How do I point aider at a custom endpoint?

Set OPENAI_API_BASE to the endpoint and OPENAI_API_KEY to your key, then run aider with --model openai/ followed by the model id.

Where does .aider.conf.yml go?

In your home directory, the root of the git repository or the current directory. Aider loads them in that order and the last one loaded takes priority.

Why does aider warn about unknown context window size?

It has no metadata for a model it does not know and falls back to defaults. Aider’s docs say the warning can usually be ignored.

What does an aider session cost?

Billing is per token. On 2026-11-11 input prices for security builds start at $0.40 per million tokens, and the prepaid minimum is $10.

Set up aider with PentestLLM

Aider reaches PentestLLM through its OpenAI-compatible settings: export OPENAI_API_BASE=https://api.pentestllm.ai/v1 and OPENAI_API_KEY, then start aider with --model openai/ followed by a build id. The same values can live in .aider.conf.yml so you do not retype them.

Get a key Prices per token

shell

export OPENAI_API_BASE=https://api.pentestllm.ai/v1
export OPENAI_API_KEY=sk-ptl-live-…

Steps

Export the base URL and the key
Create a key in the PentestLLM console. In the shell that will run aider, set aider’s two OpenAI-compatible variables. On Windows, aider’s docs use setx in place of export, followed by a new shell.
shell
```
export OPENAI_API_BASE=https://api.pentestllm.ai/v1
export OPENAI_API_KEY=sk-ptl-live-…
```
Start aider with a build id
Change into your project and start aider with the model name prefixed by openai/, which tells aider to use the OpenAI-compatible connection. The id after the prefix is a build from the models page.
shell
```
cd /path/to/project
aider --model openai/gemma-4-26b-a4b-it-cybersecurity
```
Expect one warning
Aider does not have metadata for this model, so it prints a line saying the context window size and costs are unknown and that it is using sane defaults. Aider’s docs say this warning can usually be ignored. The session works; aider’s own cost estimate will be missing.
Save the settings in .aider.conf.yml
To stop typing flags, put them in .aider.conf.yml. Aider loads this file from your home directory, the root of the git repository and the current directory, in that order, and the last one loaded wins. Leave the key line out if you keep the key in the environment, and never commit a file that contains it.
.aider.conf.yml
```
openai-api-base: https://api.pentestllm.ai/v1
openai-api-key: sk-ptl-live-…
model: openai/gemma-4-26b-a4b-it-cybersecurity
```

What each setting does

OPENAI_API_BASE: The endpoint aider sends requests to. https://api.pentestllm.ai/v1, with the /v1.
OPENAI_API_KEY: Your PentestLLM key.
--model openai/<id>: The model. The openai/ prefix selects the OpenAI-compatible connection; the rest is the build id.
openai-api-base, openai-api-key, model: The same three values as keys in .aider.conf.yml.

Why a named build here

This guide uses a single build id, gemma-4-26b-a4b-it-cybersecurity, and not the router id. Aider’s documentation shows the form openai/<model-name> and does not show a model name that itself contains a slash, so we have not written auto/security into the command.

If you want the router with aider, create a key in the console with its auto router option set to auto/security. That key routes every chat request as the router id whatever model name arrives, so the named build in your command becomes a label and each request is placed on a fast, balanced or frontier build.

What aider is good at in security work

Aider edits files in a git repository and commits each change, which makes it a tidy tool for the code side of security work: fixing a finding in your own code base, writing a regression test for a vulnerability you confirmed, adding input validation, or turning notes into a detection rule file. Every change is a commit you can review and revert.

On a security build it will also discuss the flaw it is fixing, because these builds answer security questions other models decline. Refusals are reduced, not removed.

Keeping the bill small

Aider sends a map of the repository and the files you added with every request, so input tokens are most of the cost. Add only the files a task needs and drop them afterwards. The table below lists each security build’s live price on 2026-11-11; a build with a low input price costs the least per edit.

Authorized use

Use aider on code you own or are engaged to work on. PentestLLM is for lawful, authorized security work, and the acceptable use policy covers every request. For an agent that also runs commands and tools, see the OpenCode guide; for all clients, the agent guides.

9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.

Build	Input	Output	Context
Qwen3.8 27B Cybersecurity	$0.40	$2.40	262,144
Gemma 4 26B A4B Cybersecurity	$0.4224	$1.3376	262,144
GLM-5.3 Flash Cybersecurity	$0.5093	$1.6975	1,048,576
Red Team (Flash)	$0.90	$3.00	not published
Red Team (Pro)	$1.50	$6.00	not published
OrcaCyber MiniMax M3.1 Flash	$2.00	$4.00	261,632
OrcaCyber Qwen3.8 Flash Next	$2.00	$4.00	261,632
Cyber Frontier	$5.25	$15.75	1,048,576
OrcaCyber Zero 1.5	$7.50	$18.75	999,488

Full price list and tool fees · Every model · API docs

Questions

Set OPENAI_API_BASE to the endpoint and OPENAI_API_KEY to your key, then run aider with --model openai/ followed by the model id.
In your home directory, the root of the git repository or the current directory. Aider loads them in that order and the last one loaded takes priority.
It has no metadata for a model it does not know and falls back to defaults. Aider’s docs say the warning can usually be ignored.
Through a key whose auto router option is set to auto/security. That key routes every chat request to the router whatever model name aider sends.
Billing is per token. On 2026-11-11 input prices for security builds start at $0.40 per million tokens, and the prepaid minimum is $10.

One key, from $10

PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.

Get a key

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

Input, 8,000 tokens at $0.40 per million: $0.0032
Output, 1,000 tokens at $2.40 per million: $0.0024
One turn: $0.0056
1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B CybersecurityOrcaCyber Zero 1.5 $18.75

Steps

Export the base URL and the key

Start aider with a build id

Expect one warning

Save the settings in .aider.conf.yml