Connecting an AI Provider, or Running One Yourself

Every AI feature runs on a provider you choose and pay for, with your own key. The screen is Settings, then AI: the provider, the key, the model and a few limits, with Save AI Settings and Test Connection at the foot. AI in Pental shows what the features do with it.

What you can point it at

• Ollama, local or self-hosted, which the screen marks as recommended. Requests go from your browser to the machine running it.
• Groq, which is fast and has a free tier, so it is a reasonable place to try the features before committing.
• OpenAI.
• Anthropic Claude.
• A custom endpoint, declared under API Format as OpenAI-compatible or Anthropic-compatible, for anything you host yourself or buy elsewhere.

For a hosted provider you paste a key, and the Model list then holds every model the key can use, as the provider lists it. Its first choice, Recommended, is the model Pental recommends for that provider, and it moves to each newer one Pental recommends with nothing for you to change; choose a model by name instead to keep it fixed. For Ollama you give its URL, and for a custom endpoint the endpoint’s URL, and the list holds the models installed there; on Ollama, Recommended uses the newest model Pental has recommended that you have pulled.

Where the requests go

The key is stored in your own database, encrypted, and never sent back to a browser after saving. A request with your own key, or to your own endpoint, is sent to the provider from your own side: by your database on Supabase, or by your Pental gateway. Neither the key nor what is asked passes through Pental. If your database cannot send just now (on Supabase it needs the pg_net extension; behind a gateway, a current gateway that is running), the request waits until it can rather than going another way. Ollama is asked from your own browser, so nothing passes through Pental at all, and running AI drafting on your own hardware covers that setup.

Full size

Calderwood SecurityTheir own AI, in their own databaseDemonstration portals. The four firms are invented; every screen is the real software.Drag sideways to see the whole screen.

Settings, AI says which route your firm is on. With no key of your own saved, it says requests pass through Pental’s servers on their way to the provider, which is the one case where they do; save your own key, or run Ollama, and they do not.

Limits worth setting

• Requests a minute: blank means no limit, which is how it starts. With a number, a request over it waits its turn, and the field it is for says how long.
• Fields written at once: how many fields Generate all asks for together, each after the fields it needs. Automatic is four for a hosted model, two for your own endpoint and one for Ollama, which answers one at a time.
• For a custom endpoint, Max Tokens: the reply size for a request that names none. 2,000 suits most self-hosted models; a feature that writes something long, such as a summary, asks for more of its own.
• For Ollama, the context window. Left blank, it is sized to the model so the model stays on the graphics card, which is what keeps it fast; set a number only to override it.

Local models have no rate limits, so the platform can take as long as a job needs. Hosted providers do, so set Requests a minute to stay inside yours. Neither runs a reduced-quality pass to save time.

The prompts are yours

Every field and section the platform can write has a prompt you can read and edit, beside the field itself in Settings (the Assessments and Findings tabs): the built-in fields, your own custom fields and sections, and the summaries. The box shows the built-in prompt until you change it, Reset to default puts it back, and what Pental adds to every request so the answer fits the field (HTML for a rich field, the shape a CVSS vector or a list of links must take) is shown beneath it. Nothing is hidden inside the product, so if the output is not in your house voice, the fix is a prompt you can see rather than a support ticket. How to write a penetration test report is a useful brief for what those prompts should ask for.