Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Environment Variables

Environment variables override stored configuration values.

Authentication & API

VariableDescriptionDefault
PRETORIN_API_KEYAPI key for platform access. Overrides api_key in config file.—
PRETORIN_PLATFORM_API_BASE_URLPlatform REST API base URLhttps://platform.pretorin.com/api/v1/public
PRETORIN_API_BASE_URLBackward-compatible alias for PRETORIN_PLATFORM_API_BASE_URL—
PRETORIN_MODEL_API_BASE_URLModel API URL for agent runtimehttps://platform.pretorin.com/api/v1/public/model

Context

VariableDescriptionDefault
PRETORIN_SYSTEM_IDActive system ID. Overrides the system set via pretorin context set.—
PRETORIN_FRAMEWORK_IDActive framework ID. Overrides the framework set via pretorin context set.—

Agent Runtime

VariableDescriptionDefault
OPENAI_API_KEYModel key for agent runtime. Used as a fallback when config.api_key (from pretorin login) is unset, and as the preferred key when --base-url points the agent at a non-platform endpoint.—
OPENAI_BASE_URLBase URL for the model API endpoint. Overrides openai_base_url in config file.—
OPENAI_MODELModel name for the agent runtime.gpt-4o

Source Attestation

VariableDescriptionDefault
PRETORIN_SOURCE_PROVIDERSJSON array of source provider configurations. Overrides source_providers in config file.—
PRETORIN_SOURCE_MANIFESTJSON string or file path to a source manifest. Falls back to .pretorin/source-manifest.json in the git repo root, then ~/.pretorin/source-manifest-{system_id}.json, then the source_manifest config key.—

Behavior

VariableDescriptionDefault
PRETORIN_DISABLE_UPDATE_CHECKSet to a truthy value (1, true, yes, on) to disable passive update notifications.—
PRETORIN_LOG_LEVELLogging level (DEBUG, INFO, WARNING, ERROR)WARNING
PRETORIN_MCP_TELEMETRY_DISABLEDSet to any non-empty value to suppress the PRETORIN_TELEMETRY_EVENT JSON lines that pretorin mcp-serve emits on stderr for tool-routing observability.—
PRETORIN_MCP_MAX_RESULT_BYTESByte budget for a single serialized MCP tool result before the response guard compacts it. Raise it for hosts that tolerate larger tool payloads. A malformed or non-positive value falls back to the default.40000

Cloud Scanner Recipes

These are standard cloud-provider SDK environment variables. Pretorin’s bundled asset-inventory recipes honor them when scanning AWS/Azure.

VariableDescriptionDefault
AWS_REGIONSingle AWS region to scan for the asset-inventory-aws-baseline recipe. When unset, the recipe enumerates all regions the account has opted into and scans them concurrently. AWS_DEFAULT_REGION is honored as a fallback.—
AWS_DEFAULT_REGIONFallback region used by the asset-inventory-aws-baseline recipe when AWS_REGION is unset. Standard boto3 variable.—
AZURE_SUBSCRIPTION_IDSubscription ID used by the asset-inventory-azure-baseline recipe. When unset, the recipe falls back to the default subscription from az account show.—

Recipe Authoring

VariableDescriptionDefault
USERFallback author name written into the frontmatter of recipes scaffolded with pretorin recipe new. Used only when git config user.name is unavailable.unknown

Precedence

For the API key:

  1. PRETORIN_API_KEY environment variable (highest)
  2. api_key in ~/.pretorin/config.json

For the platform API URL:

  1. PRETORIN_PLATFORM_API_BASE_URL environment variable (highest)
  2. PRETORIN_API_BASE_URL environment variable (legacy alias)
  3. platform_api_base_url in ~/.pretorin/config.json
  4. api_base_url in ~/.pretorin/config.json (legacy)
  5. https://platform.pretorin.com/api/v1/public default

For the model key (agent runtime):

  1. config.api_key (from pretorin login) — used as bearer key for the platform model proxy
  2. OPENAI_API_KEY environment variable
  3. config.openai_api_key

When --base-url is explicitly provided (i.e. pointing the agent at a non-platform endpoint), the order flips to prefer OPENAI_API_KEY first, then falls back to config keys.

For the model name:

  1. OPENAI_MODEL environment variable (highest)
  2. openai_model in ~/.pretorin/config.json
  3. Org AI settings from the platform (cached)
  4. gpt-4o default

For the source manifest:

  1. PRETORIN_SOURCE_MANIFEST environment variable (highest) — JSON string or file path
  2. .pretorin/source-manifest.json in the git repo root
  3. ~/.pretorin/source-manifest-{system_id}.json
  4. source_manifest key in ~/.pretorin/config.json

CI/CD Example

export PRETORIN_API_KEY=pretorin_your_key_here
export PRETORIN_DISABLE_UPDATE_CHECK=1
export PRETORIN_SYSTEM_ID=your_system_id

pretorin frameworks list
pretorin evidence push