Can Claude Code run a non-Claude model?

It sends requests to whatever Anthropic-format endpoint ANTHROPIC_BASE_URL names, so yes in practice. Anthropic states that it does not support routing Claude Code to non-Claude models, so treat it as an unsupported setup.

Do I need claude-code-router?

No. A local router was needed when an endpoint only spoke the OpenAI format. PentestLLM answers the Anthropic Messages format directly at https://api.pentestllm.ai/v1/messages.

Should the base URL include /v1?

No. Set ANTHROPIC_BASE_URL to https://api.pentestllm.ai. Claude Code appends /v1/messages to it.

Does my Claude subscription get billed?

Claude Code’s docs say that while a gateway credential variable is active, requests carry that credential in place of the subscription login. Requests to PentestLLM are billed per token to your PentestLLM balance.

Which model id should I use?

Use auto/security to let the router choose a security build per request, or a single build id from the models page to keep every turn on one model.

Set up Claude Code with PentestLLM

Claude Code talks to any endpoint that speaks the Anthropic Messages format, and PentestLLM serves that format at https://api.pentestllm.ai. Set ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN, start claude with a security model id, and the same agent runs on a security-tuned build.

Get a key Prices per token

shell

export ANTHROPIC_BASE_URL=https://api.pentestllm.ai
export ANTHROPIC_AUTH_TOKEN=sk-ptl-live-…

Steps

Export the base URL and the key
Create a key in the PentestLLM console. In the terminal that will run Claude Code, set the two variables. The base URL has no /v1: Claude Code adds /v1/messages itself. ANTHROPIC_AUTH_TOKEN sends the key as a bearer token, and while it is set, requests carry that credential in place of a claude.ai login.
shell
```
export ANTHROPIC_BASE_URL=https://api.pentestllm.ai
export ANTHROPIC_AUTH_TOKEN=sk-ptl-live-…
```

Verify the endpoint with one request

Claude Code’s docs recommend a direct request before opening the agent, so a failure points at the endpoint and not at your setup. A JSON answer with a content field means the URL and the key work. A 401 means the key is wrong.

shell

curl -sS -X POST "$ANTHROPIC_BASE_URL/v1/messages" \
  -H "Authorization: Bearer $ANTHROPIC_AUTH_TOKEN" \
  -H "anthropic-version: 2023-06-01" \
  -H "content-type: application/json" \
  -d '{"model": "auto/security", "max_tokens": 16, "messages": [{"role": "user", "content": "Reply with the single word ok."}]}'

Start Claude Code on a security model
Launch with --model, or set ANTHROPIC_MODEL to have it apply to every launch from that shell. Inside the session, /status should show your base URL and the auth token as the credential in use.
shell
```
claude --model auto/security
```
Make it persistent, for this machine only
To keep the setup across terminals, put the variables in the env block of ~/.claude/settings.json. Do not put the key in a project’s .claude/settings.json: that file is committed with the repository. If you also use Claude Code with Claude models, keep this in shell exports instead, so only the terminal you choose is redirected.
~/.claude/settings.json
```
{
  "env": {
    "ANTHROPIC_BASE_URL": "https://api.pentestllm.ai",
    "ANTHROPIC_AUTH_TOKEN": "sk-ptl-live-…",
    "ANTHROPIC_MODEL": "auto/security"
  }
}
```

Read this first: what is unsupported

Anthropic’s gateway documentation, read on 11 November 2026, says it does not support routing Claude Code to non-Claude models through any gateway. This setup works because PentestLLM’s endpoint accepts the Messages format and translates it for its builds. It is your configuration to maintain, and a Claude Code update can change what the agent sends.

Some things are lost in translation. Extended thinking settings and prompt cache controls are dropped, because the builds behind the endpoint have no equivalent. Claude Code also makes a few checks directly against Anthropic’s own API, such as its fast mode availability check, whatever base URL you set.

What each variable does

ANTHROPIC_BASE_URL: The endpoint Claude Code sends Messages requests to. https://api.pentestllm.ai, without a path.
ANTHROPIC_AUTH_TOKEN: Your PentestLLM key, sent in the Authorization: Bearer header.
ANTHROPIC_API_KEY: The alternative credential variable, sent in x-api-key. The endpoint accepts either; set one, not both.
ANTHROPIC_MODEL: The model for sessions started from this environment: auto/security or one build id.
CLAUDE_CODE_MAX_CONTEXT_TOKENS: The context window Claude Code should assume. It assumes 200,000 tokens for an id it does not recognize.

Errors you may meet

401: The key is wrong, or it is in the variable the other header reads. Re-copy it from the console.
A warning that the model is not recognized: Expected. Claude Code does not know the id and assumes a 200,000-token window; set CLAUDE_CODE_MAX_CONTEXT_TOKENS if the build’s window differs.
400 naming an unrecognized field: Claude Code’s docs give CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS=1 for endpoints that reject pre-release request fields.
A startup warning about two credential sources: A saved login and the token are both present. The token is used; run /logout to clear the warning.
402: The prepaid balance is empty. Top up in the console.

Why testers do this

Claude Code’s own docs say penetration testing and CTF workloads frequently trigger its model fallback. Pointing the agent at a security-tuned build keeps the tooling you know and changes the model’s willingness: these builds answer security questions other models decline. That is reduced refusals, not zero. The page on Claude Code and security research sets out the other options, including Anthropic’s own.

Use it only on systems you own or have written permission to test; the acceptable use policy applies to every request the agent sends. If you would sooner use an agent built for custom endpoints, see the OpenCode guide.

9 security builds, priced per token

Read from the live catalog on 2026-11-11. Prices are US dollars per million tokens, paid from a prepaid balance that starts at $10. The id auto/security has no price of its own: each request is billed at the build that answered.

Build	Input	Output	Context
Qwen3.8 27B Cybersecurity	$0.40	$2.40	262,144
Gemma 4 26B A4B Cybersecurity	$0.4224	$1.3376	262,144
GLM-5.3 Flash Cybersecurity	$0.5093	$1.6975	1,048,576
Red Team (Flash)	$0.90	$3.00	not published
Red Team (Pro)	$1.50	$6.00	not published
OrcaCyber MiniMax M3.1 Flash	$2.00	$4.00	261,632
OrcaCyber Qwen3.8 Flash Next	$2.00	$4.00	261,632
Cyber Frontier	$5.25	$15.75	1,048,576
OrcaCyber Zero 1.5	$7.50	$18.75	999,488

Full price list and tool fees · Every model · API docs

Questions

It sends requests to whatever Anthropic-format endpoint ANTHROPIC_BASE_URL names, so yes in practice. Anthropic states that it does not support routing Claude Code to non-Claude models, so treat it as an unsupported setup.
No. A local router was needed when an endpoint only spoke the OpenAI format. PentestLLM answers the Anthropic Messages format directly at https://api.pentestllm.ai/v1/messages.
No. Set ANTHROPIC_BASE_URL to https://api.pentestllm.ai. Claude Code appends /v1/messages to it.
Claude Code’s docs say that while a gateway credential variable is active, requests carry that credential in place of the subscription login. Requests to PentestLLM are billed per token to your PentestLLM balance.
Use auto/security to let the router choose a security build per request, or a single build id from the models page to keep every turn on one model.

One key, from $10

PentestLLM is for systems you own or have written permission to test. The acceptable use policy says what is not allowed.

Get a key

usage, 1,000 agent turns on Qwen3.8 27B Cybersecurity

Input, 8,000 tokens at $0.40 per million: $0.0032
Output, 1,000 tokens at $2.40 per million: $0.0024
One turn: $0.0056
1,000 turns: $5.60

output price per million tokens, 9 builds

$1.3376 Gemma 4 26B A4B CybersecurityOrcaCyber Zero 1.5 $18.75

Steps

Export the base URL and the key