.pyrit_conf_example

# PyRIT Configuration File Example
# ================================
# This is a YAML-formatted configuration file. Copy to ~/.pyrit/.pyrit_conf
# or specify a custom path when loading via --config-file.
#
# For documentation on configuration options, see:
# https://github.com/microsoft/PyRIT/blob/main/doc/getting_started/pyrit_conf.md

# Memory Database Type
# --------------------
# Specifies which database backend to use for storing prompts and results.
# Options: in_memory, sqlite, azure_sql (case-insensitive)
# - in_memory: Temporary in-memory database (data lost on exit)
# - sqlite: Persistent local SQLite database (default)
# - azure_sql: Azure SQL database (requires connection string in env vars)
memory_db_type: sqlite

# Initializers
# ------------
# List of built-in initializers to run during PyRIT initialization.
# Initializers configure default values for converters, scorers, and targets.
# Names are normalized to snake_case (e.g., "TargetInitializer" -> "target").
#
# Available initializers:
# - target: Registers available prompt targets into the TargetRegistry
# - converter: Registers the curated core converter presets
# - scorer: Registers pre-configured scorers into the ScorerRegistry
# - technique: Registers attack techniques into the AttackTechniqueRegistry
# - load_default_datasets: Optionally preloads all registered datasets into memory
# - preload_scenario_metadata: Preloads scenario metadata into the registry
#
# Each initializer can be specified as:
# - A simple string (name only)
# - A dictionary with 'name' and optional 'args' for parameters
#
# Parameters are lists of strings. Use the CLI command
# `pyrit_scan list-initializers` to see available parameters.
#
# Example:
# initializers:
#   - scorer
#   - name: target
#     args:
#       tags:
#         - default
#         - scorer
initializers:
  - name: target
    args:
      tags:
        - default
        - scorer
  - name: converter
  - name: scorer
  - name: technique
  # Optional full preload/cache warming for offline or shared environments.
  # This can take several minutes and may require network access,
  # provider credentials, or accepted dataset licenses. Scenarios fetch only their
  # requested datasets on demand without this initializer.
  # If intentional preload exceeds backend startup time, increase
  # server.startup_timeout below.
  # - name: load_default_datasets

  # Operator and Operation Defaults
# -------------------------------
# GUI defaults for new attacks and scans.
#
# - operator: Identifies who is running the attack (e.g., your team name or alias).
# - operation: Proposes a saved Operation name to group new activity under. It is
#   never created automatically: until it is saved, the GUI highlights it as not
#   registered and each user chooses an existing Operation, registers it, or
#   clears it.
#
# Both are optional.
operator: roakey
# operation: my_engagement

# Initialization Scripts
# ----------------------
# List of local paths to Python scripts containing PyRITInitializer subclasses.
# Paths can be absolute or relative to the current working directory.
#
# Behavior:
# - Omit this field (or set to null): No custom scripts loaded (default)
# - Set to []: Explicitly load no scripts (same as omitting)
# - Set to list of paths: Load the specified scripts
#
# Example:
# initialization_scripts:
#   - /path/to/my_custom_initializer.py
#   - ./local_initializer.py

# Environment Configuration
# -------------------------
# Azure Key Vault is the canonical source for shared and deployed configuration.
# See doc/getting_started/pyrit_conf.md for loading order, references, and migration guidance.
# The list may contain at most one bootstrap secret URL.
# env_akv_ref:
#   - https://my-vault.vault.azure.net/secrets/my-pyrit-env
# env_akv_strict: true

# Auto-discovered ~/.pyrit/.env remains supported but emits a security warning.
# Prefer env_akv_ref for shared or deployed secrets.
# Use ~/.pyrit/.env.local for quick local plaintext patches or when Azure is unavailable.
# Process values remain authoritative; AKV and ordinary env_files fill gaps in load order.
# Only a file named .env.local overrides existing values.
# Explicit env_files remain supported regardless of name or location and may contain full kv: URLs.
# env_files:
#   - /path/to/.env.local

# Max Concurrent Scenario Runs
# ----------------------------
# Maximum number of scenario runs that can execute concurrently in the backend.
# Applies only to the pyrit_backend server.
max_concurrent_scenario_runs: 3

# Live Reinitialization
# ---------------------
# Allows administrators to apply saved configuration changes without restarting
# the backend. Enable only when the deployment has exactly one backend process
# and one replica. Known worker and replica settings are checked as an additional
# safeguard. Live apply rejects busy runtimes and requires a restart if
# initialization fails after replacement begins.
enable_live_reinitialization: false

# Custom Initializer Registration (REST API)
# -------------------------------------------
# When true, the REST API accepts POST /api/initializers to register custom
# initializer scripts and DELETE /api/initializers/{name} to remove custom
# initializers.
#
# ⚠️  WARNING: Enabling this allows arbitrary Python code execution on the
# server via the REST API. Only enable on trusted networks.
# The pyrit_backend default host is localhost, which limits exposure.
# If you bind to 0.0.0.0, ensure you are on a trusted network.
#
# Default: false
allow_custom_initializers: false

# Optional storage for custom initializer Python scripts. This may be a local
# directory or an Azure Blob container URI with an optional blob prefix.
# Container URIs may include a SAS; otherwise DefaultAzureCredential is used. Defaults to
# ~/.pyrit/custom_initializers.
#
# ⚠️  WARNING: When allow_custom_initializers is true, the backend runs every script
# in this source at startup and live reinitialization. Anyone who can write to this
# source, or to this configuration file, can run code as the backend. Restrict write
# access to trusted administrators.
# custom_initializers_source: https://account.blob.core.windows.net/container/custom_initializers

# Optional storage for scenario presets, the saved scenario configurations the
# scanner UI launches from. This may be a local directory or an Azure Blob
# container URI with an optional blob prefix. Container URIs may include a SAS;
# otherwise DefaultAzureCredential is used. Defaults to ~/.pyrit/scenario_presets.
# scenario_presets_source: https://account.blob.core.windows.net/container/scenario_presets

# Optional storage for operator-authored ScenarioSuite definitions, which contain
# ordered references to scenario presets. PyRIT merges these editable documents
# with read-only suites registered in code; a stored document takes precedence on
# a name collision. This supports the same local directory and Azure Blob sources
# as scenario_presets_source. Defaults to ~/.pyrit/scenario_suites.
# scenario_suites_source: https://account.blob.core.windows.net/container/scenario_suites

# Upload Folder for API-Created Targets
# -------------------------------------
# Folder that targets created through the REST API may upload local files from
# (HTTPXAPITarget). The server passes it to the target; API callers cannot choose it.
# When unset, those targets cannot be created through the API; register them in
# Python or with an initializer instead.
#
# Default: unset
# target_upload_directory: /path/to/upload/files

# Local Backend Server
# --------------------
# Client settings used by pyrit_scan when connecting to or launching a backend.
# - url: Backend URL used when --server-url is omitted.
# - startup_timeout: Seconds to wait for --start-server before cleaning up the
#   spawned process and returning an error.
#
# Both settings can be overridden with --server-url and --startup-timeout.
server:
  url: http://localhost:8000
  startup_timeout: 120

# Silent Mode
# -----------
# If true, suppresses print statements during initialization.
# Useful for non-interactive environments or when embedding PyRIT in other tools.
silent: false