2. Choose a model¶
Mylonite has no default provider and no default model. demo's replay (step
1) needed none; every command from here on that makes an LLM call does, and
checks for it before touching your target.
The full provider table, how to hand over a key, and which commands need one at all are on Choose a model — this page doesn't repeat that table, since it's generated from the same registry the CLI checks against and would drift from it if copied here by hand.
Pick one of two paths:
- A hosted provider. Anthropic is the one this journey is measured
against (
claude-haiku-4-5-20251001). Also supported: OpenAI (OPENAI_API_KEY), Gemini (GEMINI_API_KEY), Azure (AZURE_API_KEY), Bedrock (AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY), and Vertex AI or a LiteLLM proxy (no bare key — see the table for how each authenticates).
- No key at all: a local model. Self-hosted models covers Ollama and vLLM in full. The honest version of that page's guidance, stated here because it changes what you should expect from the rest of this journey: a small (3B-class) local model is what fits a laptop or a default CI runner without being killed for memory, and a 3B model is measurably worse at both roles Mylonite's calls play — the planner driving your tools, and the judge deciding whether damage actually happened. Run one and a clean result on your own app can mean the attack wasn't tried properly, not that your app is safe; treat a 3B run as a smoke run for steps 1-4, and use a hosted model (or a larger self-hosted one) before trusting a kept finding or its absence.
With none of --model, mylonite.yaml's model:, or MYLONITE_MODEL set,
every live command stops before touching a target, naming the approved
providers and their key variables, and exits 4.
Next¶
3. Point at your app — the first step that needs your own server, still free.