Configuration

Auto-generated page. This page is generated from the live Evidentia codebase by scripts/wiki/sync_reference.py. Do not edit it by hand; change the underlying code/data and re-run the generator (uv run python scripts/wiki/sync_reference.py).

Evidentia is configured through three layers, in precedence order: CLI flag > environment variable > evidentia.yaml > built-in default. LiteLLM endpoint routing also reads provider-specific configuration; see the offline AI section below.

evidentia.yaml

An optional project config file discovered by walking the current directory up to the filesystem root for the first evidentia.yaml. String values support ${ENV_VAR} interpolation. Honored keys (schema: evidentia_core.config.EvidentiaConfig):

Key	Type	Description
organization	str \| None	Organization name — seeds gap analyze's inventory.organization when the inventory file lacks one.
system_name	str \| None	System / product name surfaced in reports alongside organization.
frameworks	list[str]	Default framework IDs for gap analyze when --frameworks is omitted. CLI replaces, never unions.
llm.model	str \| None	Default LLM model name (e.g. 'claude-sonnet-4-6'). Overridden by --model or $EVIDENTIA_LLM_MODEL.
llm.temperature	float \| None	Default LLM temperature. Overridden by $EVIDENTIA_LLM_TEMPERATURE.

Environment variables

Evidentia reads the following 54 EVIDENTIA_* environment variables. Variables whose name ends in _PASSWORD, _SECRET, or _TOKEN_FILE carry credential material. Set them in your shell/secret store, never commit their values.

Environment variable
EVIDENTIA_AI_ACQUISITION_DIR
EVIDENTIA_AI_OPERATOR
EVIDENTIA_AI_REGISTRY_DIR
EVIDENTIA_API_AUTH_TOKEN_FILE
EVIDENTIA_API_DEV
EVIDENTIA_API_OFFLINE
EVIDENTIA_API_SECURITY_HEADERS
EVIDENTIA_AUDIT_RO
EVIDENTIA_CATALOG_DIR
EVIDENTIA_CHALLENGE_STORE_DIR
EVIDENTIA_CONMON_ALERT_DEDUP_FILE
EVIDENTIA_CONMON_DAEMON_HISTORY_FILE
EVIDENTIA_CONMON_DAEMON_STATUS_FILE
EVIDENTIA_CONMON_STATE_FILE
EVIDENTIA_EDITOR_ALLOW_ANY
EVIDENTIA_ENTERPRISE_RETENTION_PROFILES_FILE
EVIDENTIA_EVIDENCE_AUTO_MIRROR_WORM
EVIDENTIA_EVIDENCE_STORE_DIR
EVIDENTIA_EVIDENCE_WORM_BACKEND_FACTORY
EVIDENTIA_EXPLAIN_CACHE_DIR
EVIDENTIA_GAP_STORE_DIR
EVIDENTIA_INCIDENT_CLOCK_PROFILES_FILE
EVIDENTIA_LLM_API_BASE
EVIDENTIA_LLM_MODEL
EVIDENTIA_LLM_TEMPERATURE
EVIDENTIA_MCP_SIGNER_FACTORY
EVIDENTIA_MCP_SIGN_OUTPUTS
EVIDENTIA_METRIC_STORE_DIR
EVIDENTIA_MODEL_STORE_DIR
EVIDENTIA_MSSQL_PASSWORD
EVIDENTIA_MYSQL_PASSWORD
EVIDENTIA_ORACLE_PASSWORD
EVIDENTIA_OSCAL_NS
EVIDENTIA_POAM_STORE_DIR
EVIDENTIA_POSTGRES_PASSWORD
EVIDENTIA_RBAC_IDENTITY
EVIDENTIA_RBAC_POLICY_FILE
EVIDENTIA_RBAC_TENANT
EVIDENTIA_REGISTRY_SAM_API_KEY
EVIDENTIA_RETENTION_STORE_DIR
EVIDENTIA_SERVICENOW_INSTANCE_URL
EVIDENTIA_SERVICENOW_PASSWORD
EVIDENTIA_SERVICENOW_TABLE
EVIDENTIA_SERVICENOW_USER
EVIDENTIA_SIGNING_KEY_PASSPHRASE
EVIDENTIA_SIGNING_KEY_PASSPHRASE_FILE
EVIDENTIA_SKIP_FRONTEND_BUILD
EVIDENTIA_SMTP_PASSWORD
EVIDENTIA_SQLITE_SAFE_ROOT
EVIDENTIA_TEST_MODE
EVIDENTIA_TRUST_PROXY_HEADERS
EVIDENTIA_VENDOR_STORE_DIR
EVIDENTIA_WEBHOOK_SECRET
EVIDENTIA_WORKFLOW_STORE_DIR

Offline AI configuration

Offline generation supports Ollama and local OpenAI-compatible servers, including vLLM. Set OLLAMA_API_BASE for Ollama, OPENAI_API_BASE or OPENAI_BASE_URL for OpenAI-compatible routes, or HOSTED_VLLM_API_BASE for vLLM prefixes. Include the server API root, such as /v1, where required. Only Ollama defaults to localhost. Conflicting explicit bases are refused. EVIDENTIA_LLM_API_BASE affects diagnostic/status code, not completions.

The dedicated transport ignores environment proxies and refuses redirects. Unknown per-call routing options, custom transports/callbacks and multimodal content are refused. Text messages, function schemas, structured output and streaming remain supported. In-process vLLM loading is deferred for v0.13; use a separately running local server.

Keep routing stable and restrict the server's own network access. Host/container network isolation remains necessary. See Air-gapped install for endpoint precedence, migration and qualification limits.

LLM provider keys

The LLM-backed commands (evidentia risk generate, evidentia explain) read the standard provider SDK keys via LiteLLM. Evidentia does not define these; set whichever matches your configured model. evidentia doctor reports which are detected.

Environment variable	Provider
OPENAI_API_KEY	OpenAI
ANTHROPIC_API_KEY	Anthropic
GOOGLE_API_KEY	Google
AZURE_OPENAI_API_KEY	Azure OpenAI