Built-in
Hilbras AI is configured server-side with HILBRAS_AI_API_KEY or NVIDIA_API_KEY. Its endpoint and model are managed by the server and are not shown in the interface. Users can select it but cannot edit or remove it.
Your providers
Add any OpenAI-compatible or Anthropic-compatible provider in Settings → AI providers. Keys are encrypted at rest.
SSRF protection
Provider base URLs are resolved and checked before every request. Private, loopback, link-local, CGNAT, and metadata addresses are refused, including DNS rebinding. There is no development escape hatch.