Run Strix, HackingBuddyGPT and PentestGPT on an API model: setup and cost

The open-source pentest agents need a model API, and the stock keys are the wrong fit for security prompts. On r/cybersecurity in September 2026 ("Best LLM for security professionals", 100+ comments) the top comment says Anthropic gates security work behind its Cyber Verification Program, announced 2026-10-06, and OpenAI does the same. Every setup guide for these tools still starts with an OpenAI key.

Each agent below takes an OpenAI-compatible base URL. Set it to https://api.uplinkswitch.com/v1, add an UplinkSwitch key, and name a model from the uncensored AI for cybersecurity table. The Red Team ids are the uncensored build with a short security-analyst instruction sent ahead of your messages: deliverable first, real tool invocations, CVE, CWE and ATT&CK IDs, evidence separated from inference, proof-of-concept code with the fix. The instruction is not charged and the agent's own system prompt follows it and wins on conflicts.

Three values. A key from the console (prepaid credit from $10, no subscription). The base URL https://api.uplinkswitch.com/v1, which is the OpenAI-compatible root; the chat path is /chat/completions under it. A model id: we use glm-5.3-redteam below, and the SDK guide shows the same three values in Python, TypeScript, Go and Rust.

Smoke test before the agent, so a wrong path fails here and not twenty turns in:

curl https://api.uplinkswitch.com/v1/chat/completions \
  -H "authorization: Bearer sk-uplink-live-..." \
  -H "content-type: application/json" \
  -d '{"model":"glm-5.3-redteam","max_tokens":400,"messages":[{"role":"user","content":"List the Nuclei templates you would run first against a Jenkins 2.440 instance and why."}]}'

Strix runs a team of agents against a target in a sandbox and routes model calls through litellm. Its README documents three variables: STRIX_LLM for the model in litellm format, LLM_API_KEY, and LLM_API_BASE for a custom endpoint (read 2026-10-22). The openai/ prefix tells litellm to speak the OpenAI format.

STRIX_LLM="openai/glm-5.3-redteam"
LLM_API_KEY="sk-uplink-live-..."
LLM_API_BASE="https://api.uplinkswitch.com/v1"

Strix sends long transcripts every turn, so the cached-input rate matters more here than on a chat frontend; the cost table below shows both.

HackingBuddyGPT is the research harness from the ipa-lab group; its LinuxPrivesc use case connects to a host over SSH and lets the model work through a privilege-escalation exercise. The README documents --llm.api_base (OpenRouter by default), --llm.model in litellm format, --llm.api_key and --llm.context_size (read 2026-10-22).

python src/hackingBuddyGPT/cli/wintermute.py LinuxPrivesc \
  --llm.api_base="https://api.uplinkswitch.com/v1" \
  --llm.api_key="sk-uplink-live-..." \
  --llm.model="openai/glm-5.3-redteam" \
  --llm.context_size=100000 \
  --conn.host=10.0.0.5 --conn.username=lowpriv --conn.password=...

Set --llm.context_size below the model's window so the harness trims the transcript before the API refuses it; Uplink Red Team (Flash) lists not listed. The same flags go in a .env file as llm.api_base, llm.model and llm.api_key.

CAI (Cybersecurity AI, from Alias Robotics) is a framework of agents with a CLI. The README documents CAI_MODEL and the provider keys, and says the open-source line is frozen at 0.5.10 with the repository archived. The base URL variable, OPENAI_BASE_URL, is in its docs/models.md (read 2026-10-22).

CAI_MODEL="openai/glm-5.3-redteam"
OPENAI_API_KEY="sk-uplink-live-..."
OPENAI_BASE_URL="https://api.uplinkswitch.com/v1"

PentestGPT changed shape in 2026. Its autonomous mode runs on Claude Code or Codex, so the key it needs is theirs. Claude Code takes a base URL and a token, the same two variables the Claude Code page documents, and then bills the Claude models on your UplinkSwitch key.

export ANTHROPIC_BASE_URL="https://api.uplinkswitch.com/v1"
export ANTHROPIC_AUTH_TOKEN="sk-uplink-live-..."

The Red Team builds speak the OpenAI format, not the Anthropic one, so they do not run under Claude Code. The legacy interactive mode, pentestgpt-legacy, documents --base-url only in its local-server example (read 2026-10-22); the invocation below follows that example and we have not run it end to end against a hosted endpoint. For the Red Team builds, Strix or HackingBuddyGPT is the documented path.

pentestgpt-legacy --base-url https://api.uplinkswitch.com/v1 --reasoning-model glm-5.3-redteam

Uplink Red Team (Pro) is the default: the security-analyst instruction is on the route, so the agent's step comes back with the IDs and the command, at $1.50 in and $6.00 out per million tokens. Uplink Red Team (Flash) carries the same instruction on our faster build, with thinking on by default, for runs that read long logs or a whole repository. GLM-5.3 Flash Cybersecurity is the budget pick at $0.525 in and $1.75 out, with a 1024K tokens window, for loops that send thousands of turns. GLM-5.3 Uncensored and the other builds on the uncensored LLM API take your prompt as is, for an agent whose own system prompt already says how to work.

An agent resends the transcript on every turn, so input dominates. Take 300 turns at 8,000 input and 500 output tokens each: 2,400,000 input and 150,000 output tokens. The second column bills 70% of the input at the cached rate, which is what a repeated prefix earns on the builds that list one.

Give the agent its own key with a monthly spend limit from the console, so a loop that never ends stops at the number you set. Requests that fail are not charged, and each top-up locks its rates for 30 days.

• The base URL ends in /v1. Strix, HackingBuddyGPT and CAI append /chat/completions themselves; a URL that already has it returns 404 on every turn.
• The litellm prefix: openai/glm-5.3-redteam, not the bare id, in Strix, HackingBuddyGPT and CAI. The bare id goes to the OpenAI SDK and curl.
• Ids are exact and lowercase. GET https://api.uplinkswitch.com/v1/models lists every id the key can call, all 267 of them.
• Keep the key out of the repository: .env in .gitignore, or the shell environment. A leaked key spends your balance until you revoke it in the console.
• Run the agents against systems you are authorized to test.

Does PentestGPT need an OpenAI API key? Its autonomous mode runs on Claude Code or Codex, so it needs whichever of those is installed, not an OpenAI key. Point Claude Code at an UplinkSwitch key with the two variables above and PentestGPT bills Claude here. The legacy mode documents --base-url for a local server.

Can I use PentestGPT with a different model? Through Claude Code, any Claude model on this key. For the Red Team builds, which speak the OpenAI format, Strix, HackingBuddyGPT and CAI take the base URL directly with glm-5.3-redteam.

What model does Strix use? Whatever STRIX_LLM names, in litellm format. The README's examples use OpenAI and Anthropic ids; openai/glm-5.3-redteam with LLM_API_BASE set to https://api.uplinkswitch.com/v1 runs it on the Red Team build.

Is CAI still maintained? The README says the open-source line is frozen at 0.5.10 and the repository is archived. It still runs, and its model and base URL settings are the ones above. HackingBuddyGPT and Strix are active.

How much does an AI pentest run cost in tokens? 300 agent turns at 8,000 input and 500 output tokens each is 2,550,000 tokens. On GLM-5.3 Uncensored that is $0.8294 at the input rate and $0.479 with 70% of the input cached. The table above has every build.

Can agentic AI be used for penetration testing? Yes. The four agents here run reconnaissance, testing and reporting loops on a model API, on systems you are authorized to test. The model decides the next step; the harness runs the tool and feeds the output back. The base URL decides who bills the tokens.

Related: best LLM for cybersecurity and WhiteRabbitNeo alternatives by API. Get a key: prepaid from $10, no subscription, 30-day price lock.