Skip to main content
Configure Strix using environment variables or a config file.

​
LLM Configuration

​
string
required
Model name in LiteLLM format (e.g., openai/gpt-5.4, anthropic/claude-sonnet-4-6).
​
string
API key for your LLM provider. Not required for local models or cloud provider auth (Vertex AI, AWS Bedrock).
​
string
Custom API base URL. Also accepts OPENAI_API_BASE, LITELLM_BASE_URL, or OLLAMA_API_BASE.
​
string
Extra HTTP headers sent on every LLM request, as a JSON object (e.g. {"X-Feature-Key":"value","X-Tenant":"acme"}). Useful for OpenAI-compatible gateways that require attribution or routing headers in addition to the bearer token. The bearer token itself still comes from LLM_API_KEY. Applies to both the LiteLLM and native OpenAI routing paths.
​
integer
default:"300"
Request timeout in seconds for LLM calls.
​
integer
default:"5"
Maximum number of retries for LLM API calls on transient failures.
​
string
default:"high"
Control thinking effort for reasoning models. Valid values: none, minimal, low, medium, high, xhigh, max. Defaults to medium for quick scan mode.
​
integer
default:"30"
Timeout in seconds for memory compression operations (context summarization).

​
Dedicated deduplication model

Finding deduplication is a cheap, structured classification task. By default it runs on the main model, but you can route it to a smaller/cheaper model without affecting the agents that do the actual testing.
​
string
Model used to judge whether a candidate finding duplicates an existing report. Falls back to STRIX_LLM when unset.
​
string
Optional provider key for the deduplication model.
​
string
Optional custom API base URL for the deduplication model. Use when the dedupe model runs on a different endpoint than the main model.
​
string
Optional JSON object of extra HTTP headers sent on every deduplication-model request, e.g. {"X-Feature-Key":"value"}. A dedicated dedupe model never inherits LLM_EXTRA_HEADERS; set this when its endpoint needs custom headers.
​
string
Reasoning effort for the deduplication model. Defaults to the model’s own baseline when unset.

​
Optional Features

​
string
API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.
​
string
Postman API key (PMAK-…). Enables fetching Postman collections by id as a target (postman://<collection-uid>), and Postman environments (postman://<collection-uid>?env=<environment-uid>) to resolve collection variables. Not needed when passing a local collection export file.
​
string
default:"1"
Telemetry toggle. Set to 0, false, no, or off to disable telemetry (PostHog, Scarf, OTEL).
​
string
OTLP/Traceloop base URL for remote OpenTelemetry export. If unset, Strix keeps traces local only.
​
string
API key used for remote trace export. Remote export is enabled only when both TRACELOOP_BASE_URL and TRACELOOP_API_KEY are set.
​
string
Optional custom OTEL headers (JSON object or key=value,key2=value2). Useful for Langfuse or custom/self-hosted OTLP gateways.
When remote OTEL vars are not set, Strix still writes complete run telemetry locally to:
When remote vars are set, Strix dual-writes telemetry to both local JSONL and the remote OTEL endpoint.

​
Docker Configuration

​
string
default:"ghcr.io/usestrix/strix-sandbox:1.3.0"
Docker image to use for the sandbox container.
​
string
Docker daemon socket path. Use for remote Docker hosts or custom configurations.
​
string
default:"docker"
Runtime backend for the sandbox environment.

​
Sandbox Configuration

​
integer
default:"120"
Maximum execution time in seconds for sandbox operations.
​
integer
default:"10"
Timeout in seconds for connecting to the sandbox container.

​
Config File

Strix stores configuration in ~/.strix/cli-config.json. You can also specify a custom config file:
Config file format:

​
Example Setup