Skip to main content
Make flintai-cli work for you. Set these environment variables to customize scans and evals. Defaults work out of the box.

​
Where settings come from

Flint AI CLI reads settings from the following places, highest precedence first:
  1. Your shell or CI environment. Anything already exported, or set inline on the command (GENERATOR_MODEL=openai:gpt-5.4 flintai scan ...), wins over both files below.
  2. A project .env. The nearest .env in your working directory or one of its parents. Use this to give a project its own model, keys, and limits.
  3. The global ~/.flintai/.env. The fallback for anything the project file doesn’t set. It always loads, so a project .env can override a setting but never hide one that lives only here.
The two files are merged rather than one replacing the other, so a project .env only needs the settings it changes.
flintai init writes to a project .env when there is one. If the directory you run it from contains a .env, flintai init replaces that file’s contents with the settings it collects, instead of writing to ~/.flintai/.env. To keep an existing project file, run flintai init from somewhere else and set project-specific values by hand afterwards.

​
Using environment variables in config.json

Reference environment variables in your config file using ${VAR_NAME} syntax:
You can use this syntax anywhere in your config.json:
  • API keys: "key": "${ANTHROPIC_API_KEY}"
  • Endpoints: "host": "${STAGING_URL}"
  • Any string value: "name": "${AGENT_NAME}"
Security: Use ${...} references for API keys rather than pasting them as plaintext. This keeps credentials out of config files.

​
API keys

Flint AI CLI uses an LLM to analyze your agent code and filter false positives. Choose one provider:
GEMINI_API_KEYFree tier available. Get your key: aistudio.google.com/apikey

​
How to set your API key

Run the interactive setup wizard:
This writes your provider, API key, and runtime settings to a .env — see where settings come from for which one — and creates a ~/.flintai/config.json skeleton.
Production and CI/CD environmentsThe .env file stores API keys as plaintext on disk. For production or shared infrastructure, use an external secret manager:
Never commit .env files to version control.

​
GENERATOR_MODEL

​
string
required
Controls which LLM reads your agent code and filters false positives during scan.Format: <provider>:<model-name>Supported providers: gemini, openai, anthropic, litellmflintai init sets this for you, using the default it offers for the provider you choose. See where settings come from for which file it writes to.Why this matters:
  • Faster models = faster scans
  • More capable models = better false positive filtering
  • Cost varies by provider and model
Where it’s used:
  • Scan: AI reasoning to analyze agent code and filter false positives
  • Eval: LLM-as-judge scoring, security probe generation
Examples:

​
SCANNER_REASONING_EFFORT

​
string
default:"medium"
Sets how much reasoning a scan asks for when GENERATOR_MODEL is an OpenAI GPT-5 reasoning model.It applies to those models only. Other providers ignore it, and so do the gpt-5-chat variants, which are plain chat models. If a model rejects the value, the scan drops it and continues rather than failing.Raise it for closer analysis of complex agent code, lower it for faster and cheaper scans. Your provider’s reference lists the levels it accepts.Example:
​
boolean
default:"false"
Controls whether Flint AI CLI shares anonymous usage analytics. Only true enables sharing; any other value, or no value at all, keeps it off.The first time you run a command, the CLI asks. The prompt accepts on Enter, so pressing Enter turns analytics on. Set this variable before your first run to skip the prompt entirely and use the value you set.Your answer is written to your .env, so run flintai init first if you don’t have one yet — without it there’s nothing to record your answer in, and you’re asked again next time. Edit the file to change your answer later.In CI the CLI never asks and never shares.Example:
Shared: the command you ran, the CLI version, your Python version and operating system, how long the command took, the error type if it failed, whether the run was in CI, and a random client ID that counts installations.Never shared: your code, file paths, prompts, model responses, scan and eval findings, API keys, and anything that identifies you or your organization.
​
string
A random identifier the CLI generates once and stores in your .env so analytics can count installations without identifying you. It’s tied to nothing else about you or your machine. Delete the line to get a new one.

​
Scan limits

Control how much agent code Flint AI CLI scans. Raise these if scanning large codebases.
​
number
default:"40"
Maximum analysis iterations per agent file.When to change: Large agents with complex logic need more iterations to analyze thoroughly.Example:
​
number
default:"50"
Maximum number of files to analyze.When to change: Scanning a very large codebase (100+ Python files).Example:
​
number
default:"200000"
Maximum tokens allowed for file content during scan. Scan stops when limit is reached.When to change: Scan stops early with “token budget exhausted” on large codebases.Example:
​
number
default:"600"
Maximum seconds for analysis before timeout (default is 10 minutes).When to change: Scanning times out on large codebases or slow models.Example:

​
Eval limits

Eval concurrency is set with --concurrency on flintai eval run, not with an environment variable:
Need help? See Troubleshooting for common configuration issues.