Model and harness

Each scan runs with a model driven through a harness. Together they decide which AI runs your prompts and how.

Model and provider

• model - Codex and Anthropic use a searchable picker populated from the models available to the configured account. OpenRouter remains a free-text model name because its catalog is too broad; enter the provider's exact model identifier (for example z-ai/glm-5.2).
• model_provider - where the model runs. The form lists only providers configured for the engine: openrouter, claude, and/or codex. Run ./kritt setup and follow the AI provider setup guides when none are available.

Harness

The harness is the CLI agent runtime that executes the prompt against the workspace:

Harness	Notes
codex	The Codex CLI runner (each job gets an isolated home).
claude-code	The Claude Code runner.

The harness is what actually reads the repository, runs the agent loop, and returns the structured output your steps require.

Tool-enabled harness jobs run as root inside a disposable container. Each receives a writable copy of the target and dependency repositories plus direct outbound internet, so the agent can install packages, compile the target, run tests, research public information, and build proof-of-concept artifacts. The job does not receive the Docker socket, database, project .env, or another job's workspace.

For a standard configured provider, open·kritt chooses a compatible harness automatically: Codex uses codex; Anthropic and OpenRouter use claude-code. OpenRouter can also use the Codex harness as an advanced option when its matching Codex provider configuration is installed.

The engine image currently contains an experimental Cursor adapter and cursor-agent, but the API/UI intentionally expose no provider/Cursor combination. Cursor headless login and OpenRouter's Cursor BYOK endpoint require separate configuration that open·kritt does not perform. Do not treat the installed adapter as a supported scan path.

Thinking effort

thinking_effort tunes how much reasoning the model spends. The UI shows only levels supported by the selected model and harness. Depending on that combination, values can include low, medium (the open·kritt default), high, xhigh, max, or Codex ultra. OpenRouter models that do not expose an effort selector use default, which leaves the choice to the provider. Higher effort can find subtler bugs at the cost of time and tokens.

Note

Pick the model/harness combination documented for your configured provider. Run the full stack on a dedicated Docker host or VM when scanning untrusted code; see the threat model.

Next: attach skills, post-scripts, and rankers.