropic/claude-sonnet-4-5"
}

Or at launch:

cyberstrike --model anthropic/claude-sonnet-4-5

Or switch mid-session with /models in the TUI.

Disabling / Enabling Providers

{
  "disabled_providers": ["openrouter", "groq"],
  "enabled_providers": ["anthropic", "openai"]
}

enabled_providers is a whitelist — only listed providers appear. disabled_providers is a blacklist. They can be combined.

Model Catalog

CyberStrike pulls model metadata (pricing, context limits, capabilities) from models.dev and caches it locally. The catalog auto-updates, so new models appear without upgrading CyberStrike.

Anthropic (Claude)

Anthropic’s Claude models provide advanced reasoning capabilities for security analysis.

Available Models

Cyberstrike pulls its model catalog live from models.dev, so the exact list tracks what Anthropic currently offers. Common picks:

Anthropic Authentication

1. Get your API key from the Anthropic Console
2. In the TUI, run /connect, select Anthropic, and enter your API key

Or set the environment variable:

export ANTHROPIC_API_KEY="sk-ant-..."

Extended Thinking

Enable extended thinking for complex security analysis:

{
  "provider": {
    "anthropic": {
      "options": {
        "thinking": {
          "type": "enabled",
          "budgetTokens": 10000
        }
      }
    }
  }
}

Token Usage & Caching

In the session TUI header, CyberStrike shows context usage for the most recent assistant message and estimated session cost in USD. For direct Anthropic models, CyberStrike adds ephemeral cache control to selected system and recent messages automatically.

Anthropic Rate Limits

Rate limits depend on your Anthropic account; refer to the Anthropic API documentation for current quotas. CyberStrike uses exponential backoff for retryable errors and honors Retry-After headers.

AWS Bedrock

AWS Bedrock lets you run CyberStrike through your own AWS account. Your data stays in your infrastructure, you get IAM-based access control, and you can use VPC endpoints for private network access.

CyberStrike uses the standard AWS credential provider chain (@aws-sdk/credential-providers), so if you already use the AWS CLI or SDKs, your existing credentials will work.

Prerequisites

Quick Start

# If you already have AWS CLI configured
cyberstrike

# If you have a named profile
AWS_PROFILE=my-profile cyberstrike

# If you have access keys
AWS_ACCESS_KEY_ID=AKIA... AWS_SECRET_ACCESS_KEY=... cyberstrike

# On EC2 with an IAM Role attached — just run it
cyberstrike

Authentication Methods

CyberStrike supports 9 different ways to authenticate with AWS Bedrock:

1. AWS Access Keys

export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
export AWS_REGION="us-east-1"

2. AWS Profiles

{
  "provider": {
    "amazon-bedrock": {
      "options": {
        "profile": "my-profile",
        "region": "us-east-1"
      }
    }
  }
}

Or use AWS_PROFILE=my-profile cyberstrike.

3. SSO / IAM Identity Center

Configure an SSO profile in ~/.aws/config, then:

aws sso login --profile my-sso
AWS_PROFILE=my-sso cyberstrike

4. STS AssumeRole (Role Chaining)

Configure role chaining in ~/.aws/config with role_arn and source_profile, then use AWS_PROFILE=bedrock-role cyberstrike.

5. Web Identity Token (OIDC)

For EKS, GitHub Actions, or OIDC-federated environments:

export AWS_WEB_IDENTITY_TOKEN_FILE="/var/run/secrets/eks.amazonaws.com/serviceaccount/token"
export AWS_ROLE_ARN="arn:aws:iam::123456789012:role/my-eks-role"

6. Container Credentials (ECS / Fargate)

AWS injects credentials automatically. No configuration needed.

7. EC2 Instance Metadata (IMDS)

On EC2 with an IAM role attached, credentials are fetched automatically.

8. Bearer Token

export AWS_BEARER_TOKEN_BEDROCK="your-bearer-token"

9. Custom Credential Process

Configure a custom tool in ~/.aws/config with credential_process.

Authentication Priority

IAM Permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "arn:aws:bedrock:*::foundation-model/anthropic.*"
    }
  ]
}

Region Configuration

Cross-Region Inference

CyberStrike automatically handles cross-region inference profile prefixes:

VPC Endpoint

{
  "provider": {
    "amazon-bedrock": {
      "options": {
        "region": "us-east-1",
        "endpoint": "https://bedrock-runtime.us-east-1.vpce-xxxxx.amazonaws.com"
      }
    }
  }
}

Bedrock Troubleshooting

GitHub Copilot

Authenticate with your GitHub account via OAuth and access all models available through your Copilot subscription — including Claude, GPT-4o, and o-series models.

Requirements

• A GitHub account with an active GitHub Copilot subscription (Individual, Business, or Enterprise)
• For GitHub Enterprise: your GHE server URL

Copilot Authentication

In the TUI, run /connect and select Login with GitHub Copilot:

Cyberstrike opens a browser window for GitHub authorization. Enter the device code shown in the terminal, authorize the app, and the OAuth token is saved automatically.

Available Copilot Models

Copilot Configuration

GitHub Copilot requires no manual configuration beyond the OAuth login. To use a Copilot model as default:

{
  "model": "github-copilot/claude-sonnet-4-20250514"
}

How Copilot Works

1. OAuth device flow — Cyberstrike requests a device code from GitHub, you authorize in the browser
2. Token exchange — The OAuth token is exchanged for a short-lived Copilot session token (~30 min TTL)
3. Auto-refresh — Session tokens are refreshed automatically before expiry
4. Model routing — Claude models use the Anthropic Messages API; all others use the OpenAI-compatible endpoint

Copilot Troubleshooting

Custom & OpenAI-Compatible Providers

For endpoints that aren’t bundled (Fireworks, vLLM, LM Studio, a private gateway), define them under provider. Loading is triggered by the top-level api field (the base URL):

{
  "provider": {
    "my-endpoint": {
      "name": "My Endpoint",
      "api": "https://api.example.com/v1",
      "options": { "apiKey": "{env:MY_API_KEY}" },
      "models": {
        "my-model": { "name": "My Model" }
      }
    }
  },
  "model": "my-endpoint/my-model"
}

Built-in Extra Providers

These are already bundled — just set the API-key environment variable and select a model as provider-id/model:

vLLM

{
  "provider": {
    "vllm": {
      "name": "vLLM",
      "api": "http://localhost:8000/v1",
      "models": { "llama-3.3-70b": { "name": "Llama 3.3 70B" } }
    }
  }
}

LM Studio

{
  "provider": {
    "lmstudio": {
      "name": "LM Studio",
      "api": "http://localhost:1234/v1",
      "models": { "local-model": { "name": "Local Model" } }
    }
  }
}

Azure OpenAI

{
  "provider": {
    "azure": {
      "name": "Azure OpenAI",
      "options": {
        "apiKey": "{env:AZURE_API_KEY}"
      }
    }
  }
}

export AZURE_RESOURCE_NAME="your-resource"
export AZURE_API_KEY="..."

Custom Provider Troubleshooting

• 401 Unauthorized — check the API key env var and that it’s referenced with {env:VAR}.
• Model not found — the model id must match the provider’s format and be listed under models.
• Unexpected response — the endpoint may not be fully OpenAI-compatible; tool calling and streaming vary by provider.