Note
Read this first: what the LLM is and isn't. In Crawl Cove the language model is
interpretation only: it explains findings in plain English and drafts report
summaries. The app is fully functional with the LLM set to none (that's the
default), falling back to deterministic templates. No LLM output can ever create,
remove, or re-score a finding. Every finding comes from a coded, versioned check.
The model's output is also schema-validated: anything that fails strict validation
falls back to the template and is tagged so the degradation is visible. You are never
trusting the model with the numbers, only with the wording.
That boundary is the whole design. Findings, severities, and impact scores are deterministic; the LLM sits on top to make them readable and to give you a first draft of the executive summary. So configuring a backend is genuinely optional. Turn it on for nicer explanations, or leave it off and lose nothing factual.
If you do want it on, you have two options.
Option A: Ollama (local, free, no key)
This runs a model entirely on your own machine. With Ollama nothing leaves your computer, there's no API key, and there's no per-request cost. That fits Crawl Cove's local-first, private-by-default posture.
-
Install Ollama from ollama.com.
-
Pull a chat model:
ollama pull llama3.1(Another chat model works too; this is just a sensible default.)
-
Make sure the daemon is running on
http://localhost:11434(Ollama starts it for you after install). -
In Crawl Cove → Settings → LLM → set the backend to Ollama → click Test connection → pick a model → save.
That's it: no account, no key, no quota.
Option B: Anthropic API key (cloud)
If you'd rather use a hosted model, Crawl Cove can call Anthropic.
Note
What you'll need: an Anthropic account and an API key from console.anthropic.com. A few minutes.
- Create a key at console.anthropic.com.
- In Crawl Cove → Settings → LLM → set the backend to Anthropic.
- Paste the key (it's stored encrypted; see below).
- Pick a model. The default is
claude-opus-4-8;claude-sonnet-4-6andclaude-haiku-4-5are also valid choices. - Click Test connection to confirm it works before you rely on it.
Tip
The Test connection button on either backend is worth using every time you change the configuration. A working test now means the evidence drawer's AI explanations and the report's drafted summary will be there when you need them on a client call. The alternative is discovering a misconfiguration mid-deliverable.
When the model misbehaves, the app stays honest
Crawl Cove is built to degrade gracefully, never to crash on the LLM:
- Output that fails strict schema validation falls back to the deterministic template and is tagged so you can see it degraded.
- A provider rate limit maps to a clean
rate_limitedcode, not a crash.
So a flaky or rate-limited model never breaks your workflow; you just fall back to the template behaviour you'd have with the LLM off.
Your key is handled like every other secret
The Anthropic key follows Crawl Cove's secret discipline: it's encrypted via
Electron safeStorage and lives only in the encrypted secrets folder under
<userData>/secrets/. It is never written to the SQLite database, returned across
the IPC bridge to the interface, rendered back, or logged. The same rule
governs your OAuth tokens and every other API key. Setting a model up doesn't widen
your exposure.
Next
- Using the evidence drawer is where the LLM's plain-English explanations and suggested fixes show up (and where the template takes over when it's off).
- Building white-label PDF reports shows the drafted, editable executive summary in action.