Skip to content

Configuration

Sean edited this page Sep 24, 2026 · 1 revision

Configuration

Add a model connection

Agent B ships with no saved model connections. Open Settings → Add connection and choose a provider.

OpenAI

  • API base: https://api.openai.com/v1
  • Model ID: the exact hosted model identifier
  • Credential: an OpenAI API key

Anthropic

  • API base: https://api.anthropic.com/v1
  • Model ID: the exact Claude model identifier
  • Credential: an Anthropic API key

Amazon Bedrock

  • Region: the AWS region used by the runtime endpoint
  • Model ID: the exact model or inference-profile identifier
  • Credential: a Bedrock bearer API key

Agent B uses the provider-neutral Converse API. Account and regional availability still determine which model IDs work.

Local / OpenAI-compatible

Use this option for Ollama, LM Studio, vLLM, oMLX, Splash, llama.cpp, or another server exposing compatible /models and /chat/completions routes.

Typical API base:

http://127.0.0.1:8000/v1

Use the exact model ID returned by the server's /models endpoint. Enable Supports thinking control only when the server accepts chat_template_kwargs.enable_thinking.

Credential behavior

  • Each connection owns its credential.
  • A credential is never copied to another connection.
  • Public settings responses expose only a boolean indicating whether a key is set.
  • Settings are written with owner-only permissions.
  • Agent B redacts bearer credentials before saving transcript events.

Agent A connection

The default API URL is:

http://127.0.0.1:8777

Keep this endpoint on loopback. Agent B accepts only loopback Agent A URLs.

Methodology skills

Skills add focused methodology to a run without changing Burp's scope or safety controls. Select only what is relevant. A no-skill run is useful as an evaluation control.

Environment overrides

  • DOUBLE_AGENT_URL
  • AGENT_B_DATA_DIR
  • AGENT_B_MODEL_URL
  • AGENT_B_MODEL_API_KEY
  • AGENT_B_MODEL
  • AGENT_B_MODEL_AUTH_FILE
  • AWS_REGION
  • AWS_BEARER_TOKEN_BEDROCK

Avoid environment overrides for routine multi-provider use; saved connections provide stronger credential isolation.

Clone this wiki locally