Configuration (.env)

How to configure

cp .env.example .env
# Edit with your preferred editor

The .env file is in .gitignore — it never gets uploaded to the repository.

LLM Provider

Variable	Default	Description
`LLM_PROVIDER`	`ollama`	LLM provider: `ollama`, `openai`, or `anthropic`
`OLLAMA_MODEL`	`qwen3:14b`	Ollama model — must support tool calling
`OLLAMA_BASE_URL`	`http://localhost:11434`	URL of Ollama server
`OPENAI_MODEL`	`gpt-4o`	OpenAI model (if provider=openai)
`OPENAI_API_KEY`	—	OpenAI API key
`ANTHROPIC_MODEL`	`claude-3-5-sonnet-20241022`	Anthropic model (if provider=anthropic)
`ANTHROPIC_API_KEY`	—	Anthropic API key

OSINT API Keys

Variable	Service	Free tier
`VIRUSTOTAL_API_KEY`	VirusTotal	500 req/day
`ABUSEIPDB_API_KEY`	AbuseIPDB	1,000 req/day
`ALIENVAULT_OTX_API_KEY`	AlienVault OTX	Unlimited
`SHODAN_API_KEY`	Shodan	100 req/month
`IPINFO_TOKEN`	IPInfo	50,000 req/month
`URLSCAN_API_KEY`	URLScan.io	5,000 req/day
`FRED_API_KEY`	FRED (Federal Reserve)	Free
`EIA_API_KEY`	EIA (Energy)	Free
`CLOUDFLARE_API_TOKEN`	Cloudflare Radar	Free
`ACLED_ACCESS_TOKEN`	ACLED	Free (research)
`ACLED_EMAIL`	ACLED (required with token)	—
`AISSTREAM_API_KEY`	AISStream (maritime traffic)	Free

OSINT Behavior

Variable	Default	Description
`CACHE_TTL_SECONDS`	`86400`	Result cache duration (24 hours)
`MAX_PIVOTS`	`2`	Maximum depth of auto-pivot
`THREAT_FEED_LIMIT`	`10`	Maximum IOCs per feed fetch
`BATCH_DELAY_SECONDS`	`2`	Pause between IOCs in batch mode (rate limiting)

Server Ports

Variable	Default	Description
`MCP_TRANSPORT`	`stdio`	MCP transport: `stdio` or `streamable-http`
`MCP_HTTP_PORT`	`8080`	HTTP port for MCP streamable-http
`A2A_HOST`	`0.0.0.0`	A2A server listening interface
`A2A_PORT`	`9000`	A2A server port

Investigations

Variable	Default	Description
`INVESTIGATION_DB_PATH`	`data/osint_ai.db`	Path to investigations SQLite database
`CHROMA_PATH`	`data/chroma`	ChromaDB persistent storage
`INVESTIGATIONS_DIR`	`investigaciones`	Root directory for investigation folders
`EMBEDDING_MODEL`	`sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2`	Embedding model for semantic search
`ACTIVE_INVESTIGATIONS_LIMIT`	`5`	Maximum active investigations simultaneously
`MONTHLY_OPERATIONS_LIMIT`	`100`	Monthly operations quota

OSINT Cache

Variable	Default	Description
`OSINT_CACHE_DB_PATH`	`data/osint_cache.db`	Path to OSINT cache database

Complete .env example

# === LLM ===
LLM_PROVIDER=ollama
OLLAMA_MODEL=qwen3:14b
OLLAMA_BASE_URL=http://localhost:11434

# === OSINT API Keys ===
VIRUSTOTAL_API_KEY=your_virustotal_key
ABUSEIPDB_API_KEY=your_abuseipdb_key
ALIENVAULT_OTX_API_KEY=your_alienvault_key
SHODAN_API_KEY=your_shodan_key
IPINFO_TOKEN=your_ipinfo_token
URLSCAN_API_KEY=your_urlscan_key

# === Optional ===
FRED_API_KEY=your_fred_key
EIA_API_KEY=your_eia_key
CLOUDFLARE_API_TOKEN=your_cloudflare_token
ACLED_ACCESS_TOKEN=your_acled_token
ACLED_EMAIL=your@email.com
AISSTREAM_API_KEY=your_aisstream_key

# === Behavior ===
CACHE_TTL_SECONDS=86400
MAX_PIVOTS=2
THREAT_FEED_LIMIT=10
BATCH_DELAY_SECONDS=2

# === Servers ===
MCP_TRANSPORT=stdio
MCP_HTTP_PORT=8080
A2A_HOST=0.0.0.0
A2A_PORT=9000

# === Investigations ===
INVESTIGATION_DB_PATH=data/osint_ai.db
CHROMA_PATH=data/chroma
INVESTIGATIONS_DIR=investigaciones
ACTIVE_INVESTIGATIONS_LIMIT=5
MONTHLY_OPERATIONS_LIMIT=100