# AI providers and cost

> Connect AI models, route each AI task to a model for the system or one team, keep code on-premise, and track AI cost.

Source: https://scansuite.eu/documentation/usage/ai-providers
Last reviewed: 2026-10-19

Every AI feature runs on models you connect here: AI Native SAST, dependency checks, secrets verification, proof-of-concept generation, the AI Pentest, AI DAST and drafting custom rules. Until a model answers the default route, AI scans cannot start.

The setup has three parts, in this order:

| Card | What it holds |
|---|---|
| AI connections | Where requests go: an endpoint and its key. One connection can carry several models. |
| AI models | A model on a connection, with how it is asked: its reasoning level, output and context limits, and whether it can call tools. |
| Task routing | Which model answers each AI task, and which models take over when it does not answer. |

A fourth card, **AI usage by task**, shows what each task has spent.

## System AI and a team's own models

The same four cards appear in two places:

| Scope | Where | Who sets it up | Who uses it |
|---|---|---|---|
| System AI | System Settings → Shared services | A system administrator | Every team, unless the team chooses otherwise. Teams see the system models by name only, never the connection, endpoint or key behind them. |
| A team's own models | Teams → AI tab | A team admin | That team only. |

On the team's **AI** tab, the **AI provider** card has one field, **Use**:

| Choice | Effect | When to choose it |
|---|---|---|
| The system AI, set up by a system administrator | The default for a new team. The team uses the system models. The Task routing card shows them by name, read-only. If no system AI is set up, the team has no AI. | Most teams. |
| This team's own models | The team adds its own connections and models and routes its own tasks. The system AI is never used for this team, not even when the team's models fail. | The team must keep code with its own provider, or pay for AI separately. |
| No AI: turn AI features off for this team | AI scans, verification and proof-of-concept generation stop. Classic scanners still run. | A team that must not send anything to a model. |

Click **Save** after changing it. Only team admins can change the team's AI; other members see the settings read-only. A team's models never fall back to the system's, and the system's never fall back to a team's.

> **Saving needs a recent sign-in:** Changing a connection, model or route asks you to sign in again if your session is not fresh: *Sign in again to change the AI settings.* Scans already queued keep the AI configuration they started with; a change applies to new scans only.

## Connect your first AI provider

This sets up the system AI, which every team uses by default. To give one team its own models instead, do the same steps on **Teams → AI** after setting **Use** to **This team's own models** and clicking **Save**.

### Before you start

| Prerequisite | How to check it |
|---|---|
| A system administrator account | The sidebar shows System Settings under Admin. |
| An endpoint the server can reach | From the server, curl -sS -o /dev/null -w "%{http_code}" <YOUR_AI_URL>/models prints an HTTP status code (200 or 401), not a connection error. |
| A key for that endpoint | Created in your provider's console. For Vertex AI, a service account key in JSON with access to the Claude models. |
| The model ID | As the provider names it, for example gpt-4o or claude-sonnet-4-6. For Azure OpenAI, the deployment name. |

| Placeholder | What it is | Where it comes from |
|---|---|---|
| <YOUR_AI_URL> | The OpenAI-compatible base address, for example https://api.openai.com/v1 or http://llm.internal.example.com:8000/v1. Leave it empty for the OpenAI API itself. | Your provider's documentation, or whoever runs the model server. |
| <YOUR_MODEL_ID> | The model the provider serves. | Your provider's model list; for Azure OpenAI, the deployment name. |
| <YOUR_API_KEY> | The key for the endpoint. | Your provider's console. Typed by a person into the form, never pasted into a chat. |

### Steps

1. Open **System Settings** (sidebar, Admin) and the **Shared services** tab.

   *Check:* the **System AI**, **Task routing**, **AI connections** and **AI models** cards are shown. Task routing says *No model answers the default route yet: AI scans cannot start until one does.*
2. In **AI connections**, click **Add connection**. Enter a **Name** (for example `Main`), choose the **Kind** (**OpenAI-compatible** or **Vertex AI (Claude)**) and fill in the fields of that kind (see [Connection fields](https://scansuite.eu/documentation/usage/ai-providers#connection-fields)).
3. > **A person does this step:** A person types the API key or pastes the service account key into the form. An OpenAI-compatible server at its own API URL that takes no key, such as vLLM or Ollama inside the network, is saved with the key left empty.
   >
   > An agent following this page stops here and asks the person to do it; it never asks for the key in the chat.
4. Click **Save**.

   *Check:* the connection is listed with *Key saved*, or *No key* for a server without one.
5. In **AI models**, click **Add model**. Enter a **Name** (for example `Strong`), choose the **Connection** you just saved, enter the **Model ID**, and click **Save**.

   *Check:* the model is listed as *Usable*, and the Task routing card now shows it on the **Default** row. The first model you add answers the default route, which every task falls back to.
6. Click **Test** beside the model.

   *Check:* it says *Answered in N s* followed by the model's reply.
7. In the **System AI** card, click **Test connection**.

   *Check:* it says *The system AI answered.*

Every team that uses the system AI can now run AI scans. A team admin can confirm it for one team with **Teams → AI → Test connection**: *AI answered, using the system AI.*

### If it does not work

| What you see | What to do |
|---|---|
| The connection is refused on Save: needs its own key | The public OpenAI API (API URL left empty) and Vertex AI need a key; Vertex AI in System Settings can use the deployment's own identity instead. Enter the key, or the API URL of your own server. |
| An OpenAI-compatible URL must be an HTTP or HTTPS address | Enter the full base address with http:// or https://. A user name or password in the address, a query string and a #fragment are refused. |
| Test says No answer | Check the Model ID, the key, and that the server can reach the endpoint (the curl check above). The scan log of an AI scan gives the provider's error. |
| The model shows Cannot be used | Hover the label for the reason, for example a missing key or Google Cloud project ID, then edit the connection or model. |
| The system AI did not answer. Check the settings and the key. | The first model of the default route did not answer. Test each model on its own to find which one fails. |
| AI is not available for this team (team Test connection) | The team uses the system AI and none is set up, or the team's own models do not answer. |

## Connection fields

The **Add connection** form. Fields marked *system only* appear only in System Settings.

| Field | What it does | Default | When to change it |
|---|---|---|---|
| Name | A label for the connection, shown in the model form. | Empty, required | Name it after the endpoint, for example Azure prod. |
| Kind | OpenAI-compatible (OpenAI, Azure OpenAI, vLLM, Ollama, LM Studio, gateways) or Vertex AI (Claude) (Claude models on Google Cloud). | OpenAI-compatible | Choose Vertex AI (Claude) for Claude on Google Cloud. |
| API URL | OpenAI-compatible: the base address of the API. http:// and https:// are both accepted. | Empty: the OpenAI API | Any provider other than OpenAI itself. |
| API key | OpenAI-compatible: the key sent with each request. Stored encrypted and never shown again; leave it empty when editing to keep the saved one. | None | On the first save, unless the API URL points to a server that takes no key; to rotate a key. |
| Google Cloud project ID | Vertex AI: the project that serves the models. | Empty, required | Always for Vertex AI. |
| Vertex AI region | Vertex AI: the region of the endpoint. | global | When your Claude quota is in one region. |
| Service account key (JSON) | Vertex AI: the key of a service account allowed to call the models. Stored encrypted. | None | Always for Vertex AI, unless the system uses the deployment's identity. |
| Use the deployment's own identity (no key) | Vertex AI, system only: call Vertex AI as the service account the installation runs as, with no key stored. | Off | ScanSuite runs on Google Cloud with a service account that may call Vertex AI. |
| CA bundle path | System only: a PEM file of extra certificate authorities to trust for this endpoint, as a path inside the containers, for example /key/internal-ca.pem. | Empty: the standard authorities | An internal authority signed the endpoint's certificate, or a proxy inspects TLS. |
| Requests at once, all scans | How many requests every running scan together may send to this connection at the same time. 0 to 64. | 0: no cap | The provider rate-limits you, or a local server overloads. |
| In use | Unticked, the connection and its models are skipped. | On | To take an endpoint out of service without deleting it. |

## Model fields

| Field | What it does | Default | When to change it |
|---|---|---|---|
| Name | How the model is shown in routes, logs, usage and prices. Teams see a system model by this name only. | Empty, required | Name it by its role, for example Strong or Fast. |
| Connection | The connection the model is reached through. | The first connection | When you have several. |
| Model ID | The model as the provider knows it; for Azure OpenAI, the deployment name. | Empty, required | Always. |
| Reasoning | Auto sends no reasoning setting. Low, Medium and High ask for more reasoning (extended thinking for Claude). Off turns it off. | Auto | A reasoning model you want to make cheaper (Low) or more thorough (High). Keep Auto for models without reasoning, such as GPT-4o. |
| Maximum output tokens | The longest answer the model may write. | Empty: ScanSuite's default | The model allows longer answers and findings are cut short. |
| Context window, tokens | The largest request the model takes. A request clearly larger goes to the next model of its route. At least 1000. | Empty: no size check | Smaller local models, so that large files go to a model that fits them. |
| Requests at once | A cap for this model alone, under the connection's cap. 0 to 64. | 0: only the connection's cap | Providers that limit each model, such as Azure deployments. |
| Supports tool calling | Whether the model can call tools. Tasks marked as tool loops ask such models first. | On | Untick for a model without tool calling. |
| In use | Unticked, the model is skipped in every route. | On | To take a model out without deleting it. |

Each model in the list shows its status — *Usable*, *Cannot be used* (with the reason) or *Turned off* — how many routes use it, and **Test**, **Edit** and **Delete**.

## Task routing

The **Task routing** card lists the tasks with the model that answers each one, under **Answered by**. A route is a **First model** and, under **Then**, the models to try next when it does not answer.

- The **Default** route answers every task without a route of its own, and is every task's last fallback. It cannot be emptied once set.
- The feature rows are **AI SAST**, **Dependency checks**, **Secrets verification**, **PoC generation**, **AI pentest**, **AI DAST** and **Custom rules**. A feature without its own route uses the Default route.
- **Show the steps** expands a feature into its steps. Each step is marked *needs a strong model*, *a mid model is enough* or *a fast model is enough*; a step without its own route uses the feature's.
- A step marked *Tool loop* asks models with tool calling first.

To route a task, click **Change** on its row, pick the **First model** and any **Then** models, and click **Save**. **Use the route above** removes the task's own route again.

> **A practical split:** Start with one strong model on the Default route. Once **AI usage by task** shows where the tokens go, route the steps marked *a fast model is enough* to a cheaper model. Results and cost change; nothing else needs reconfiguring.

When a model does not answer the availability check at the start of a scan, it is set aside for that scan and the next model of the route answers instead. The scan log names the model that answered, and the scan page lists the model that answered each AI task. When no model of a step the scan cannot do without answers, the scan stops and its log gives the provider's error.

## AI usage by task

The **AI usage by task** card lists, per **Task** and **Model**, the **Requests**, **Tokens** and **Cost, USD** over every scan and page request. Cost appears once the model is priced (see Cost below). The tasks that spend most on a strong model are the ones worth trying on a cheaper one.

## Keeping code on-premise

AI Native SAST sends source code to the model, so this is the decision that matters most for static analysis.

> **Warning:** A cloud-hosted model means source code is sent to the provider. For sensitive code, connect an OpenAI-compatible model served inside your own network (vLLM, Ollama, LM Studio and similar). The rest of the platform works the same, fully offline.

- Plain `http://` addresses are accepted, for a model server inside your network. Over HTTP the key and the prompts, including source code, travel unencrypted: use it only on a network you trust.
- TLS verification cannot be turned off. If an internal certificate authority issued the model's certificate, or a proxy inspects TLS, put the model on the system AI and fill in **CA bundle path**: the system administrator copies the authority's PEM file to `/opt/scansuite/key` on the server and enters its path as the containers see it, for example `/key/internal-ca.pem`. Teams cannot name a CA bundle.

## Model choice

Results are written by the model, so they vary a little between runs. Larger models give more consistent results; for local models, 30B parameters is the practical floor if you want reproducible findings rather than suggestions.

## Cost

Token usage is counted per team, including usage through a team's own models. Two monthly limits apply, and the lower one wins:

| Limit | Where | Who sets it | Default |
|---|---|---|---|
| Tokens a month | Teams → AI → Monthly token budget | A team admin | Empty: no team limit |
| AI tokens a month | System Settings → Teams, the team's limits | A system administrator | Empty: no limit |

When the month's tokens are used up, AI features pause and AI scanners report that AI is unavailable until the next month or a higher limit. The **Monthly token budget** card shows what the team has used.

Spend is shown in US dollars once the models are priced. A system administrator fills in the **LLM prices** card under **System Settings → Shared services**: a JSON table keyed by model name, with the price per million prompt and completion tokens, for example `{"Strong (system)": {"prompt": 3, "completion": 15}}`. Use the names listed under **Models your teams used**; a system model is listed as teams see it. Scan History, the scan page, the Products pages, the **Top 10 LLM Token Consuming Targets** panel and AI usage by task then show the cost. Changing a price re-prices past scans; token counts never change.

| Feature | What drives its cost |
|---|---|
| AI Native SAST | Grows with the number of files in scope. Reachability analysis adds cost per finding. The scope is the main control. |
| Dependency reachability | Only dependency findings with exploitation evidence are analysed, so the cost follows the number of exploitable findings, not of dependencies. |
| Secrets verification | Cheap. |
| AI DAST and AI Pentest | Bounded by the scan's cycle and time budget. |

> **Tip:** Incremental Scan, Custom Scope and Monitor Changes on the Static Code Analysis page make a re-scan cost what the change costs rather than what the codebase costs.

## Other AI settings of a team

The **How AI handles findings** card on the team's **AI** tab holds two settings that team admins and operators can change:

| Setting | What it does | Default |
|---|---|---|
| Close findings that are verified as fixed | When a scan no longer reports an AI SAST finding, the finding is closed only with file and line evidence that the problem is gone. See [Rescans and fix verification](https://scansuite.eu/documentation/usage/vulnerability-management/rescans-and-fix-verification). | On |
| Language of AI-written text | The language of finding descriptions and proof-of-concept notes: English or Russian. | English |

## Where this fits

The other integrations of a team and the system — DefectDojo, Securitm, alerts, Nessus — are in [API keys for external systems](https://scansuite.eu/documentation/administration/configuring-api-keys-for-external-systems). Who may change what is in [Teams and roles](https://scansuite.eu/documentation/administration/teams-and-roles).