agentaudit 3.9.18 → 3.9.19

package/README.md

@@ -208,6 +208,7 @@ Then ask your agent: *"Check which MCP servers I have installed and audit any un
 | `agentaudit audit <url>` | Deep LLM-powered 3-pass audit (~30s) | `agentaudit audit https://github.com/owner/repo` |
 | `agentaudit lookup <name>` | Look up package in trust registry | `agentaudit lookup fastmcp` |
 | `agentaudit check <name\|url>` | Lookup + auto-audit if not found | `agentaudit check https://github.com/owner/repo` |
+| `agentaudit status` | Check API keys + active LLM provider | `agentaudit status` |
 | `agentaudit setup` | Register agent + configure API key | `agentaudit setup` |
 
 ### Global Flags
@@ -217,6 +218,7 @@ Then ask your agent: *"Check which MCP servers I have installed and audit any un
 | `--json` | Output machine-readable JSON to stdout |
 | `--quiet` / `-q` | Suppress banner and decorative output (show findings only) |
 | `--no-color` | Disable ANSI colors (also respects `NO_COLOR` env var) |
+| `--provider <name>` | Force LLM provider (`anthropic`, `openai`, `openrouter`, `ollama`, `custom`) |
 | `--help` / `-h` | Show help text |
 | `-v` / `--version` | Show version |
 
@@ -433,12 +435,19 @@ export AGENTAUDIT_API_KEY=asf_your_key_here
 | Variable | Description |
 |----------|-------------|
 | `AGENTAUDIT_API_KEY` | API key for registry access |
-| `ANTHROPIC_API_KEY` | Anthropic API key for deep audits (Claude) |
+| `ANTHROPIC_API_KEY` | Anthropic API key for deep audits (Claude) -- recommended |
 | `OPENAI_API_KEY` | OpenAI API key for deep audits (GPT-4o) |
 | `OPENROUTER_API_KEY` | OpenRouter API key (access 200+ models) |
 | `OPENROUTER_MODEL` | Model to use via OpenRouter (default: `anthropic/claude-sonnet-4`) |
+| `OLLAMA_MODEL` | Ollama model name for local audits (e.g. `llama3.1`, `qwen2.5-coder`) |
+| `OLLAMA_HOST` | Ollama server URL (default: `http://localhost:11434`) |
+| `LLM_API_URL` | Any OpenAI-compatible API endpoint (e.g. LM Studio, vLLM, Together, Groq) |
+| `LLM_API_KEY` | API key for custom endpoint (optional if no auth needed) |
+| `LLM_MODEL` | Model name for custom endpoint |
 | `NO_COLOR` | Disable ANSI colors ([no-color.org](https://no-color.org)) |
 
+> **Provider priority:** Anthropic > OpenAI > OpenRouter > Custom > Ollama. Override with `--provider=ollama` etc.
+
 ---
 
 ## 📦 Requirements
@@ -468,7 +477,7 @@ Or use without installing: `npx agentaudit`
 
 ### Setting up your LLM key for deep audits
 
-The `audit` command supports **three LLM providers**. Set one of these environment variables:
+The `audit` command supports **any LLM provider**. Set one of these environment variables:
 
 ```bash
 # Linux / macOS
@@ -487,13 +496,32 @@ set OPENAI_API_KEY=sk-...
 set OPENROUTER_API_KEY=sk-or-...
 ```
 
-**Provider priority:** Anthropic > OpenAI > OpenRouter. The active provider is shown during the audit.
+**Provider priority:** Anthropic > OpenAI > OpenRouter > Custom > Ollama. Override with `--provider=<name>`.
 
-**OpenRouter model selection:** By default, OpenRouter uses `anthropic/claude-sonnet-4`. Override with:
+**OpenRouter model selection:** By default uses `anthropic/claude-sonnet-4`. Override with:
 ```bash
 export OPENROUTER_MODEL=google/gemini-2.5-pro    # or any model on openrouter.ai
 ```
 
+**Local with Ollama (free, no API key):**
+```bash
+export OLLAMA_MODEL=llama3.1          # or qwen2.5-coder, deepseek-r1, etc.
+agentaudit audit https://github.com/owner/repo
+```
+> Note: Local models produce lower quality audits than Claude/GPT-4o. Use for quick checks, not production security audits.
+
+**Any OpenAI-compatible API:**
+```bash
+export LLM_API_URL=http://localhost:1234/v1     # LM Studio, vLLM, etc.
+export LLM_MODEL=my-model
+agentaudit audit https://github.com/owner/repo
+```
+
+**Check your setup:**
+```bash
+agentaudit status    # validates all configured API keys
+```
+
 **Troubleshooting:** If you see `API error: Incorrect API key`, double-check your key is valid and has credits. Use `--debug` to see the full API response.
 
 ### What data is sent externally?

package/cli.mjs

@@ -28,22 +28,31 @@ const REGISTRY_URL = 'https://agentaudit.dev';
 
 // ── Provider resolution ────
 function resolveProvider(preferred, keys) {
+  const orModel = process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+  const ollamaModel = process.env.OLLAMA_MODEL || 'llama3.1';
+  const ollamaHost = process.env.OLLAMA_HOST || 'http://localhost:11434';
+  const customUrl = process.env.LLM_API_URL;
+  const customKey = process.env.LLM_API_KEY;
+  const customModel = process.env.LLM_MODEL || 'default';
+
   const providers = {
     anthropic: keys.anthropicKey ? { id: 'anthropic', label: 'Anthropic (Claude)', key: keys.anthropicKey } : null,
     openai: keys.openaiKey ? { id: 'openai', label: 'OpenAI (GPT-4o)', key: keys.openaiKey } : null,
-    openrouter: keys.openrouterKey ? { id: 'openrouter', label: `OpenRouter (${process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4'})`, key: keys.openrouterKey } : null,
+    openrouter: keys.openrouterKey ? { id: 'openrouter', label: `OpenRouter (${orModel})`, key: keys.openrouterKey } : null,
+    ollama: process.env.OLLAMA_MODEL || process.env.OLLAMA_HOST ? { id: 'ollama', label: `Ollama (${ollamaModel})`, key: null, host: ollamaHost, model: ollamaModel } : null,
+    custom: customUrl ? { id: 'custom', label: `Custom (${customModel})`, key: customKey, url: customUrl, model: customModel } : null,
   };
   // Aliases
-  const aliases = { claude: 'anthropic', gpt: 'openai', 'gpt-4o': 'openai', 'gpt4': 'openai', or: 'openrouter' };
+  const aliases = { claude: 'anthropic', gpt: 'openai', 'gpt-4o': 'openai', 'gpt4': 'openai', or: 'openrouter', local: 'ollama' };
 
   if (preferred) {
     const resolved = aliases[preferred] || preferred;
     const p = providers[resolved];
-    if (!p) return null; // requested provider not available
+    if (!p) return null;
     return p;
   }
-  // Auto-detect: Anthropic > OpenAI > OpenRouter
-  return providers.anthropic || providers.openai || providers.openrouter || null;
+  // Auto-detect priority: Anthropic > OpenAI > OpenRouter > Custom > Ollama (local last — usually weaker)
+  return providers.anthropic || providers.openai || providers.openrouter || providers.custom || providers.ollama || null;
 }
 
 // ── Global flags (set in main before command routing) ────
@@ -1344,10 +1353,14 @@ async function auditRepo(url) {
   if (!resolvedProvider) {
     // No LLM API key — clear explanation
     console.log();
-    console.log(`  ${c.yellow}No LLM API key found.${c.reset} The ${c.bold}audit${c.reset} command needs an LLM to analyze code.`);
+    console.log(`  ${c.yellow}No LLM provider configured.${c.reset} The ${c.bold}audit${c.reset} command needs an LLM to analyze code.`);
     console.log();
-    console.log(`  ${c.bold}Option 1: Set an API key${c.reset}`);
-    console.log(`  Supported keys: ${c.cyan}ANTHROPIC_API_KEY${c.reset}, ${c.cyan}OPENAI_API_KEY${c.reset}, or ${c.cyan}OPENROUTER_API_KEY${c.reset}`);
+    console.log(`  ${c.bold}Option 1: Set an API key${c.reset} ${c.dim}(any one of these)${c.reset}`);
+    console.log(`  ${c.cyan}ANTHROPIC_API_KEY${c.reset}    Anthropic Claude ${c.dim}(recommended)${c.reset}`);
+    console.log(`  ${c.cyan}OPENAI_API_KEY${c.reset}       OpenAI GPT-4o`);
+    console.log(`  ${c.cyan}OPENROUTER_API_KEY${c.reset}   OpenRouter ${c.dim}(200+ models)${c.reset}`);
+    console.log(`  ${c.cyan}OLLAMA_MODEL${c.reset}         Ollama ${c.dim}(local, free, set model name)${c.reset}`);
+    console.log(`  ${c.cyan}LLM_API_URL${c.reset}          Any OpenAI-compatible API ${c.dim}(+ LLM_API_KEY, LLM_MODEL)${c.reset}`);
     console.log();
     console.log(`  ${c.dim}# Linux / macOS:${c.reset}`);
     console.log(`  ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
@@ -1451,19 +1464,33 @@ async function auditRepo(url) {
       _lastLlmText = text;
       report = extractJSON(text);
     } else {
-      // OpenAI or OpenRouter (both use OpenAI-compatible API)
-      const isOpenRouter = resolvedProvider.id === 'openrouter';
-      const apiUrl = isOpenRouter ? 'https://openrouter.ai/api/v1/chat/completions' : 'https://api.openai.com/v1/chat/completions';
-      const modelName = isOpenRouter ? (process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4') : 'gpt-4o';
-      const extraHeaders = isOpenRouter ? { 'HTTP-Referer': 'https://agentaudit.dev', 'X-Title': 'AgentAudit' } : {};
+      // OpenAI, OpenRouter, Ollama, or Custom (all use OpenAI-compatible chat completions API)
+      let apiUrl, modelName, authHeaders;
+      switch (resolvedProvider.id) {
+        case 'openrouter':
+          apiUrl = 'https://openrouter.ai/api/v1/chat/completions';
+          modelName = process.env.OPENROUTER_MODEL || 'anthropic/claude-sonnet-4';
+          authHeaders = { 'Authorization': `Bearer ${resolvedProvider.key}`, 'HTTP-Referer': 'https://agentaudit.dev', 'X-Title': 'AgentAudit' };
+          break;
+        case 'ollama':
+          apiUrl = `${resolvedProvider.host}/v1/chat/completions`;
+          modelName = resolvedProvider.model;
+          authHeaders = {};
+          break;
+        case 'custom':
+          apiUrl = resolvedProvider.url.endsWith('/chat/completions') ? resolvedProvider.url : `${resolvedProvider.url.replace(/\/$/, '')}/chat/completions`;
+          modelName = resolvedProvider.model;
+          authHeaders = resolvedProvider.key ? { 'Authorization': `Bearer ${resolvedProvider.key}` } : {};
+          break;
+        default: // openai
+          apiUrl = 'https://api.openai.com/v1/chat/completions';
+          modelName = 'gpt-4o';
+          authHeaders = { 'Authorization': `Bearer ${resolvedProvider.key}` };
+      }
 
       const res = await fetch(apiUrl, {
         method: 'POST',
-        headers: {
-          'Authorization': `Bearer ${resolvedProvider.key}`,
-          'Content-Type': 'application/json',
-          ...extraHeaders,
-        },
+        headers: { 'Content-Type': 'application/json', ...authHeaders },
         body: JSON.stringify({
           model: modelName,
           max_tokens: 8192,
@@ -1472,7 +1499,7 @@ async function auditRepo(url) {
             { role: 'user', content: userMessage },
           ],
         }),
-        signal: AbortSignal.timeout(120_000),
+        signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 120_000), // Ollama: 5min (local can be slow)
       });
       const data = await res.json();
       if (data.error) {
@@ -1706,19 +1733,14 @@ async function main() {
     console.log(`    agentaudit audit https://github.com/owner/repo`);
     console.log(`    agentaudit lookup fastmcp --json`);
     console.log();
-    console.log(`  ${c.bold}For deep audits,${c.reset} set an LLM API key (any one):`);
-    if (process.platform === 'win32') {
-      console.log(`    ${c.dim}PowerShell:  $env:ANTHROPIC_API_KEY = "sk-ant-..."${c.reset}`);
-      console.log(`    ${c.dim}             $env:OPENAI_API_KEY = "sk-..."${c.reset}`);
-      console.log(`    ${c.dim}             $env:OPENROUTER_API_KEY = "sk-or-..."${c.reset}`);
-      console.log(`    ${c.dim}CMD:         set ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
-      console.log(`    ${c.dim}             set OPENAI_API_KEY=sk-...${c.reset}`);
-      console.log(`    ${c.dim}             set OPENROUTER_API_KEY=sk-or-...${c.reset}`);
-    } else {
-      console.log(`    ${c.dim}export ANTHROPIC_API_KEY=sk-ant-...${c.reset}`);
-      console.log(`    ${c.dim}export OPENAI_API_KEY=sk-...${c.reset}`);
-      console.log(`    ${c.dim}export OPENROUTER_API_KEY=sk-or-...${c.reset}    ${c.dim}(200+ models, set OPENROUTER_MODEL to pick)${c.reset}`);
-    }
+    console.log(`  ${c.bold}For deep audits,${c.reset} set an LLM provider (any one):`);
+    console.log(`    ${c.dim}ANTHROPIC_API_KEY     Anthropic Claude (recommended)${c.reset}`);
+    console.log(`    ${c.dim}OPENAI_API_KEY        OpenAI GPT-4o${c.reset}`);
+    console.log(`    ${c.dim}OPENROUTER_API_KEY    200+ models (+ OPENROUTER_MODEL)${c.reset}`);
+    console.log(`    ${c.dim}OLLAMA_MODEL          Local Ollama (+ OLLAMA_HOST)${c.reset}`);
+    console.log(`    ${c.dim}LLM_API_URL           Any OpenAI-compatible API (+ LLM_API_KEY, LLM_MODEL)${c.reset}`);
+    console.log();
+    console.log(`  ${c.dim}Run ${c.cyan}agentaudit status${c.dim} to check your configured providers.${c.reset}`);
     console.log();
     console.log(`  ${c.bold}Or use as MCP server${c.reset} in Cursor/Claude ${c.dim}(no extra API key needed):${c.reset}`);
     console.log(`    ${c.dim}Add to your MCP config:${c.reset}`);
@@ -1746,10 +1768,16 @@ async function main() {
       openaiKey: process.env.OPENAI_API_KEY,
       openrouterKey: process.env.OPENROUTER_API_KEY,
     };
+    const ollamaHost = process.env.OLLAMA_HOST || 'http://localhost:11434';
+    const ollamaModel = process.env.OLLAMA_MODEL;
+    const customUrl = process.env.LLM_API_URL;
+
     const checks = [
       { name: 'Anthropic', env: 'ANTHROPIC_API_KEY', key: keys.anthropicKey, testUrl: 'https://api.anthropic.com/v1/messages', testHeaders: (k) => ({ 'x-api-key': k, 'anthropic-version': '2023-06-01', 'content-type': 'application/json' }), testBody: JSON.stringify({ model: 'claude-sonnet-4-20250514', max_tokens: 1, messages: [{ role: 'user', content: 'hi' }] }) },
       { name: 'OpenAI', env: 'OPENAI_API_KEY', key: keys.openaiKey, testUrl: 'https://api.openai.com/v1/models', testHeaders: (k) => ({ 'Authorization': `Bearer ${k}` }), testBody: null },
       { name: 'OpenRouter', env: 'OPENROUTER_API_KEY', key: keys.openrouterKey, testUrl: 'https://openrouter.ai/api/v1/models', testHeaders: (k) => ({ 'Authorization': `Bearer ${k}` }), testBody: null },
+      { name: 'Ollama', env: 'OLLAMA_MODEL', key: ollamaModel, testUrl: `${ollamaHost}/api/tags`, testHeaders: () => ({}), testBody: null },
+      { name: 'Custom', env: 'LLM_API_URL', key: customUrl, testUrl: customUrl ? `${customUrl.replace(/\/$/, '')}/models` : null, testHeaders: (k) => process.env.LLM_API_KEY ? ({ 'Authorization': `Bearer ${process.env.LLM_API_KEY}` }) : {}, testBody: null },
     ];
 
     for (const p of checks) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.18",
+  "version": "3.9.19",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {