> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/configuration-center/ai-model-configuration.md). # AI Model Configuration On the AI Model Configuration page you connect and manage the AI providers and models that the AI Assistant uses. Open it from **Configuration Center > AI > Manage** (the card requires the **ReadAIConfiguration** permission). You can add cloud-based or self-hosted AI providers, select which models are available to the Assistant, and control which tools and data each provider is allowed to use. {% hint style="info" %} Provider configurations are **per user**. The providers, API keys and model selections you add are visible and usable only in your own account. Other users, including administrators, do not see them and must add their own providers. {% endhint %}

AI Model Configuration page with no provider configured — AI Model Configuration Page

When no provider is configured, the page shows **Set up your AI assistant** with an **Add your first provider** button. Once providers exist, the **Providers** section shows a summary such as `2 configured · 1 active`, an **Add provider** button and one card per provider. ### Adding an AI Provider To use the AI Assistant, at least one AI provider and model must be configured. Click **Add provider** to start the **Add an AI provider** wizard. The wizard has four steps: **Choose provider**, **Connect**, **Select models** and **Data access**. #### 1. Choose provider Select the AI provider you want to connect. Both cloud-based and self-hosted providers are supported. Providers you have already added are marked with a **Configured** badge.

Provider	Type
OpenAI	Cloud
DeepSeek	Cloud
Anthropic	Cloud
OpenCode Go	Cloud
OpenCode Zen	Cloud
Ollama	Self-hosted
vLLM	Self-hosted
LM Studio	Self-hosted
LocalAI	Self-hosted

Choose provider step — Choose a provider

Cloud providers process AI requests in an external service. Self-hosted providers run the models on infrastructure that your organization manages. #### 2. Connect After selecting a provider, enter the information required to establish the connection: * **Display name**: the name shown for this provider in Forestall. * **API key**: for cloud providers. * **Server URL**: for self-hosted providers, the address where the AI service is running.

Click **Connect & discover models** to validate the connection and retrieve the models available from the selected provider. The connection is validated before the provider is saved. If the credentials or server address are invalid, an error is shown, and you can correct the connection information before continuing. #### 3. Select models After a successful connection, the models discovered from the provider are listed. Choose which models should be available to users in the AI Assistant.

Enable only the models you want users to see. The enabled models appear in the AI Assistant model selector after the provider configuration is saved. #### 4. Data access The Data access step determines which Forestall tools (MCP tools) the model may call when answering questions. The tools are listed in two groups: | Tool group | Description | | ----------------------------- | --------------------------------------------------------------------------------------------------------- | | **Documentation tools** | Answers from Forestall documentation. No scan results, vulnerabilities, or environment data are involved. | | **Forestall live data tools** | Read live scans, vulnerability findings, AD/AWS/GCP entities, attack paths, and environment data. |

Data access with the Documentation tools and Forestall live data tools groups

Each group has a checkbox that selects or clears all of its tools and shows how many are selected (for example `6/6`). Click a group to expand it and select individual tools.

Documentation tools group expanded — Documentation tools

The resulting data access is summarized with a badge on the review panel and on the provider card: * **Docs only**: only documentation tools are enabled. This is the default. The Assistant can explain how a feature works, explain a finding or give general remediation guidance, but cannot retrieve live scan or entity data. * **Full access**: all documentation and live data tools are enabled. * **N tools**: a custom selection of individual tools (for example `12 tools`). Use it when a provider needs access to specific areas of Forestall without the complete set of live data.

Custom tool selection: 2 of the live data tools selected — Custom tool selection

When you enable live data tools for a **cloud** provider, the **Enable live data tools?** window opens. It warns that the selected tools will send live scan results, vulnerability findings and other environment data to the provider's API, and recommends a local model if you need live data. Click **Enable selected tools** to confirm or **Cancel** to keep them disabled. The window is not shown for self-hosted providers.

Enable live data tools? confirmation window — Enable live data tools?

### Save the Provider The last step shows a **Review** panel with the **Provider**, **Server** (self-hosted providers), **Models enabled** (`X of Y`) and **Data access** badge. Click **Add provider** to save. The configured provider is then displayed on the **AI Model Configuration** page and its enabled models become available in the AI Assistant.

Each provider card shows the display name, the provider type, an **Active** / **Off** status, a **Cloud** / **Local** badge, the data access badge, the masked API key (for example `sk-e...lGuI`) or server URL, and **Manage provider**. The three-dot menu offers **Manage provider**, **Disable** / **Enable** and **Delete**. You can add several providers to your account, for example to use different models with different data access settings. ## Managing an AI Provider Open a configured provider (**Manage provider**) to update its models, data access settings, connection information, or availability. The page has three sections: **Models**, **Data access** and **Settings**. ### Models The **Models** section shows the models currently available from the provider. Click **Refresh** to discover the models again, change which models are enabled, and click **Save changes**. Disabling a model removes it from the Assistant model selector without removing the provider configuration. ### Data access The **Data access** section shows the same **Documentation tools** and **Forestall live data tools** groups as the wizard. You can switch between docs-only access, full access, or a custom selection of tools. For cloud providers, enabling live data tools asks for confirmation again. Changes to data access affect future AI Assistant requests made with models from that provider. ### Settings The **Settings** section contains the connection details and the provider lifecycle. Depending on the provider type, you can update the **Display name**, the **API key** or the **Server URL**, then click **Save changes**. Stored API keys are not displayed in full after they have been saved. Leave the **API key** field blank to keep the existing key. Enter a new key only if it needs to be changed. ### Enabling or Disabling a Provider A provider can be disabled without deleting its configuration, either from the card's three-dot menu or from **Settings** (**Disable provider**). When a provider is disabled, its models are no longer available for selection in the AI Assistant. The provider can be enabled again later without recreating the configuration. ### Deleting a Provider To remove a provider, use the card's three-dot menu or **Settings** (**Delete provider**), then confirm with **Delete Provider**. Deleting a provider removes its configuration and all its model settings, and prevents its models from being used in future AI Assistant conversations. This cannot be undone. ## Data Privacy and External Providers The data sent by the AI Assistant depends on the tools enabled for the selected provider. With **Docs only**, the model cannot call live data tools, so live environment data is not made available to it. With **Full access** or a custom selection that includes live data tools, information retrieved from the Forestall environment may be sent to the selected AI provider when it is required to answer a question. With a cloud provider, the permitted data can leave the Forestall environment and is processed by the external AI service. With a self-hosted provider, the model runs on infrastructure that your organization controls. > **Note:** Documentation and finding searches may use a separate embedding service to process the search phrase, including when a self-hosted model is selected.