AI Model Configuration
On the AI Model Configuration page you connect and manage the AI providers and models that the AI Assistant uses. Open it from Configuration Center > AI > Manage (the card requires the ReadAIConfiguration permission).
You can add cloud-based or self-hosted AI providers, select which models are available to the Assistant, and control which tools and data each provider is allowed to use.
When no provider is configured, the page shows Set up your AI assistant with an Add your first provider button. Once providers exist, the Providers section shows a summary such as 2 configured · 1 active, an Add provider button and one card per provider.
Adding an AI Provider
To use the AI Assistant, at least one AI provider and model must be configured.
Click Add provider to start the Add an AI provider wizard. The wizard has four steps: Choose provider, Connect, Select models and Data access.
1. Choose provider
Select the AI provider you want to connect.
Both cloud-based and self-hosted providers are supported. Providers you have already added are marked with a Configured badge.
OpenAI
Cloud
DeepSeek
Cloud
Anthropic
Cloud
OpenCode Go
Cloud
OpenCode Zen
Cloud
Ollama
Self-hosted
vLLM
Self-hosted
LM Studio
Self-hosted
LocalAI
Self-hosted
Cloud providers process AI requests in an external service. Self-hosted providers run the models on infrastructure that your organization manages.
2. Connect
After selecting a provider, enter the information required to establish the connection:
Display name: the name shown for this provider in Forestall.
API key: for cloud providers.
Server URL: for self-hosted providers, the address where the AI service is running.
Click Connect & discover models to validate the connection and retrieve the models available from the selected provider.
The connection is validated before the provider is saved. If the credentials or server address are invalid, an error is shown, and you can correct the connection information before continuing.
3. Select models
After a successful connection, the models discovered from the provider are listed.
Choose which models should be available to users in the AI Assistant.
Enable only the models you want users to see.
The enabled models appear in the AI Assistant model selector after the provider configuration is saved.
4. Data access
The Data access step determines which Forestall tools (MCP tools) the model may call when answering questions. The tools are listed in two groups:
Documentation tools
Answers from Forestall documentation. No scan results, vulnerabilities, or environment data are involved.
Forestall live data tools
Read live scans, vulnerability findings, AD/AWS/GCP entities, attack paths, and environment data.
Each group has a checkbox that selects or clears all of its tools and shows how many are selected (for example 6/6). Click a group to expand it and select individual tools.
The resulting data access is summarized with a badge on the review panel and on the provider card:
Docs only: only documentation tools are enabled. This is the default. The Assistant can explain how a feature works, explain a finding or give general remediation guidance, but cannot retrieve live scan or entity data.
Full access: all documentation and live data tools are enabled.
N tools: a custom selection of individual tools (for example
12 tools). Use it when a provider needs access to specific areas of Forestall without the complete set of live data.
When you enable live data tools for a cloud provider, the Enable live data tools? window opens. It warns that the selected tools will send live scan results, vulnerability findings and other environment data to the provider's API, and recommends a local model if you need live data. Click Enable selected tools to confirm or Cancel to keep them disabled. The window is not shown for self-hosted providers.
Save the Provider
The last step shows a Review panel with the Provider, Server (self-hosted providers), Models enabled (X of Y) and Data access badge. Click Add provider to save.
The configured provider is then displayed on the AI Model Configuration page and its enabled models become available in the AI Assistant.
Each provider card shows the display name, the provider type, an Active / Off status, a Cloud / Local badge, the data access badge, the masked API key (for example sk-e...lGuI) or server URL, and Manage provider. The three-dot menu offers Manage provider, Disable / Enable and Delete.
You can add several providers to your account, for example to use different models with different data access settings.
Managing an AI Provider
Open a configured provider (Manage provider) to update its models, data access settings, connection information, or availability. The page has three sections: Models, Data access and Settings.
Models
The Models section shows the models currently available from the provider.
Click Refresh to discover the models again, change which models are enabled, and click Save changes.
Disabling a model removes it from the Assistant model selector without removing the provider configuration.
Data access
The Data access section shows the same Documentation tools and Forestall live data tools groups as the wizard. You can switch between docs-only access, full access, or a custom selection of tools. For cloud providers, enabling live data tools asks for confirmation again.
Changes to data access affect future AI Assistant requests made with models from that provider.
Settings
The Settings section contains the connection details and the provider lifecycle.
Depending on the provider type, you can update the Display name, the API key or the Server URL, then click Save changes.
Stored API keys are not displayed in full after they have been saved. Leave the API key field blank to keep the existing key. Enter a new key only if it needs to be changed.
Enabling or Disabling a Provider
A provider can be disabled without deleting its configuration, either from the card's three-dot menu or from Settings (Disable provider).
When a provider is disabled, its models are no longer available for selection in the AI Assistant. The provider can be enabled again later without recreating the configuration.
Deleting a Provider
To remove a provider, use the card's three-dot menu or Settings (Delete provider), then confirm with Delete Provider.
Deleting a provider removes its configuration and all its model settings, and prevents its models from being used in future AI Assistant conversations. This cannot be undone.
Data Privacy and External Providers
The data sent by the AI Assistant depends on the tools enabled for the selected provider.
With Docs only, the model cannot call live data tools, so live environment data is not made available to it. With Full access or a custom selection that includes live data tools, information retrieved from the Forestall environment may be sent to the selected AI provider when it is required to answer a question.
With a cloud provider, the permitted data can leave the Forestall environment and is processed by the external AI service. With a self-hosted provider, the model runs on infrastructure that your organization controls.
Note: Documentation and finding searches may use a separate embedding service to process the search phrase, including when a self-hosted model is selected.
Last updated
Was this helpful?