Configuration

Most runs need no config file at all — the launcher (pentestswarm run) and scan flags cover everything. A config.yaml is there for when you want to pin a provider and model, override individual agents, or check the file into a repo for reproducible runs.

Getting a starter config

pentestswarm init

init writes a starter config.yaml you can edit. Two companion commands help you keep an environment healthy:

• pentestswarm doctor — health check: verifies Go, Docker, installed recon tools, and provider configuration, and tells you exactly what to fix.
• pentestswarm install-tools — fetches the recon / exploit toolchain (subfinder, httpx, nuclei, naabu, katana, dnsx, gau, nmap, …) so the swarm has real tools to operate.

config.yaml

orchestrator

The orchestrator block is the swarm's default LLM configuration — every agent inherits from it unless a per-agent override says otherwise.

orchestrator:
  provider: "together"        # together | claude | openai | gemini | orcarouter | ollama | lmstudio | bedrock
  model: ""                   # explicit model id; leave empty to use the provider default
  api_key: ""                 # or set PENTESTSWARM_ORCHESTRATOR_API_KEY (not used by bedrock)
  endpoint: ""                # base URL — auto-configured for most providers
  region: "us-east-1"         # Bedrock region
  aws_profile: ""             # Bedrock shared-config profile
  context_window: 128000      # tokens

Field	Meaning
provider	Which LLM provider to use. See Providers.
model	Explicit model id. Leave empty to take the provider's default (and, for together, its automatic per-task routing).
api_key	The key. Can also come from the PENTESTSWARM_ORCHESTRATOR_API_KEY env var or the launcher's key field.
endpoint	Base URL. Auto-configured for most providers; set it for a custom OpenAI-compatible endpoint.
region	AWS region for bedrock. Defaults to us-east-1.
aws_profile	AWS shared-config profile for bedrock. Static keys (aws_access_key_id, aws_secret_access_key, optional aws_session_token) win when both are set.
context_window	Context size in tokens.

For bedrock, model is required — set it with --model or orchestrator.model to a Bedrock model ID or inference profile (for example zai.glm-5). bedrock does not use api_key.

Per-agent overrides (agents)

The swarm has four agent roles — recon, classifier, exploit, and report. You can override any of them individually with its own model, provider, and api_key:

agents:
  recon:
    model: "meta-llama/Llama-3.3-70B-Instruct-Turbo"
  classifier:
    model: "Qwen/Qwen2.5-72B-Instruct-Turbo"
  exploit:
    provider: "claude"        # run just the exploit agent on a different provider
    api_key: ""
  report:
    model: "meta-llama/Llama-3.3-70B-Instruct-Turbo"

Explicit model always wins

An explicit per-agent model always beats the automatic routing that the together provider does. If you set a model here, that's the model that agent uses — the auto-routing only applies to agents you leave unset. See Providers → Together AI.

Setting the key via environment

For any cloud provider you can skip api_key in the file and export the key instead:

export PENTESTSWARM_ORCHESTRATOR_API_KEY=your-key-here

The launcher's key field, the orchestrator.api_key config value, and this env var are three interchangeable ways to supply the same key. Local providers (Ollama, LM Studio) need no key at all.

Precedence, in short

1. Per-agent model/provider in agents.* — most specific, wins for that agent.
2. orchestrator block — the default every un-overridden agent inherits.
3. PENTESTSWARM_ORCHESTRATOR_API_KEY / launcher key field — supplies the key when the config doesn't.