Configuration
Environment variables for Launchsafe
Configure Launchsafe using environment variables or a config file.
LLM Configuration
LaunchSafe currently supports Google Gemini only. Other providers are on the roadmap.
LAUNCHSAFE_LLMstringrequired
Gemini model in gemini/<model> form (e.g. gemini/gemini-3.1-pro-preview, gemini/gemini-2.5-flash).
GEMINI_API_KEYstringrequired
API key for Google Gemini.
GEMINI_STRONG_MODELstring
Optional override for the model used after upgrade_model() (defaults to the supervisor model).
GEMINI_LITE_MODELstring
Optional override for the model used after downgrade_model() (defaults to gemini-2.5-flash).
LLM_TIMEOUTintegerdefault 300
Request timeout in seconds for LLM calls.
LAUNCHSAFE_LLM_MAX_RETRIESintegerdefault 5
Maximum number of retries for LLM API calls on transient failures.
LAUNCHSAFE_REASONING_EFFORTstringdefault high
Control thinking effort for reasoning models. Valid values: none, minimal, low, medium, high, xhigh. Defaults to medium for quick scan mode.
LAUNCHSAFE_MEMORY_COMPRESSOR_TIMEOUTintegerdefault 30
Timeout in seconds for memory compression operations (context summarization).
Optional Features
PERPLEXITY_API_KEYstring
API key for Perplexity AI. Enables real-time web search during scans for OSINT and vulnerability research.
LAUNCHSAFE_DISABLE_BROWSERbooleandefault false
Disable browser automation tools.
LAUNCHSAFE_TELEMETRYstringdefault 1
Global telemetry default toggle. Set to 0, false, no, or off to disable both PostHog and OTEL unless overridden by per-channel flags below.
LAUNCHSAFE_OTEL_TELEMETRYstring
Enable/disable OpenTelemetry run observability independently. When unset, falls back to LAUNCHSAFE_TELEMETRY.
LAUNCHSAFE_POSTHOG_TELEMETRYstring
Enable/disable PostHog product telemetry independently. When unset, falls back to LAUNCHSAFE_TELEMETRY.
TRACELOOP_BASE_URLstring
OTLP/Traceloop base URL for remote OpenTelemetry export. If unset, Launchsafe keeps traces local only.
TRACELOOP_API_KEYstring
API key used for remote trace export. Remote export is enabled only when both TRACELOOP_BASE_URL and TRACELOOP_API_KEY are set.
TRACELOOP_HEADERSstring
Optional custom OTEL headers (JSON object or key=value,key2=value2). Useful for Langfuse or custom/self-hosted OTLP gateways.
When remote OTEL vars are not set, Launchsafe still writes complete run telemetry locally to:
launchsafe_runs/<run_name>/events.jsonlWhen remote vars are set, Launchsafe dual-writes telemetry to both local JSONL and the remote OTEL endpoint.
Docker Configuration
LAUNCHSAFE_IMAGEstringdefault ghcr.io/uselaunchsafe/launchsafe-sandbox:0.1.13
Docker image to use for the sandbox container.
DOCKER_HOSTstring
Docker daemon socket path. Use for remote Docker hosts or custom configurations.
LAUNCHSAFE_RUNTIME_BACKENDstringdefault docker
Runtime backend for the sandbox environment.
Sandbox Configuration
LAUNCHSAFE_SANDBOX_EXECUTION_TIMEOUTintegerdefault 120
Maximum execution time in seconds for sandbox operations.
LAUNCHSAFE_SANDBOX_CONNECT_TIMEOUTintegerdefault 10
Timeout in seconds for connecting to the sandbox container.
Config File
Launchsafe stores configuration in ~/.launchsafe/cli-config.json. You can also specify a custom config file:
launchsafe --target ./app --config /path/to/config.jsonConfig file format:
{
"env": {
"LAUNCHSAFE_LLM": "gemini/gemini-3.1-pro-preview",
"GEMINI_API_KEY": "...",
"LAUNCHSAFE_REASONING_EFFORT": "high"
}
}Example Setup
# Required
export LAUNCHSAFE_LLM="gemini/gemini-3.1-pro-preview"
export GEMINI_API_KEY="..."
# Optional: Enable web search
export PERPLEXITY_API_KEY="pplx-..."
# Optional: Custom timeouts
export LLM_TIMEOUT="600"
export LAUNCHSAFE_SANDBOX_EXECUTION_TIMEOUT="300"