Environment Variables

LLM

Variable	Type	Default	Description
`LLM_PROVIDER`	string	`ollama`	`ollama` \| `openai` \| `anthropic`
`OLLAMA_MODEL`	string	`qwen3:14b`	Ollama model with tool calling support
`OLLAMA_BASE_URL`	string	`http://localhost:11434`	URL of Ollama server
`OPENAI_MODEL`	string	`gpt-4o`	OpenAI model
`OPENAI_API_KEY`	string	—	OpenAI API key
`ANTHROPIC_MODEL`	string	`claude-3-5-sonnet-20241022`	Anthropic model
`ANTHROPIC_API_KEY`	string	—	Anthropic API key

OSINT API Keys

Variable	Service	Free tier
`VIRUSTOTAL_API_KEY`	VirusTotal	500 req/day
`ABUSEIPDB_API_KEY`	AbuseIPDB	1,000 req/day
`ALIENVAULT_OTX_API_KEY`	AlienVault OTX	Unlimited
`SHODAN_API_KEY`	Shodan	100 req/month
`IPINFO_TOKEN`	IPInfo	50,000 req/month
`URLSCAN_API_KEY`	URLScan.io	5,000 req/day
`FRED_API_KEY`	FRED	Free
`EIA_API_KEY`	EIA	Free
`CLOUDFLARE_API_TOKEN`	Cloudflare Radar	Free
`ACLED_ACCESS_TOKEN`	ACLED	Free (research)
`ACLED_EMAIL`	ACLED	Required with token
`AISSTREAM_API_KEY`	AISStream	Free

OSINT Behavior

Variable	Type	Default	Description
`CACHE_TTL_SECONDS`	int	`86400`	Result cache TTL (seconds)
`MAX_PIVOTS`	int	`2`	Maximum depth of auto-pivot
`THREAT_FEED_LIMIT`	int	`10`	Max IOCs per feed fetch
`BATCH_DELAY_SECONDS`	float	`2`	Pause between IOCs in batch

Data Paths

Variable	Type	Default	Description
`OSINT_CACHE_DB_PATH`	path	`data/osint_cache.db`	OSINT cache SQLite
`INVESTIGATION_DB_PATH`	path	`data/osint_ai.db`	Investigations SQLite
`CHROMA_PATH`	path	`data/chroma`	ChromaDB directory
`INVESTIGATIONS_DIR`	path	`investigaciones`	Root directory for investigations

Embeddings

Variable	Type	Default	Description
`EMBEDDING_MODEL`	string	`sentence-transformers/paraphrase-multilingual-MiniLM-L12-v2`	Embedding model for ChromaDB

Quotas

Variable	Type	Default	Description
`ACTIVE_INVESTIGATIONS_LIMIT`	int	`5`	Max active investigations simultaneously
`MONTHLY_OPERATIONS_LIMIT`	int	`100`	Monthly operations quota

Servers

Variable	Type	Default	Description
`MCP_TRANSPORT`	string	`stdio`	`stdio` \| `streamable-http`
`MCP_HTTP_PORT`	int	`8080`	HTTP port for MCP
`A2A_HOST`	string	`0.0.0.0`	A2A listening interface
`A2A_PORT`	int	`9000`	A2A server port

Reading variables in code

The system uses Pydantic Settings (src/config.py). Variables are read at startup and validated with types. If a required variable is missing, startup fails with a clear message.

from src.config import settings

# Access variables
print(settings.virustotal_api_key)
print(settings.cache_ttl_seconds)
print(settings.ollama_model)