# NeuroSploit v4.3.0 — environment / API keys (optional)
# ------------------------------------------------------------------
# You only need this for the API-key auth path. If you log in with a
# local subscription CLI instead (--subscription with Claude / Codex /
# Gemini / Grok), you don't need any key here.
#
# Set the key(s) for the providers you use, then load and run:
#   set -a; . ./.env; set +a
#   neurosploit run http://target --model anthropic:claude-opus-4-8 -v
#
# Provider prefix -> env var (use as `--model <prefix>:<model>`).

# anthropic:   https://console.anthropic.com/
ANTHROPIC_API_KEY=

# openai:      https://platform.openai.com/api-keys
OPENAI_API_KEY=

# gemini:      https://aistudio.google.com/app/apikey
# (GOOGLE_API_KEY is also accepted as an alias if GEMINI_API_KEY is unset)
GEMINI_API_KEY=
#GOOGLE_API_KEY=

# azure:       Azure OpenAI (OpenAI-compatible). Use `--model azure:<deployment>`
#              (the model name is your Azure *deployment* name).
#AZURE_OPENAI_API_KEY=
#AZURE_OPENAI_ENDPOINT=https://your-resource.openai.azure.com
#AZURE_OPENAI_API_VERSION=2024-10-21

# xai:         https://console.x.ai/
XAI_API_KEY=

# nvidia_nim:  https://build.nvidia.com/   (keys look like nvapi-...)
NVIDIA_NIM_API_KEY=

# deepseek:    https://platform.deepseek.com/
DEEPSEEK_API_KEY=

# mistral:     https://console.mistral.ai/
MISTRAL_API_KEY=

# qwen:        https://dashscope-intl.aliyuncs.com/  (Alibaba DashScope)
DASHSCOPE_API_KEY=

# zai:         https://z.ai/  (GLM models)
ZAI_API_KEY=

# moonshot:    https://platform.moonshot.ai/  (Kimi models)
MOONSHOT_API_KEY=

# groq:        https://console.groq.com/keys
GROQ_API_KEY=

# together:    https://api.together.xyz/settings/api-keys
TOGETHER_API_KEY=

# openrouter:  https://openrouter.ai/keys
OPENROUTER_API_KEY=

# opencode:    https://opencode.ai/auth  (OpenCode Zen gateway)
#              Or skip the key entirely and use --subscription with the
#              `opencode` CLI logged into your own Zen/plan account.
OPENCODE_API_KEY=

# nous:        Nous Portal (https://portal.nousresearch.com) — Hermes models.
#              Or skip the key entirely and use --subscription with the
#              `hermes` CLI (`hermes setup --portal` for OAuth login).
NOUS_API_KEY=

# ollama:      local, no key needed. Override the endpoint if not default:
#OLLAMA_BASE_URL=http://localhost:11434/v1

# litellm:     point at your LiteLLM proxy (OpenAI-compatible). Route any
#              model through it as `--model litellm:<model>`.
#LITELLM_BASE_URL=http://localhost:4000/v1
LITELLM_API_KEY=

# TypeSafe System One (RLCD — Reinforcement Learning for Calibrated Decisions).
# When set, NeuroSploit adjudicates each finding with a calibrated verdict
# (confirmed/needs-review/rejected) + an "impact demonstrated" judgment over the
# EVIDENCE, refining confidence and the needs-review boundary. Additive — never
# overrules a deterministic validator. Disable with NEUROSPLOIT_TYPESAFE=off.
TYPESAFE_API_KEY=

# ------------------------------------------------------------------
# Attack-graph memory (Neo4j) — OPTIONAL. The graph is always written to the
# run's graph/ folder; these only add a live Neo4j sync so paths accumulate
# across runs. Pass the URI with --neo4j <uri> (or set NEO4J_URI); credentials
# come ONLY from the environment, never flags, never written to disk.
#NEO4J_URI=bolt://localhost:7687
#NEO4J_USER=neo4j
#NEO4J_PASSWORD=
#NEO4J_DATABASE=neo4j
# Salt for the graph's secret fingerprints (so credential reuse correlates
# without storing any secret). Share one value across a team that shares a Neo4j.
# Defaults to ~/.neurosploit/graph-salt when unset.
#NEUROSPLOIT_GRAPH_SALT=

# Target-authorization gate — OPTIONAL. When set, the harness verifies a signed
# capability token (minted with `neurosploit capability issue`) before any recon
# and refuses targets outside the grant.
#NEUROSPLOIT_CAPABILITY_KEY=
#
# (For blind classes — SSRF/XXE/blind RCE — pass an out-of-band domain you
#  control with the --oob-domain flag; without it those are reported as leads.)