ConfigurationFull Reference

Full Configuration Reference

Kyber uses two files: ~/.kyber/config.json for settings and ~/.kyber/.env for secrets.

config.json (settings only — no secrets)

{
  "agents": {
    "defaults": {
      "workspace": "~/.kyber/workspace",
      "provider": "openrouter",
      "chatProvider": "",
      "taskProvider": "",
      "maxTokens": 8192,
      "temperature": 0.7,
      "timezone": "",
      "backgroundProgressUpdates": true
    }
  },
  "providers": {
    "openrouter": { "apiBase": null, "chatModel": "", "taskModel": "", "model": "" },
    "anthropic":  { "chatModel": "", "taskModel": "", "model": "" },
    "openai":     { "chatModel": "", "taskModel": "", "model": "" },
    "deepseek":   { "chatModel": "", "taskModel": "", "model": "" },
    "gemini":     { "chatModel": "", "taskModel": "", "model": "" },
    "groq":       { "chatModel": "", "taskModel": "", "model": "" },
    "custom": [
      {
        "name": "my-provider",
        "apiBase": "https://your-endpoint.com/v1",
        "chatModel": "",
        "taskModel": "",
        "model": ""
      }
    ]
  },
  "channels": {
    "discord": {
      "enabled": false,
      "allowFrom": [],
      "allowGuilds": [],
      "allowChannels": [],
      "requireMentionInGuilds": true,
      "maxAttachmentMb": 20,
      "typingIndicator": true
    },
    "telegram": {
      "enabled": false,
      "allowFrom": [],
      "proxy": null
    },
    "whatsapp": {
      "enabled": false,
      "bridgeUrl": "ws://localhost:3001",
      "allowFrom": []
    }
  },
  "gateway": { "host": "0.0.0.0", "port": 18790 },
  "dashboard": { "host": "127.0.0.1", "port": 18890, "allowedHosts": [] },
  "tools": {
    "web": { "search": { "maxResults": 5 } },
    "exec": { "timeout": 60, "restrictToWorkspace": false },
    "skillScanner": {
      "useLlm": true,
      "useBehavioral": true,
      "useVirustotal": false,
      "useAidefense": false,
      "enableMeta": true,
      "llmModel": ""
    }
  }
}

.env (secrets)

All API keys, bot tokens, and auth tokens live in ~/.kyber/.env:

# Provider API keys
KYBER_PROVIDERS__OPENROUTER__API_KEY=sk-or-v1-xxx
KYBER_PROVIDERS__ANTHROPIC__API_KEY=sk-ant-xxx
KYBER_PROVIDERS__OPENAI__API_KEY=sk-xxx
KYBER_PROVIDERS__DEEPSEEK__API_KEY=sk-xxx
KYBER_PROVIDERS__GEMINI__API_KEY=xxx
KYBER_PROVIDERS__GROQ__API_KEY=xxx
 
# Custom provider keys (name uppercased, hyphens/spaces become underscores)
KYBER_CUSTOM_PROVIDER_MY_LOCAL_API_KEY=xxx
 
# Tool keys
KYBER_TOOLS__WEB__SEARCH__API_KEY=xxx
KYBER_TOOLS__SKILL_SCANNER__LLM_API_KEY=xxx          # optional, auto-detected from active provider
KYBER_TOOLS__SKILL_SCANNER__VIRUSTOTAL_API_KEY=xxx    # optional, for binary scanning
KYBER_TOOLS__SKILL_SCANNER__AI_DEFENSE_API_KEY=xxx    # optional, for Cisco AI Defense
 
# Channel tokens
KYBER_CHANNELS__TELEGRAM__TOKEN=123456:ABC-DEF
KYBER_CHANNELS__DISCORD__TOKEN=xxx
 
# Dashboard auth
KYBER_DASHBOARD__AUTH_TOKEN=xxx

This file is created with 600 permissions (owner read/write only) and is managed automatically by save_config() and the dashboard.

Environment variable overrides

Any field can be overridden using environment variables with the KYBER_ prefix and __ as a nested delimiter:

export KYBER_AGENTS__DEFAULTS__PROVIDER="openai"
export KYBER_AGENTS__DEFAULTS__TEMPERATURE="0.5"

Priority order (highest wins):

  1. Real environment variables (export KYBER_...)
  2. ~/.kyber/.env file
  3. ~/.kyber/config.json

Migrating from older versions

If you have API keys in config.json from an older version of Kyber:

kyber migrate-secrets

This extracts all secrets to .env, blanks them from config.json, and sets file permissions to 600.

WorkspaceOverview