# Costa Security Costa is the world's most powerful secure AI platform, designed for enterprise security and performance. ## Our Products ### Costa Code The world's most capable secure coding assistant. Costa Code empowers engineers to code safely in their preferred IDEs using cutting-edge AI models while maintaining security and compliance. ### Costa Gateway A high-performance, secure LLM and tool router that provides unified API access across hundreds of models through a single endpoint. ### Costa Copilot An enterprise-grade AI chat assistant that connects to external agents and tools to enhance workflow productivity. ## Platform Benefits - **Security First**: Enterprise-ready security with comprehensive controls - **Unified Access**: Single platform for all AI needs with centralized observability - **Latest Models**: Support for Claude 4, GPT-5, Gemini 2.5, and more - **IDE Integration**: Works with Cursor, VS Code, JetBrains, and others - **Auto Router**: Intelligent model selection for optimal performance ## Documentation Index The following links provide comprehensive documentation for Costa Security products: ## Priority Documentation ### Index URL: https://docs.costa.security/index ```mdx --- ---

Connect your AI.

Make every token count.

Get started

A Costa session: prompts, tool calls, and routing across models

A real session.

Chat with our docs

``` ### Introduction URL: https://docs.costa.security/api-reference/introduction ```mdx --- title: 'Introduction' description: 'Example section for showcasing API endpoints' --- If you're not looking to build API reference documentation, you can delete this section by removing the api-reference folder. ## Welcome There are two ways to build API documentation: [OpenAPI](https://mintlify.com/docs/api-playground/openapi/setup) and [MDX components](https://mintlify.com/docs/api-playground/mdx/configuration). For the starter kit, we are using the following OpenAPI specification. View the OpenAPI specification file ## Authentication All API endpoints are authenticated using Bearer tokens and picked up from the specification file. ```json "security": [ { "bearerAuth": [] } ] ``` ``` ### Authentication URL: https://docs.costa.security/api-reference/authentication ```mdx --- title: "Authentication" description: "Learn how to authenticate with the Costa AI API using API keys and security best practices" icon: "key" --- Costa AI uses API keys for authentication. All requests must include a valid API key in the Authorization header. ## API Key Management Navigate to **Settings** → **API Keys** in your Costa AI dashboard Configure key permissions and usage limits Securely store your API key (starts with `costa_ent_`) Use the interactive API playground to verify your key works ## Authentication Methods **Standard Method**: Include your API key in the Authorization header ```bash curl -X POST "https://ai.costa.app/api/v1/chat/completions" \ -H "Authorization: Bearer costa_ent_your_key_here" \ -H "Content-Type: application/json" ``` Never expose your API key in client-side code or public repositories. ## API Key Types **Purpose**: For development and testing environments **Features**: - Lower rate limits - Access to development models - Detailed error messages - No SLA guarantees **Usage Limits**: - 1,000 requests per hour - 10,000 tokens per day - Basic model access only **Purpose**: For production applications and services **Features**: - Higher rate limits - Access to all models - SLA guarantees - Priority support **Usage Limits**: - 10,000 requests per hour - 1,000,000 tokens per day - Full model suite access **Purpose**: For enterprise customers with custom requirements **Features**: - Custom rate limits - Dedicated infrastructure - White-glove support - Custom security controls **Usage Limits**: - Unlimited requests (fair use) - Custom token allocations - Private model access ## Security Best Practices Rotate API keys every 90 days for enhanced security Store keys in environment variables, never in code Use keys with minimal required permissions Monitor API key usage for unusual activity ## Rate Limiting Costa AI implements rate limiting to ensure fair usage and system stability. ### Rate Limit Headers All API responses include rate limit information: ```http X-RateLimit-Limit: 10000 X-RateLimit-Remaining: 9999 X-RateLimit-Reset: 1640995200 X-RateLimit-Window: 3600 ``` Maximum requests allowed in the current window Requests remaining in the current window Unix timestamp when the rate limit window resets Rate limit window duration in seconds ### Rate Limit Tiers - **Requests**: 100 per hour - **Tokens**: 10,000 per day - **Models**: Basic models only - **Burst**: 10 concurrent requests - **Requests**: 1,000 per hour - **Tokens**: 100,000 per day - **Models**: Standard model suite - **Burst**: 50 concurrent requests - **Requests**: 10,000+ per hour - **Tokens**: 1,000,000+ per day - **Models**: Full model suite + custom - **Burst**: 200+ concurrent requests ## Error Handling **Cause**: Invalid or missing API key ```json { "error": { "type": "authentication_error", "code": "invalid_api_key", "message": "Invalid API key provided" } } ``` **Solutions**: - Verify API key is correct - Check key hasn't expired - Ensure proper Authorization header format **Cause**: Insufficient permissions for the requested resource ```json { "error": { "type": "permission_error", "code": "insufficient_permissions", "message": "API key does not have permission to access this model" } } ``` **Solutions**: - Check API key permissions in dashboard - Upgrade to appropriate tier - Contact support for model access **Cause**: Rate limit exceeded ```json { "error": { "type": "rate_limit_error", "code": "rate_limit_exceeded", "message": "Rate limit exceeded. Try again in 60 seconds." } } ``` **Solutions**: - Implement exponential backoff - Upgrade to higher tier - Optimize request frequency ## Testing Authentication Use our interactive API playground to test your authentication: Visit our [API playground](/api-reference/chat/completions) to test your API key and explore available models. ### Example Request ```bash Test Authentication curl -X GET "https://ai.costa.app/api/v1/models" \ -H "Authorization: Bearer costa_ent_your_key_here" \ -H "Content-Type: application/json" ``` ```python Python Test import requests response = requests.get( "https://ai.costa.app/api/v1/models", headers={ "Authorization": "Bearer costa_ent_your_key_here", "Content-Type": "application/json" } ) if response.status_code == 200: print("Authentication successful!") print(response.json()) else: print(f"Authentication failed: {response.status_code}") ``` ## Need Help? Get help with API authentication and integration Questions about API security and best practices Discuss enterprise authentication requirements Complete API reference and examples ``` ### Overview URL: https://docs.costa.security/security/overview ```mdx Apply # Security Overview Our platform is built with security as a foundation, not an afterthought. We maintain rigorous security standards and compliance certifications to ensure your data is protected. ## Compliance & Certifications **: Export data in machine-readable format - **Consent Management**: Clear consent mechanisms - **Data Protection Officer**: Dedicated DPO for GDPR compliance - **Privacy by Design**: Built-in privacy protections **EU Data Processing**: - EU-only data processing options - Data residency in EU regions - Standard Contractual Clauses (SCCs) - Regular compliance assessments HIPAA compliance requires specific configuration and Business Associate Agreement (BAA). **HIPAA Features**: - **Administrative Safeguards**: Access controls and workforce training - **Physical Safeguards**: Facility access and workstation security - **Technical Safeguards**: Encryption and audit controls - **Business Associate Agreement**: Available for covered entities **Protected Health Information (PHI)**: - End-to-end encryption for PHI - Access logging and monitoring - Breach notification procedures - Regular risk assessments International standard for information security management systems (ISMS). **Security Controls**: - **Information Security Policies**: Comprehensive security framework - **Risk Management**: Systematic risk assessment and treatment - **Asset Management**: Inventory and classification of information assets - **Incident Management**: Structured incident response procedures **Continuous Improvement**: - Regular security assessments - Management reviews and updates - Employee security training - Third-party security evaluations ## Security Monitoring Continuous monitoring of all systems with automated threat detection Dedicated security team with 24/7 incident response capabilities Regular security assessments and vulnerability remediation Integration with global threat intelligence feeds and analysis ## Data Protection **Data in Transit**: - TLS 1.3 for all API communications - Certificate pinning for mobile applications - Perfect Forward Secrecy (PFS) - HSTS enforcement for web interfaces **Data at Rest**: - AES-256 encryption for all stored data - Key management with HSM integration - Encrypted database storage - Secure backup and recovery **Key Management**: - Hardware Security Modules (HSM) - Key rotation policies - Secure key distribution - Multi-party key authorization **Data Collection**: - Minimal data collection principles - Clear data classification policies - Consent management systems - Data quality controls **Data Processing**: - Purpose limitation enforcement - Processing transparency - Data minimization practices - Automated data governance **Data Retention**: - Configurable retention policies - Automated data purging - Legal hold capabilities - Data archival procedures **Data Deletion**: - Secure data wiping procedures - Certificate of destruction - Backup data removal - Audit trail maintenance **Privacy by Design**: - Built-in privacy protections - Default privacy settings - Privacy impact assessments - Data protection engineering **User Rights**: - Right to access personal data - Right to rectification - Right to erasure (right to be forgotten) - Right to data portability - Right to object to processing **Consent Management**: - Granular consent controls - Consent withdrawal mechanisms - Consent audit trails - Regular consent reviews ## Security Best Practices **Authentication**: - Strong API key generation - Regular key rotation (recommended every 90 days) - Multi-factor authentication for key generation - IP allowlisting for enhanced security **Authorization**: - Principle of least privilege - Scope-limited API keys - Rate limiting and throttling - Request signing for critical operations **Monitoring**: - Real-time API usage monitoring - Anomaly detection for unusual patterns - Automated alerts for security events - Comprehensive audit logging **Secure Coding**: - Input validation and sanitization - Output encoding and escaping - SQL injection prevention - Cross-site scripting (XSS) protection **Code Review**: - Mandatory security code reviews - Automated security scanning - Dependency vulnerability checking - Static application security testing (SAST) **Deployment Security**: - Secure CI/CD pipelines - Container security scanning - Infrastructure as code security - Runtime application self-protection (RASP) **Security Training**: - Regular security awareness training - Phishing simulation exercises - Incident response training - Security policy education **Access Management**: - Regular access reviews - Automated user provisioning/deprovisioning - Privileged access management (PAM) - Just-in-time access for sensitive operations **Vendor Management**: - Third-party security assessments - Vendor risk management program - Supply chain security reviews - Business continuity planning ## Incident Response Automated monitoring systems detect potential security incidents Security team analyzes the incident scope and impact Immediate actions to contain and isolate the incident Remove the threat and address root causes Restore normal operations with enhanced monitoring Post-incident review and security improvements ## Security Reporting We believe in transparency about our security practices and incident response. **Available Reports**: - **SOC 2 Reports**: Available to enterprise customers under NDA - **Penetration Testing**: Annual third-party security assessments - **Vulnerability Assessments**: Regular security scanning reports - **Compliance Attestations**: Certification and compliance documentation **Security Contact**: - **Security Team**: security@costa.security - **Vulnerability Reports**: security@costa.security (PGP key available) - **Emergency Contact**: +1-800-COSTA-AI (24/7 security hotline) ## Additional Resources Detailed technical security documentation Compliance certifications and attestations Real-time security and compliance status Responsible disclosure and security research Security best practices for developers Incident response procedures and contacts ``` ## Priority Documentation Summary - https://docs.costa.security/index — Index - https://docs.costa.security/api-reference/introduction — Introduction - https://docs.costa.security/api-reference/authentication — Authentication - https://docs.costa.security/security/overview — Overview ## All Documentation ### About URL: https://docs.costa.security/about-costa ```mdx --- title: "About" description: "Learn about Costa's features and capabilities" --- ## Key Features ### **Intelligent Code Generation** - **Multi-language Support**: Expert assistance across 50+ programming languages - **Context-Aware Suggestions**: Understands your codebase structure and patterns - **Enterprise Patterns**: Trained on secure coding practices and enterprise architecture - **Custom Fine-tuning**: Adapt models to your organization's specific coding standards ### **Advanced Security Analysis** - **Real-time Vulnerability Detection**: Identify security issues as you code - **Compliance Checking**: Automated verification against industry standards - **Secret Detection**: Prevent accidental exposure of API keys and credentials - **Code Quality Metrics**: Continuous assessment of code maintainability and performance ### **Enterprise Compliance** - **Audit Trails**: Complete logging of all AI interactions for compliance reporting - **Data Residency Control**: Choose where your code and data are processed - **Zero Retention Mode**: Optional setting to ensure no data is stored after processing - **Role-based Access**: Granular permissions and access controls for team management ## Support & Resources Complete API reference and integration guides 24/7 dedicated support for enterprise customers Detailed security and compliance documentation Custom implementation and optimization services Join our developer community for tips and support Real-time service status and updates ``` ### Chat Completions URL: https://docs.costa.security/api-reference/chat/completions ```mdx --- title: "Chat Completions" api: "POST https://ai.costa.app/api/v1/chat/completions" description: "Generate AI responses using Costa AI enterprise models with enhanced security features" --- **Interactive Testing Available**: Use the API playground below to test endpoints directly with your Costa AI API key. ## Authentication Bearer token with your Costa AI API key. Format: `Bearer costa_ent_your_key_here` Must be `application/json` Your application URL for usage tracking and analytics Human-readable name for your application ## Request Body The Costa AI model to use for completion. **Available Models:** - `costa/enterprise-coder-v1` - Optimized for coding tasks - `costa/secure-claude-3-5-sonnet` - Maximum security, advanced reasoning - `costa/enterprise-gpt-4-turbo` - Fast general-purpose model - `costa/compliance-assistant` - Regulatory compliance specialist Array of message objects that comprise the conversation. **Message Object:** - `role` (string): The role of the message author (`system`, `user`, or `assistant`) - `content` (string): The content of the message The maximum number of tokens to generate. Range: 1-4096 Controls randomness in the response. Range: 0.0-2.0 - `0.0` = Deterministic - `1.0` = Balanced - `2.0` = Very creative Security level for request processing. **Options:** - `standard` - Default security measures - `high` - Enhanced security protocols - `maximum` - Highest security, compliance mode Geographic region for data processing. **Available Regions:** - `us-east` - US East Coast - `us-west` - US West Coast - `eu-west` - European Union - `asia-pacific` - Asia Pacific Enable comprehensive audit logging for this request. Enable zero data retention mode - no data stored after processing. ## Interactive Testing Your API key will only be used for testing and is not stored. Always use a test key for documentation testing. ```bash cURL curl -X POST "https://ai.costa.app/api/v1/chat/completions" \ -H "Authorization: Bearer costa_ent_your_key_here" \ -H "Content-Type: application/json" \ -H "HTTP-Referer: https://docs.costa.app" \ -H "X-Title: Costa AI Documentation Test" \ -d '{ "model": "costa/enterprise-coder-v1", "messages": [ { "role": "user", "content": "Write a secure Python function to hash passwords" } ], "max_tokens": 300, "temperature": 0.1, "security_level": "high" }' ``` ```python Python import requests headers = { "Authorization": "Bearer costa_ent_your_key_here", "Content-Type": "application/json", "HTTP-Referer": "https://docs.costa.app", "X-Title": "Costa AI Python Client" } data = { "model": "costa/enterprise-coder-v1", "messages": [ { "role": "user", "content": "Write a secure Python function to hash passwords" } ], "max_tokens": 300, "temperature": 0.1, "security_level": "high" } response = requests.post( "https://ai.costa.app/api/v1/chat/completions", headers=headers, json=data ) print(response.json()) ``` ```javascript JavaScript const response = await fetch('https://ai.costa.app/api/v1/chat/completions', { method: 'POST', headers: { 'Authorization': 'Bearer costa_ent_your_key_here', 'Content-Type': 'application/json', 'HTTP-Referer': 'https://docs.costa.app', 'X-Title': 'Costa AI JS Client' }, body: JSON.stringify({ model: 'costa/enterprise-coder-v1', messages: [ { role: 'user', content: 'Write a secure Python function to hash passwords' } ], max_tokens: 300, temperature: 0.1, security_level: 'high' }) }); const data = await response.json(); console.log(data); ``` ## Response Format Unique identifier for the completion request Object type, always `chat.completion` Unix timestamp when the completion was created The Costa AI model used for the completion Array of completion choices Choice index in the array The generated message Role of the message author (`assistant`) The generated content Reason completion finished (`stop`, `length`, `content_filter`) Token usage statistics Number of tokens in the prompt Number of tokens in the completion Total tokens used Cost in USD for this request Security and compliance information Security level used for processing Geographic region where processing occurred Unique audit trail identifier Whether zero retention mode was enabled ```json Response { "id": "chatcmpl-costa-123456789", "object": "chat.completion", "created": 1704067200, "model": "costa/enterprise-coder-v1", "choices": [ { "index": 0, "message": { "role": "assistant", "content": "Here's a secure Python function to hash passwords using bcrypt:\n\n```python\nimport bcrypt\n\ndef hash_password(password: str) -> str:\n \"\"\"\n Securely hash a password using bcrypt with salt.\n \n Args:\n password (str): The plain text password to hash\n \n Returns:\n str: The hashed password\n \"\"\"\n # Generate salt and hash password\n salt = bcrypt.gensalt(rounds=12)\n hashed = bcrypt.hashpw(password.encode('utf-8'), salt)\n return hashed.decode('utf-8')\n\ndef verify_password(password: str, hashed: str) -> bool:\n \"\"\"\n Verify a password against its hash.\n \n Args:\n password (str): Plain text password\n hashed (str): Hashed password to verify against\n \n Returns:\n bool: True if password matches, False otherwise\n \"\"\"\n return bcrypt.checkpw(password.encode('utf-8'), hashed.encode('utf-8'))\n```\n\nThis implementation uses bcrypt with 12 rounds for strong security." }, "finish_reason": "stop" } ], "usage": { "prompt_tokens": 12, "completion_tokens": 245, "total_tokens": 257, "cost_usd": 0.00385 }, "security": { "level": "high", "data_residency": "us-east", "audit_id": "audit_costa_20240101_123456", "zero_retention": false } } ``` ## Error Responses Error information when request fails Human-readable error description Error type (`invalid_request_error`, `authentication_error`, `rate_limit_error`) Specific error code for debugging ```json Error Response { "error": { "message": "Invalid API key provided", "type": "authentication_error", "code": "invalid_api_key" } } ``` ## Model-Specific Examples ```json Coding Tasks { "model": "costa/enterprise-coder-v1", "messages": [ { "role": "user", "content": "Create a RESTful API endpoint for user authentication with rate limiting" } ], "max_tokens": 500, "temperature": 0.1 } ``` ```json High Security { "model": "costa/secure-claude-3-5-sonnet", "messages": [ { "role": "user", "content": "Review this financial algorithm for security vulnerabilities" } ], "max_tokens": 800, "temperature": 0.0, "security_level": "maximum", "zero_retention": true } ``` ```json Compliance Check { "model": "costa/compliance-assistant", "messages": [ { "role": "user", "content": "Verify this healthcare data processing code meets HIPAA requirements" } ], "max_tokens": 1000, "security_level": "maximum", "audit_enabled": true } ``` If you encounter issues with the interactive testing or need assistance with integration: - **Enterprise Support**: enterprise-support@costa.security - **Developer Discord**: [Join our community](https://discord.gg/costa-ai) - **Documentation Issues**: [Report on GitHub](https://github.com/costa-ai/docs) ``` ### Create Plant URL: https://docs.costa.security/api-reference/endpoint/create ```mdx --- title: 'Create Plant' openapi: 'POST /plants' --- ``` ### Delete Plant URL: https://docs.costa.security/api-reference/endpoint/delete ```mdx --- title: 'Delete Plant' openapi: 'DELETE /plants/{id}' --- ``` ### Get Plants URL: https://docs.costa.security/api-reference/endpoint/get ```mdx --- title: 'Get Plants' openapi: 'GET /plants' --- ``` ### New Plant URL: https://docs.costa.security/api-reference/endpoint/webhook ```mdx --- title: 'New Plant' openapi: 'WEBHOOK /plant/webhook' --- ``` ### Errors URL: https://docs.costa.security/api-reference/errors ```mdx **Cause**: Insufficient permissions or access to requested resource ```json { "error": { "type": "permission_error", "code": "insufficient_permissions", "message": "Your API key does not have permission to access this resource." } } ``` **Solutions**: - Check API key permissions - Upgrade subscription tier - Contact support for model access **Cause**: Too many requests ```json { "error": { "type": "rate_limit_error", "code": "rate_limit_exceeded", "message": "Rate limit exceeded. Try again in 60 seconds." } } ``` **Solutions**: - Implement exponential backoff - Check rate limit headers - Upgrade to higher tier **Cause**: Invalid request parameters ```json { "error": { "type": "validation_error", "code": "invalid_parameter", "message": "Temperature must be between 0 and 2" } } ``` **Solutions**: - Validate request parameters - Check API documentation - Ensure proper data types ## Error Handling Best Practices Implement exponential backoff for transient errors Log errors with context for debugging Provide graceful degradation when APIs fail Monitor error rates and response times ## Example Error Handling ```python import requests import time from typing import Dict, Any def call_costa_ai(payload: Dict[str, Any], max_retries: int = 3) -> Dict: for attempt in range(max_retries): try: response = requests.post( "https://ai.costa.app/api/v1/chat/completions", headers={ "Authorization": "Bearer costa_ent_your_key_here", "Content-Type": "application/json" }, json=payload, timeout=30 ) if response.status_code == 200: return response.json() elif response.status_code == 429: # Rate limited - wait and retry retry_after = int(response.headers.get('Retry-After', 60)) time.sleep(retry_after) continue elif response.status_code == 401: # Authentication error - don't retry raise Exception("Invalid API key") else: # Other errors - exponential backoff wait_time = 2 ** attempt time.sleep(wait_time) continue except requests.exceptions.RequestException as e: if attempt == max_retries - 1: raise e time.sleep(2 ** attempt) raise Exception("Max retries exceeded") ``` ```javascript async function callCostaAI(payload, maxRetries = 3) { for (let attempt = 0; attempt < maxRetries; attempt++) { try { const response = await fetch('https://ai.costa.app/api/v1/chat/completions', { method: 'POST', headers: { 'Authorization': 'Bearer costa_ent_your_key_here', 'Content-Type': 'application/json' }, body: JSON.stringify(payload) }); if (response.ok) { return await response.json(); } if (response.status === 429) { // Rate limited const retryAfter = response.headers.get('Retry-After') || 60; await new Promise(resolve => setTimeout(resolve, retryAfter * 1000)); continue; } if (response.status === 401) { // Don't retry auth errors throw new Error('Invalid API key'); } // Exponential backoff for other errors const waitTime = Math.pow(2, attempt) * 1000; await new Promise(resolve => setTimeout(resolve, waitTime)); } catch (error) { if (attempt === maxRetries - 1) { throw error; } const waitTime = Math.pow(2, attempt) * 1000; await new Promise(resolve => setTimeout(resolve, waitTime)); } } throw new Error('Max retries exceeded'); } ``` For more information, see our [API Authentication](/api-reference/authentication) and [Rate Limits](/api-reference/rate-limits) documentation. ``` ### Rate Limits URL: https://docs.costa.security/api-reference/rate-limits ```mdx --- title: "Rate Limits" description: "Understanding API rate limits and how to handle them" icon: "gauge" --- Costa AI implements fair usage rate limits to ensure optimal performance for all users. ## Current Rate Limits - **100 requests** per hour - **10,000 tokens** per day - **10 concurrent** requests - **Basic models** only - **1,000 requests** per hour - **100,000 tokens** per day - **50 concurrent** requests - **Standard models** included - **10,000+ requests** per hour - **1,000,000+ tokens** per day - **200+ concurrent** requests - **All models** + custom models ## Handling Rate Limits All API responses include rate limit headers to help you manage your usage. ### Response Headers ```http X-RateLimit-Limit: 1000 X-RateLimit-Remaining: 999 X-RateLimit-Reset: 1640995200 X-RateLimit-Window: 3600 ``` ### Best Practices Implement exponential backoff when you receive a 429 rate limit error Batch multiple operations into single requests when possible Cache responses to reduce redundant API calls [Contact us](mailto:enterprise@costa.security) to discuss higher rate limits for enterprise use cases. ``` ### Providers URL: https://docs.costa.security/byok ```mdx --- title: "Providers" description: "Use your own LLM API key with Costa" --- ## What is Setup your provider keys? Bring Your Own Key allows you to use your own providers API keys with Costa. Instead of using Costa's shared keys, you can configure your agents to use your personal or enterprise API keys from providers like Anthropic, OpenAI, etc. Codex CLI interface

bring your own key

## How it works 1. You obtain API keys from your preferred LLM providers 2. You add these keys to your Costa settings in the dashboard 3. When agents make requests, they use your keys instead of Costa's shared keys 4. Billing and usage stay directly tied to your provider accounts ## Adding your keys To configure Provider keys in Costa: 1. Go to your **Settings** in the Costa dashboard 2. Navigate to the **Providers** section 3. Click **Add Provider Key** 4. Select your provider (Anthropic, OpenAI, etc.) 5. Enter your API key 6. Save the configuration ## Supported providers - Anthropic - OpenAI - Gemini - Openrouter - Z.ai ## Benefits - **Cost control**: You're billed directly by the provider - **Rate limits**: Your usage is subject to your provider's limits, not shared ones - **Privacy**: Requests use your credentials - **Flexibility**: Use keys with specific permissions or quotas ## Best practices - Use keys with appropriate permissions for your use case - Monitor your provider's usage and billing dashboards - Rotate keys regularly for security - Use different keys for different projects or environments ## Technical notes When using your own provider keys, Costa routes requests directly to the LLM provider using your credentials. Costa does not store or intermediate your keys - they are used solely for authenticating requests to the provider APIs. ``` ### API Updates URL: https://docs.costa.security/changelog/api_updates ```mdx --- title: API Updates --- ### What's New ✨ - **Get Started**: New onboarding paths for Claude Code, Codex, and opencode — every console pointed at the same gateway. - **BYOK**: Bring your own provider keys and route them through Costa's control plane. - **Claude Code Gateway**: A dedicated guide to routing Claude Code through Costa. ### _Costa Starlog 💫_ > Agents take the keys —
> Costa charts each trajectory,
> No console flies blind. ### Navigation Changes 🧭 - **Costa Orbit**: Updated models to match latest changes ### _Costa Starlog 💫_ > Orbit hums to life,
> Haiku joins the starry mesh —
> Code dreams, softly linked. ### Initial Documentation 📚 - **Costa Documentation**: Complete documentation restructure with dedicated sections for Cosmic Routers, Models, Sessions, Points system, and Pricing - **Integration Guides**: Added Claude Code integration guide and updated existing guides for various IDEs and tools - **Cosmic Routers**: New intelligent routing system documentation with model selection quiz and performance analytics - **Security**: Comprehensive security documentation added *Note: This update only includes documentation improvements. No API endpoints or version changes were made.* ### _Costa Starlog 💫_ > Knowledge now blooms bright
> Cosmic paths illuminate
> Builders chart their course ### Initial Release 🎉 - **Documentation**: Partial reference with interactive testing, code samples in multiple languages, and model-specific examples. - **Support for the following endpoints:** ``
``
``
``
### _Costa Starlog 💫_ > Stars charted at last
> Maps of code and paths revealed
> Voyage can begin ``` ### Claude Code Max Gateway URL: https://docs.costa.security/claude-code-gateway ```mdx --- title: Claude Code Max Gateway description: Use Costa with your Claude Code Subscription - setup in seconds. --- ## Prerequisites - A Costa API key (get one from [https://ai.costa.app](https://ai.costa.app)) - Claude Code installed ## Setup The fastest way to set up Claude Code with Costa is using the [Costa CLI ](/cli): ```bash costa setup claude ``` That's it! Your Claude Code is now configured to use Costa. If you prefer to configure manually, open your Claude Code settings file: ```bash vim ~/.claude/settings.json ``` Add the following configuration: ```json { "env": { "ANTHROPIC_BASE_URL": "https://ai.costa.app/api", "ANTHROPIC_CUSTOM_HEADERS": "costa-api-key: YOUR_COSTA_KEY_HERE" }, "statusLine": { "command": "costa status --format claude-code", "padding": 0, "type": "command" } } ``` Replace `YOUR_COSTA_KEY_HERE` with your actual Costa API key. Save the file and restart Claude Code. ## Verification After saving the settings file, restart Claude Code. You can verify the configuration is working by checking the status line (if configured) or by running a Claude Code command - it should now route through Costa. ## Troubleshooting - **Configuration not applied**: Make sure you saved `~/.claude/settings.json` and restarted Claude Code - **JSON syntax errors**: Verify your JSON is valid (no trailing commas, proper quotes) - **Authentication errors**: Verify your Costa API key is correct and active - **Connection errors**: Check that you can reach `https://ai.costa.app/api` - **Settings file doesn't exist**: Create the `~/.claude` directory first with `mkdir -p ~/.claude` ``` ### Costa CLI URL: https://docs.costa.security/cli ```mdx --- title: Costa CLI description: Authenticate to Costa and connect your AI coding tools (Claude Code, Codex, and more) to Costa’s API and models. --- ### What is `costa` CLI? `costa` is the command-line tool for managing **Costa authentication** and **IDE / agent integrations**. With `costa` CLI, you can: - Connect Costa to your AI coding tools (Claude Code, Codex, and more) - Check your Costa usage (sessions and points) It is open source: https://github.com/costa-app/costa-cli --- ### Installation ### Homebrew (macOS) ```bash curl -fsSL https://raw.githubusercontent.com/costa-app/costa-cli/main/install.sh | sh ``` ### Linux (amd64) ```bash curl -fsSL https://raw.githubusercontent.com/costa-app/costa-cli/main/install.sh | sh ``` Coming soon... ### How to use? ```bash costa login ``` This opens your browser to complete OAuth authentication and securely stores credentials at: ```bash ~/.config/costa/token.json ``` ```bash costa setup claude-code ``` This configures Claude Code (CLI or VS Code extension) to use Costa’s API. ```bash ~/.claude/settings.json ``` ```bash costa setup status claude-code ``` ``` ### 💫 Cosmic Routers URL: https://docs.costa.security/cosmic-routers ```mdx --- sidebarTitle: 'Cosmic Routers' title: "💫 Cosmic Routers" icon: https://docs-cdn.costa.security/images/cosmic.svg --- # What is a Cosmic Router? **Cosmic Routers** are agentic routers that take coding to the next level. They intelligently select the best model for every request — giving **better outcomes** at **faster speeds** with **lower costs**. And they work inside of the apps you already use and love. Different models are good at different things, and Cosmic Routers unlock that potential across ecosystems. ```mermaid flowchart LR A[👨‍🚀 Coder via Claude/Cursor/...] --> B[💫 Cosmic Router] B --> C[🏛️ Architect Model] B --> D[💻 Coding Model] B --> E[📖 Documenting Model] B --> F[⚡️ Optimization Model] ``` --- # How do Cosmic Routers work? **First, every request is individually analyzed** Costa deeply analyzes a request before sending it to a model. It chooses the best model for the request based on: 1. `🔀` **type** — semantic analysis of task (coding, planning, documenting, etc...) 2. `🏎️💨` **speed** — the latest response times and model output speed (TTFT and TPS) 3. `🏔️` **complexity** — is this an easy or difficult task **Then, every request is individually secured** ```mermaid flowchart LR A[👨‍🚀 Coder via Claude/Cursor/...] -- Unfiltered Request --> B[💫 Costa Auto Router] B -- Filtered Request --> C[🤖 AI Model] C -- Filtered Response --> B B -- Unfiltered Response --> A ``` Every request is filtered (often redacted) for security before it is sent to a model. The results are then unredacted, the result is analyzed for security, and it is passed back to the user. This all happens in real time and faster than the speed of inference. ### Why secure requests? Cosmic Routers combine the performance of using frontier models for complex tasks with the security and cost advantages of low-cost open-weight models. But this also increases your attack surface. Without careful safeguards, routing across multiple models is dangerous. Cosmic Routers are built to close security gaps by securing every request end-to-end. We call this **Zero Trust AI**. --- # How powerful is Cosmic Routing? The latest research shows that adaptive routing can [**match the strongest models' accuracy while cutting costs by over 25%**](https://arxiv.org/pdf/2508.12631), or deliver [**90% of peak performance at more than 60% lower cost**](https://arxiv.org/pdf/2508.12631). With Cosmic Routers, those savings aren't just theoretical—we **pass them along directly to you**. And we do it all **securely**. Every routing decision happens inside Costa's zero-trust infrastructure, ensuring requests and responses remain private, protected, and compliant. Just doing a random coin flip on each request between two of the latest models [increases the SWEBench score by more than 3%](https://www.swebench.com/SWE-bench/blog/2025/08/19/mini-roulette/). Cosmic Routers raise SWEBench scores of the underlying models even more while costing an order of magnitude less — and those improvements are shared across all of your coding agents. --- # Which Cosmic Router should I choose? Costa offers multiple Cosmic Routers that all work slightly differently. In order to help you choose the best Cosmic Router for each task, we provide a model card, which is sort of like a nutrition label but for AI:

💫 Orbit

`costa/orbit`

**SWEBench:** 72.1

**Models Included:**

`vertex/claude-opus-4.6`

`vertex/claude-sonnet-4.5`

`vertex/claude-haiku-4.5`

`openai/gpt-5.2-codex`

`openai/gpt-5-mini`

`openai/gpt-4.1`

`vertex/gemini-3-flash`

`vertex/gemini-3-pro`

`vertex/qwen3-coder`

`vertex/glm-4.7`

`vertex/kimi-k2`

**Last Changed** 2026-02-06

**Stability:** 🛰️ Stable

**Pricing Tier:** ✨ Cosmic

💫 Nebula

`costa/nebula`

**SWEBench:** 75.9

**Models Included:**

`vertex/claude-opus-4.6`

`vertex/claude-4.5-sonnet`

`vertex/gemini-3-pro`

`openai/gpt-5.2-codex`

`vertex/qwen3-coder`

`vertex/glm-4.7`

**Last Changed** 2026-02-06

**Stability:** 🛰️ Stable

**Pricing Tier:** ✨ Cosmic

The model card lets you know which models may be called, what problems the Cosmic Router is designed to solve, and how often you can expect it to change. Because there are so many agentic coding tools, and most of them are constantly changing, we are always tuning Cosmic Routers to work well with the latest models and techniques. --- # Cosmic Routing means lower cost to you `💫 Costa Orbit` is almost as powerful as Claude Sonnet 4.5 / Gemini 3-pro...

```mermaid --- config: xyChart: plotReservedSpacePercent: 80 --- xychart-beta title "Coding Performance (higher is better)" x-axis ["Opus 4.6", "Sonnet 4.5", "Gemini 3 Pro", "💫 Costa Orbit", "GPT-5.2", "GLM4.7", "Qwen3-Coder"] y-axis "SWE-bench % Resolved" 0 --> 100 bar [80.8, 77.2, 74.2, 72.1, 71.8, 73.8, 70.6] ```

... and because of Costa's **Zero Trust AI**, we are able to offer `💫 Costa Orbit` at **1/20th of the price** of Claude Sonnet 4 and **1/5th of GPT-5 mini**: ```mermaid xychart-beta title "Cost (lower is better)" x-axis ["Claude Opus 4.6", "GPT-5 mini", "💫 Costa Orbit"] y-axis "Cost for 📖 10k context in Costa ✨ pts " 0 --> 60 bar [40, 10, 2] ``` ``` ### 🔀 Custom Routers URL: https://docs.costa.security/custom-routers ```mdx --- sidebarTitle: Custom Routers title: 🔀 Custom Routers icon: waypoints tag: coming soon --- **Custom Routers** let you control how Costa routes requests across models, providers, and policies—without changing how developers work. They enable organization-wide governance over which models are used, when they’re used, and under what constraints. Common use cases include: - Enforcing approved models or providers - Separating workloads (prod vs. sandbox, secure vs. fast) - Optimizing routing for cost, latency, or security ---

Unlock Custom Routers

Custom Routers are available on the Enterprise plan. Contact us to discuss routing policies, governance needs, and enablement.

``` ### Development URL: https://docs.costa.security/development ```mdx --- title: 'Development' description: 'Preview changes locally to update your docs' --- **Prerequisite**: Please install Node.js (version 19 or higher) before proceeding.
Please upgrade to ```docs.json``` before proceeding and delete the legacy ```mint.json``` file. Follow these steps to install and run Mintlify on your operating system: **Step 1**: Install Mintlify: ```bash npm npm i -g mintlify ``` ```bash yarn yarn global add mintlify ``` **Step 2**: Navigate to the docs directory (where the `docs.json` file is located) and execute the following command: ```bash mintlify dev ``` A local preview of your documentation will be available at `http://localhost:3000`. ### Custom Ports By default, Mintlify uses port 3000. You can customize the port Mintlify runs on by using the `--port` flag. To run Mintlify on port 3333, for instance, use this command: ```bash mintlify dev --port 3333 ``` If you attempt to run Mintlify on a port that's already in use, it will use the next available port: ```md Port 3000 is already in use. Trying 3001 instead. ``` ## Mintlify Versions Please note that each CLI release is associated with a specific version of Mintlify. If your local website doesn't align with the production version, please update the CLI: ```bash npm npm i -g mintlify@latest ``` ```bash yarn yarn global upgrade mintlify ``` ## Validating Links The CLI can assist with validating reference links made in your documentation. To identify any broken links, use the following command: ```bash mintlify broken-links ``` ## Deployment Unlimited editors available under the [Pro Plan](https://mintlify.com/pricing) and above. If the deployment is successful, you should see the following:

## Code Formatting We suggest using extensions on your IDE to recognize and format MDX. If you're a VSCode user, consider the [MDX VSCode extension](https://marketplace.visualstudio.com/items?itemName=unifiedjs.vscode-mdx) for syntax highlighting, and [Prettier](https://marketplace.visualstudio.com/items?itemName=esbenp.prettier-vscode) for code formatting. ## Troubleshooting This may be due to an outdated version of node. Try the following: 1. Remove the currently-installed version of mintlify: `npm remove -g mintlify` 2. Upgrade to Node v19 or higher. 3. Reinstall mintlify: `npm install -g mintlify` Solution: Go to the root of your device and delete the \~/.mintlify folder. Afterwards, run `mintlify dev` again. Curious about what changed in the CLI version? [Check out the CLI changelog.](https://www.npmjs.com/package/mintlify?activeTab=versions) ``` ### Team Management URL: https://docs.costa.security/enterprise/team-management ```mdx --- title: "Team Management" description: "Manage your organization's Costa AI usage, permissions, and billing" icon: "users" --- Centrally manage your organization's AI usage with role-based access controls, usage quotas, and detailed analytics. ## User Management Assign different permission levels to team members based on their role and responsibilities Organize users into departments with specific model access and usage limits Set monthly token limits and spending caps per user or department Track all user activities with comprehensive logging and reporting ## Permission Levels **Full Access**: Complete control over organization settings, billing, and user management **Capabilities**: - Add/remove users and set permissions - Configure organization-wide security settings - Access all usage analytics and audit logs - Manage billing and payment methods - Set up SSO and compliance features **Team Oversight**: Manage specific departments or teams with limited admin privileges **Capabilities**: - View team usage and analytics - Set quotas for team members - Access department-specific audit logs - Request new model access for team - View cost allocation for their department **Standard Access**: Regular development access with model usage permissions **Capabilities**: - Use assigned AI models in IDE integrations - View personal usage statistics - Access model documentation and examples - Submit feedback and feature requests - Use API keys for development **Read-Only**: Limited access for monitoring and reporting purposes **Capabilities**: - View organization usage dashboards - Access read-only analytics reports - View team member activity summaries - Export usage data for analysis - No API access or model usage ## Department Management Go to **Settings** → **Team Management** in your Costa AI dashboard Click **"Add Department"** and enter department details Choose which models this department can access Set monthly token limits and spending caps Invite users and assign them to the department Monitor token consumption, API calls, and costs in real-time across all departments View historical usage patterns and identify optimization opportunities Set up automated alerts when departments approach their usage or spending limits Detailed breakdown of costs by department, user, and model for accurate chargeback Configure granular access controls to ensure users only have access to appropriate models and features. **Model Access Levels**: - **Basic**: Standard coding models only - **Advanced**: All models except compliance-specific - **Compliance**: Full access including regulatory models - **Custom**: Specific model combinations **Feature Access**: - **API Access**: Enable/disable API key generation - **Analytics**: Control access to usage analytics - **Audit Logs**: Restrict access to sensitive audit information - **Billing**: Control who can view cost information ## SSO Integration Integrate Costa AI with your existing identity provider for seamless user management and enhanced security. ### Supported Providers Azure AD, Okta, OneLogin, PingIdentity Google Workspace, Auth0, Keycloak Custom LDAP/AD integrations available ### Configuration Steps Email enterprise-support@costa.security to initiate SSO setup Share your identity provider configuration and metadata Map user attributes and group memberships to Costa AI roles Verify SSO login works correctly with test users Enable SSO for all users with fallback authentication options ## Usage Analytics **Real-time Metrics**: - Active users and sessions - Token consumption by model - API call volume and success rates - Cost tracking and budget utilization **Historical Analysis**: - Usage trends over time - Model performance comparisons - User adoption patterns - Cost optimization opportunities **Report Types**: - Executive summaries for leadership - Department usage breakdowns - Individual user activity reports - Model performance analytics - Security and compliance reports **Export Options**: - PDF executive reports - CSV data exports - API access for custom dashboards - Scheduled email reports **Alert Types**: - Usage threshold alerts - Budget overage warnings - Security policy violations - Model performance issues - Unusual activity patterns **Notification Channels**: - Email notifications - Slack/Teams integration - Webhook endpoints - SMS alerts for critical issues ## Best Practices - **Principle of Least Privilege**: Grant users minimum necessary access - **Regular Access Reviews**: Audit user permissions quarterly - **Strong Authentication**: Require MFA for all admin accounts - **API Key Rotation**: Rotate API keys regularly and monitor usage - **Audit Monitoring**: Review audit logs for suspicious activity - **Usage Quotas**: Set appropriate limits to prevent overspend - **Model Selection**: Use cost-effective models for appropriate tasks - **Monitoring**: Regular review of usage patterns and costs - **Training**: Educate users on efficient AI usage practices - **Budgeting**: Plan AI costs as part of development budget - **Training Programs**: Provide comprehensive onboarding - **Documentation**: Maintain up-to-date integration guides - **Support Channels**: Establish clear support processes - **Feedback Loops**: Regular user feedback collection - **Success Metrics**: Track adoption and productivity gains ## Support & Resources 24/7 dedicated support for team management and configuration issues Your dedicated account manager for strategic guidance and planning Custom training programs for your team and organization Complete technical documentation and integration guides ``` ### Code Blocks URL: https://docs.costa.security/essentials/code ```mdx --- title: 'Code Blocks' description: 'Display inline code and code blocks' icon: 'code' --- ## Basic ### Inline Code To denote a `word` or `phrase` as code, enclose it in backticks (`). ``` To denote a `word` or `phrase` as code, enclose it in backticks (`). ``` ### Code Block Use [fenced code blocks](https://www.markdownguide.org/extended-syntax/#fenced-code-blocks) by enclosing code in three backticks and follow the leading ticks with the programming language of your snippet to get syntax highlighting. Optionally, you can also write the name of your code after the programming language. ```java HelloWorld.java class HelloWorld { public static void main(String[] args) { System.out.println("Hello, World!"); } } ``` ````md ```java HelloWorld.java class HelloWorld { public static void main(String[] args) { System.out.println("Hello, World!"); } } ``` ```` ``` ### Images and Embeds URL: https://docs.costa.security/essentials/images ```mdx --- title: 'Images and Embeds' description: 'Add image, video, and other HTML elements' icon: 'image' ---

## Image ### Using Markdown The [markdown syntax](https://www.markdownguide.org/basic-syntax/#images) lets you add images using the following code ```md ![title](/path/image.jpg) ``` Note that the image file size must be less than 5MB. Otherwise, we recommend hosting on a service like [Cloudinary](https://cloudinary.com/) or [S3](https://aws.amazon.com/s3/). You can then use that URL and embed. ```html

``` ## Embeds and HTML elements
Mintlify supports [HTML tags in Markdown](https://www.markdownguide.org/basic-syntax/#html). This is helpful if you prefer HTML tags to Markdown syntax, and lets you create documentation with infinite flexibility. ### iFrames Loads another HTML page within the document. Most commonly used for embedding videos. ```html ``` ``` ### Markdown Syntax URL: https://docs.costa.security/essentials/markdown ```mdx --- title: 'Markdown Syntax' description: 'Text, title, and styling in standard markdown' icon: 'text-size' --- ## Titles Best used for section headers. ```md ## Titles ``` ### Subtitles Best use to subsection headers. ```md ### Subtitles ``` Each **title** and **subtitle** creates an anchor and also shows up on the table of contents on the right. ## Text Formatting We support most markdown formatting. Simply add `**`, `_`, or `~` around text to format it. | Style | How to write it | Result | | ------------- | ----------------- | --------------- | | Bold | `**bold**` | **bold** | | Italic | `_italic_` | _italic_ | | Strikethrough | `~strikethrough~` | ~strikethrough~ | You can combine these. For example, write `**_bold and italic_**` to get **_bold and italic_** text. You need to use HTML to write superscript and subscript text. That is, add `^{` or `_{` around your text.

| Text Size | How to write it | Result |
| ----------- | ------------------------ | ---------------------- |
| Superscript | `^superscript` | ^superscript |
| Subscript | `_subscript` | _subscript |

## Linking to Pages

You can add a link by wrapping text in `[]()`. You would write `[link to google](https://google.com)` to [link to google](https://google.com).

Links to pages in your docs need to be root-relative. Basically, you should include the entire folder path. For example, `[link to text](/writing-content/text)` links to the page "Text" in our components section.

Relative links like `[link to text](../text)` will open slower because we cannot optimize them as easily.

## Blockquotes

### Singleline

To create a blockquote, add a `>` in front of a paragraph.

> Dorothy followed her through many of the beautiful rooms in her castle.

```md
> Dorothy followed her through many of the beautiful rooms in her castle.
```

### Multiline

> Dorothy followed her through many of the beautiful rooms in her castle.
>
> The Witch bade her clean the pots and kettles and sweep the floor and keep the fire fed with wood.

```md
> Dorothy followed her through many of the beautiful rooms in her castle.
>
> The Witch bade her clean the pots and kettles and sweep the floor and keep the fire fed with wood.
```

### LaTeX

Mintlify supports [LaTeX](https://www.latex-project.org) through the Latex component.

8 x (vk x H1 - H2) = (0,1)

```md
8 x (vk x H1 - H2) = (0,1)
```

```

### Navigation

URL: https://docs.costa.security/essentials/navigation

```mdx
---
title: 'Navigation'
description: 'The navigation field in docs.json defines the pages that go in the navigation menu'
icon: 'map'
---

The navigation menu is the list of links on every website.

You will likely update `docs.json` every time you add a new page. Pages do not show up automatically.

## Navigation syntax

Our navigation syntax is recursive which means you can make nested navigation groups. You don't need to include `.mdx` in page names.

```json Regular Navigation
"navigation": {
"tabs": [
{
"tab": "Docs",
"groups": [
{
"group": "Getting Started",
"pages": ["quickstart"]
}
]
}
]
}
```

```json Nested Navigation
"navigation": {
"tabs": [
{
"tab": "Docs",
"groups": [
{
"group": "Getting Started",
"pages": [
"quickstart",
{
"group": "Nested Reference Pages",
"pages": ["nested-reference-page"]
}
]
}
]
}
]
}
```

## Folders

Simply put your MDX files in folders and update the paths in `docs.json`.

For example, to have a page at `https://yoursite.com/your-folder/your-page` you would make a folder called `your-folder` containing an MDX file called `your-page.mdx`.

You cannot use `api` for the name of a folder unless you nest it inside another folder. Mintlify uses Next.js which reserves the top-level `api` folder for internal server calls. A folder name such as `api-reference` would be accepted.

```json Navigation With Folder
"navigation": {
"tabs": [
{
"tab": "Docs",
"groups": [
{
"group": "Group Name",
"pages": ["your-folder/your-page"]
}
]
}
]
}
```

## Hidden Pages

MDX files not included in `docs.json` will not show up in the sidebar but are accessible through the search bar and by linking directly to them.

```

### Reusable Snippets

URL: https://docs.costa.security/essentials/reusable-snippets

```mdx
---
title: Reusable Snippets
description: Reusable, custom snippets to keep content in sync
icon: 'recycle'
---

## Creating a custom snippet

**Pre-condition**: You must create your snippet file in the `snippets` directory.

Any page in the `snippets` directory will be treated as a snippet and will not
be rendered into a standalone page. If you want to create a standalone page
from the snippet, import the snippet into another file and call it as a
component.

### Default export

1. Add content to your snippet file that you want to re-use across multiple
locations. Optionally, you can add variables that can be filled in via props
when you import the snippet.

```mdx snippets/my-snippet.mdx
Hello world! This is my content I want to reuse across pages. My keyword of the
day is {word}.
```

The content that you want to reuse must be inside the `snippets` directory in
order for the import to work.

2. Import the snippet into your destination file.

```mdx destination-file.mdx
---
title: My title
description: My Description
---

## Header

Lorem impsum dolor sit amet.

```

### Reusable variables

1. Export a variable from your snippet file:

```mdx snippets/path/to/custom-variables.mdx
export const myName = 'my name';

export const myObject = { fruit: 'strawberries' };
```

2. Import the snippet from your destination file and use the variable:

```mdx destination-file.mdx
---
title: My title
description: My Description
---

Hello, my name is {myName} and I like {myObject.fruit}.
```

### Reusable components

1. Inside your snippet file, create a component that takes in props by exporting
your component in the form of an arrow function.

```mdx snippets/custom-component.mdx
export const MyComponent = ({ title }) => (

{title}
... snippet content ...

);
```

MDX does not compile inside the body of an arrow function. Stick to HTML
syntax when you can or use a default export if you need to use MDX.

2. Import the snippet into your destination file and pass in the props

```mdx destination-file.mdx
---
title: My title
description: My Description
---

Lorem ipsum dolor sit amet.

```

```

### Global Settings

URL: https://docs.costa.security/essentials/settings

```mdx
---
title: 'Global Settings'
description: 'Mintlify gives you complete control over the look and feel of your documentation using the docs.json file'
icon: 'gear'
---

Every Mintlify site needs a `docs.json` file with the core configuration settings. Learn more about the [properties](#properties) below.

## Properties

Name of your project. Used for the global title.

Example: `mintlify`

An array of groups with all the pages within that group

The name of the group.

Example: `Settings`

The relative paths to the markdown files that will serve as pages.

Example: `["customization", "page"]`

Path to logo image or object with path to "light" and "dark" mode logo images

Path to the logo in light mode

Path to the logo in dark mode

Where clicking on the logo links you to

Path to the favicon image

Hex color codes for your global theme

The primary color. Used for most often for highlighted content, section
headers, accents, in light mode

The primary color for dark mode. Used for most often for highlighted
content, section headers, accents, in dark mode

The primary color for important buttons

The color of the background in both light and dark mode

The hex color code of the background in light mode

The hex color code of the background in dark mode

Array of `name`s and `url`s of links you want to include in the topbar

The name of the button.

Example: `Contact us`

The url once you click on the button. Example: `https://mintlify.com/docs`

Link shows a button. GitHub shows the repo information at the url provided including the number of GitHub stars.

If `link`: What the button links to.

If `github`: Link to the repository to load GitHub information from.

Text inside the button. Only required if `type` is a `link`.

Array of version names. Only use this if you want to show different versions
of docs with a dropdown in the navigation bar.

An array of the anchors, includes the `icon`, `color`, and `url`.

The [Font Awesome](https://fontawesome.com/search?q=heart) icon used to feature the anchor.

Example: `comments`

The name of the anchor label.

Example: `Community`

The start of the URL that marks what pages go in the anchor. Generally, this is the name of the folder you put your pages in.

The hex color of the anchor icon background. Can also be a gradient if you pass an object with the properties `from` and `to` that are each a hex color.

Used if you want to hide an anchor until the correct docs version is selected.

Pass `true` if you want to hide the anchor until you directly link someone to docs inside it.

One of: "brands", "duotone", "light", "sharp-solid", "solid", or "thin"

Override the default configurations for the top-most anchor.

The name of the top-most anchor

Font Awesome icon.

One of: "brands", "duotone", "light", "sharp-solid", "solid", or "thin"

An array of navigational tabs.

The name of the tab label.

The start of the URL that marks what pages go in the tab. Generally, this
is the name of the folder you put your pages in.

Configuration for API settings. Learn more about API pages at [API Components](/api-playground/demo).

The base url for all API endpoints. If `baseUrl` is an array, it will enable for multiple base url
options that the user can toggle.

The authentication strategy used for all API endpoints.

The name of the authentication parameter used in the API playground.

If method is `basic`, the format should be `[usernameName]:[passwordName]`

The default value that's designed to be a prefix for the authentication input field.

E.g. If an `inputPrefix` of `AuthKey` would inherit the default input result of the authentication field as `AuthKey`.

Configurations for the API playground

Whether the playground is showing, hidden, or only displaying the endpoint with no added user interactivity `simple`

Learn more at the [playground guides](/api-playground/demo)

Enabling this flag ensures that key ordering in OpenAPI pages matches the key ordering defined in the OpenAPI file.

This behavior will soon be enabled by default, at which point this field will be deprecated.

A string or an array of strings of URL(s) or relative path(s) pointing to your
OpenAPI file.

Examples:

```json Absolute
"openapi": "https://example.com/openapi.json"
```
```json Relative
"openapi": "/openapi.json"
```
```json Multiple
"openapi": ["https://example.com/openapi1.json", "/openapi2.json", "/openapi3.json"]
```

An object of social media accounts where the key:property pair represents the social media platform and the account url.

Example:
```json
{
"x": "https://x.com/mintlify",
"website": "https://mintlify.com"
}
```

One of the following values `website`, `facebook`, `x`, `discord`, `slack`, `github`, `linkedin`, `instagram`, `hacker-news`

Example: `x`

The URL to the social platform.

Example: `https://x.com/mintlify`

Configurations to enable feedback buttons

Enables a button to allow users to suggest edits via pull requests

Enables a button to allow users to raise an issue about the documentation

Customize the dark mode toggle.

Set if you always want to show light or dark mode for new users. When not
set, we default to the same mode as the user's operating system.

Set to true to hide the dark/light mode toggle. You can combine `isHidden` with `default` to force your docs to only use light or dark mode. For example:

```json Only Dark Mode
"modeToggle": {
"default": "dark",
"isHidden": true
}
```

```json Only Light Mode
"modeToggle": {
"default": "light",
"isHidden": true
}
```

A background image to be displayed behind every page. See example with
[Infisical](https://infisical.com/docs) and [FRPC](https://frpc.io).

```

### Use your Anthropic API key

URL: https://docs.costa.security/get-started/anthropic-api-key

```mdx
---
title: "Use your Anthropic API key"
icon: key
---

If you don't have a Claude Code subscription, you can use your own Anthropic API key instead. Add it once in your Costa dashboard and Claude Code will route through it.

1. Go to [**AI Providers**](https://ai.costa.app/admin/ai_providers) in your Costa dashboard.
2. Find the **Anthropic** row and open the **⋮** menu.
3. Click **Edit token** and paste your Anthropic API key.

That's it.

Continue.

_{Using a different provider? See [Providers →](/byok).}

```

### Setup Claude Code

URL: https://docs.costa.security/get-started/claude-code

```mdx
---
title: "Setup Claude Code"
sidebarTitle: "Claude Code"
icon: https://docs-cdn.costa.security/images/claude.svg
hideFooterPagination: true
---

Connect Claude Code to Costa. Turn on Trim. Build a Cosmic Router.

Using a different tool? Codex · opencode · something else

## Before you start

You'll need:

- **Claude Code** installed and signed in **with a subscription**.
- A terminal you're comfortable in.

Don't have a Claude Code subscription? [Get one from Anthropic →](https://www.anthropic.com/claude-code), [use your own Anthropic API key →](/get-started/anthropic-api-key), or [add another provider →](/byok).

Copy this into your terminal and run it:

```bash
curl -fsSL https://raw.githubusercontent.com/costa-app/costa-cli/main/install.sh | sh -
```

When the install finishes, Costa walks you through:

1. Creating your Costa account.
2. Picking a **callsign** — your public username on Costa.
3. Landing on the **Integrations** menu.

Stay in the TUI. The next step happens there.

You're now on the Integrations tab. You'll see something like this:

{"\n ╭──────────────────╮ ╭────────────╮ ╭─────────────╮ ╭──────────────╮\n │ Integrations │ │ Tokens │ │ Threads │ │ Settings │\n │ │ ╰───────────────────────────────────────────────╯\n\n Integration Installed Enabled Token Agent\n ─────────────────────────────────────────────────────────\n▸ claude-code ✓ yes ✗ no — —\n codex ✓ yes ✗ no — —\n kilo ✗ no ✗ no — —\n opencode ✗ no ✗ no — —\n\n enter to enable costa"}

Use the arrow keys to highlight **claude-code**, then press **Enter**. Costa writes a Costa profile into `~/.claude/config.json` and flips the row to **Enabled ✓**.

**Restart Claude Code** so it picks up the new config.

Open Claude Code (i.e. with `claude`) and ask it to do something real — fix a bug, write a test, refactor a file. Then open your [session dashboard](https://ai.costa.app/code/dashboard/sessions) and watch your messages stream in.

You'll see the prompts, the model that handled it, the tool calls, and the running token count. That's Costa working underneath Claude Code. You can also view your [live dashboard](https://ai.costa.app/code/metrics/live) to see response times by provider and model.

Strip unused tokens before they reach the model.

```

### Setup Codex

URL: https://docs.costa.security/get-started/codex

```mdx
---
title: "Setup Codex"
sidebarTitle: "Codex"
icon: https://docs-cdn.costa.security/images/openai.svg
hideFooterPagination: true
---

Connect Codex to Costa. Turn on Trim. Build a Cosmic Router.

Using a different tool? Claude Code · opencode · something else

## Before you start

You'll need:

- **Codex CLI** installed and signed in **with a subscription**.
- A terminal you're comfortable in.

Don't have a Codex subscription? [Get one from OpenAI →](https://openai.com/codex), [use your own OpenAI API key →](/get-started/openai-api-key), or [add another provider →](/byok).

Copy this into your terminal and run it:

```bash
curl -fsSL https://raw.githubusercontent.com/costa-app/costa-cli/main/install.sh | sh -
```

When the install finishes, Costa walks you through:

1. Creating your Costa account.
2. Picking a **callsign** — your public username on Costa.
3. Landing on the **Integrations** menu.

Stay in the TUI. The next step happens there.

You're now on the Integrations tab. You'll see something like this:

{"\n ╭──────────────────╮ ╭────────────╮ ╭─────────────╮ ╭──────────────╮\n │ Integrations │ │ Tokens │ │ Threads │ │ Settings │\n │ │ ╰───────────────────────────────────────────────╯\n\n Integration Installed Enabled Token Agent\n ─────────────────────────────────────────────────────────\n claude-code ✓ yes ✗ no — —\n▸ codex ✓ yes ✗ no — —\n kilo ✗ no ✗ no — —\n opencode ✗ no ✗ no — —\n\n enter to enable costa"}

Use the arrow keys to highlight **codex**, then press **Enter**. Costa writes a Costa profile into `~/.codex/config.toml` and flips the row to **Enabled ✓**.

**Restart Codex** so it picks up the new config.

Open Codex with `codex` and ask it to do something real — fix a bug, write a test, refactor a file. Then open your [session dashboard](https://ai.costa.app/code/dashboard/sessions) and watch your messages stream in.

You'll see the prompts, the model that handled it, the tool calls, and the running token count. That's Costa working underneath Codex. You can also view your [live dashboard](https://ai.costa.app/code/metrics/live) to see response times by provider and model.

Strip unused tokens before they reach the model.

```

### Build a Cosmic Router

URL: https://docs.costa.security/get-started/cosmic-routing

```mdx
---
title: "Build a Cosmic Router"
sidebarTitle: "Build a Cosmic Router"
icon: route
hideFooterPagination: true
---

Routers only work on traffic flowing through Costa. If you haven't connected yet, [start there](/get-started/claude-code).

Cosmic Routers let you send requests to multiple models and providers. You can use them to extend your subscriptions by adding a second model.

Let's build one called `daily-driver` — 75% Opus on your Claude Max, 25% Kimi-K2.6 via OpenRouter.

Did you know, mixing models like this can increase overall performance? [Learn more](https://arxiv.org/pdf/2508.12631)

Kimi-K2.6 is on OpenRouter, so let's add it.

You'll need an OpenRouter API key. If you don't have one, [grab one from openrouter.ai](https://openrouter.ai/keys) — it takes a minute.

1. Go to [**AI Providers**](https://ai.costa.app/admin/ai_providers) and click **Add provider**.
2. Pick **OpenRouter** and paste your API key.
3. On the OpenRouter row, click **Edit models** and add `kimi-k2.6` to the enabled list.

1. Go to [**Models**](https://ai.costa.app/admin/code/models) and click **Add a router**.
2. Name it `daily-driver`.
3. Add two models with a 75/25 split:
- **75%** → `claude-opus-4.7` (your Claude Max subscription)
- **25%** → `kimi-k2.6` (via OpenRouter)
4. Save.

Your router is now available as `costa/daily-driver`.

In Claude Code, run:

```
/model daily-driver
```

{/* TODO: document how to point Codex at a Costa router */}
Not yet documented — see [Codex setup](/get-started/codex) for the model-config step.

{/* TODO: document how to point opencode at a Costa router */}
Not yet documented — see [opencode setup](/get-started/opencode) for the model-config step.

Send a few prompts. In your [session logs](https://ai.costa.app/code/sessions), click the latest session — every request shows the model your router picked, and you can watch the 75/25 split hold across the session.

That's a Cosmic Router. The subscription you already pay for. The open-weight models you heard about. Working together.

You're connected. You're trimming. You're routing. That's Costa.

Now go use it. The more traffic you send through, the more Costa learns about your work — and the more it can tell you back. We'll show you that next. But first: go build something.

```

### Use your OpenAI API key

URL: https://docs.costa.security/get-started/openai-api-key

```mdx
---
title: "Use your OpenAI API key"
icon: key
---

If you don't have a Codex subscription, you can use your own OpenAI API key instead. Add it once in your Costa dashboard and Codex will route through it.

1. Go to [**AI Providers**](https://ai.costa.app/admin/ai_providers) in your Costa dashboard.
2. Find the **OpenAI** row and open the **⋮** menu.
3. Click **Edit token** and paste your OpenAI API key.

That's it.

Continue.

_{Using a different provider? See [Providers →](/byok).}

```

### Setup opencode

URL: https://docs.costa.security/get-started/opencode

```mdx
---
title: "Setup opencode"
sidebarTitle: "opencode"
icon: square-terminal
hideFooterPagination: true
---

Connect opencode to Costa. Turn on Trim. Build a Cosmic Router.

Using a different tool? Claude Code · Codex · something else

## Before you start

You'll need:

- **opencode** installed.
- A terminal you're comfortable in.

Copy this into your terminal and run it:

```bash
curl -fsSL https://raw.githubusercontent.com/costa-app/costa-cli/main/install.sh | sh -
```

When the install finishes, Costa walks you through:

1. Creating your Costa account.
2. Picking a **callsign** — your public username on Costa.
3. Landing on the **Integrations** menu.

Stay in the TUI. The next step happens there.

You're now on the Integrations tab. You'll see something like this:

{"\n ╭──────────────────╮ ╭────────────╮ ╭─────────────╮ ╭──────────────╮\n │ Integrations │ │ Tokens │ │ Threads │ │ Settings │\n │ │ ╰───────────────────────────────────────────────╯\n\n Integration Installed Enabled Token Agent\n ─────────────────────────────────────────────────────────\n claude-code ✓ yes ✗ no — —\n codex ✓ yes ✗ no — —\n kilo ✗ no ✗ no — —\n▸ opencode ✗ no ✗ no — —\n\n enter to enable costa"}

Use the arrow keys to highlight **opencode**, then press **Enter**. Costa writes a token into `~/.config/opencode/opencode.json` and flips the row to **Enabled ✓**.

**Restart opencode** so it picks up the new config.

Open opencode with `opencode` and ask it to do something real — fix a bug, write a test, refactor a file. Then open your [session dashboard](https://ai.costa.app/code/dashboard/sessions) and watch your messages stream in.

You'll see the prompts, the model that handled it, the tool calls, and the running token count. That's Costa working underneath opencode. You can also view your [live dashboard](https://ai.costa.app/code/metrics/live) to see response times by provider and model.

Strip unused tokens before they reach the model.

```

### Turn on Trim

URL: https://docs.costa.security/get-started/trim

```mdx
---
title: "Turn on Trim"
sidebarTitle: "Turn on Trim"
icon: scissors
hideFooterPagination: true
---

When your AI runs a command, half the output is junk it doesn't need. Trim throws the junk away before it counts against your tokens. You get more out of every prompt.

Trim only works on traffic flowing through Costa. If you haven't connected your tool yet, [start there](/get-started/claude-code).

Open [Optimization Settings](https://ai.costa.app/admin/organization/optimization_settings) and toggle **Trim** on. The next request through Costa will be trimmed.

(You can also get there from **Settings → Organization Settings → Optimization**.)

Ask your AI to do something — check your git status, or run the tests.

Open [your session logs](https://ai.costa.app/code/sessions) and click the latest one. You'll see a **Trim** badge on every call that got compacted, plus exactly how many tokens it saved you.

Trim is on. From now on, every prompt goes further.

Mix your subscription models with frontier APIs on a per-request basis.

```

### 📈 Insights

URL: https://docs.costa.security/insights

```mdx
---
sidebarTitle: 'Insights'
title: 📈 Insights
icon: chart-no-axes-combined
---

## Overview

Insights turn your Costa activity into something you can understand, compare, and improve.
Instead of guessing which prompts, models, or workflows are effective, Costa shows you what actually happened and how it performed.

Insights are derived from real usage across sessions and threads.

---

## What You Can See

Costa surfaces analytics at multiple levels:

- **Session summaries**:
What was attempted, what changed, and what the outcome was.

- **Thread analytics**:
How prompts evolved, where iterations stalled, and where progress accelerated.

- **Task breakdown**:
Units of work within a session, including completion status and estimated complexity.

---

### Session Insights

Costa analyzes each session to surface:

- **Session score** — a combined signal of momentum, efficiency, and task completion
- **Time distribution** — how effort is split across planning, coding, and chat
- **Task list** — number, complexity, and completion rate of tasks
- **Tool usage patterns** — which tools and commands actually drove progress

Insights make it easy to share what worked, learn from each other’s sessions, and align on better ways of working.

For details on how sessions work, see our [ Sessions](/sessions) page.

---

### Thread Insights

Costa analyzes each thread to surface:

- **Prompt evolution** — how instructions changed and refined over the course of the thread
- **Iteration depth** — number of prompts, revisions, and intermediate reasoning steps
- **Model usage** — which models were used and how they contributed across iterations
- **Code impact** — files created or modified and the scope of changes

Thread insights help teams understand how results were reached and share effective threads as references.

For details on how threads work, see our [ 💬 Threads](/threads) page.

---

### Why Insights Matter

Costa insights are designed for **human-in-the-loop** AI-assisted coding.

They help you:
- Build faster without burning points
- Improve prompts and workflows over time
- Share high-signal examples with teammates
- Understand how AI contributes to real outcomes — not just usage volume

Insights respect your sharing, visibility, and retention settings and are private by default.

```

### Claude Code

URL: https://docs.costa.security/integrations/claude

```mdx
---
title: "Claude Code"
description: "Connect Costa to Claude Code CLI for secure AI development"
icon: https://docs-cdn.costa.security/images/claude.svg
---

## Quick Setup

Before you can use Claude Code with Costa, you need to install Claude Code. You can install it using NPM or native install methods. For detailed instructions, see the [Claude Code Quickstart Guide](https://docs.claude.com/en/docs/claude-code/quickstart).

Claude Code works seamlessly with Costa using our native Claude Code configuration. Just create a settings file and you're done.

Use this curl command to fetch your Costa configuration directly:

```bash
costa setup claude-code
```
How to install the CLI? [ click here](/cli)

### Step 1: Create Settings File

Create `.claude/settings.json` in your project directory:

```bash
mkdir -p .claude
```

### Step 2: Configure Costa Integration

Add the Costa configuration to `~/.claude/settings.json`:

```json ~/.claude/settings.json
{
"env": {
"ANTHROPIC_BASE_URL": "https://ai.costa.app/api",
"ANTHROPIC_AUTH_TOKEN": "REPLACE_WITH_YOUR_API_KEY",
"ANTHROPIC_DEFAULT_OPUS_MODEL": "costa/auto",
"ANTHROPIC_DEFAULT_SONNET_MODEL": "costa/auto",
"ANTHROPIC_DEFAULT_HAIKU_MODEL": "costa/auto",
"CLAUDE_CODE_SUBAGENT_MODEL": "costa/auto",
"DISABLE_PROMPT_CACHING": "true"
},
"model": "costa/auto",
"alwaysThinkingEnabled": true
}
```

### Step 3: Start Coding

That's it! Just run:

```bash
claude
```

Your Claude Code instance is now connected to Costa's secure infrastructure, unlocking powerful features:

- **Costa Auto Router** intelligent model selection
- **Zero-trust security** scanning all interactions
- **Enterprise compliance** and audit logging
- **Performance analytics** to track your coding efficiency and model performance

#### Claude Code CLI

Claude Code works seamlessly with Costa in the CLI...

Claude Code running in the command line interface

#### Claude Code VS Code Extension
... and also in Claude's VS Code extension.

Claude Code integrated in Visual Studio Code

### Unlock the power of Claude Code with any model
You can use any model with Claude Code, including `costa/orbit`, `gpt-5`, and others.

If you love Claude Code, but have ever wondered whether it's the IDE or models that give you that extra edge... with Costa you can break free from your IDE.

Use any model you want and compare cross-model performance with Costa's [ Analytics](/insights) over time and find the combinations that are best for you.

For a full list of available models, visit [https://ai.costa.app/code/models](https://ai.costa.app/code/models).

### Alternative Setup Methods

#### Environment Variables

Instead of the settings file, you can use environment variables:

```bash
export ANTHROPIC_BASE_URL=https://ai.costa.app/api
export ANTHROPIC_AUTH_TOKEN=your_costa_token_here
export ANTHROPIC_DEFAULT_OPUS_MODEL=costa/auto
export ANTHROPIC_DEFAULT_SONNET_MODEL=costa/auto
export ANTHROPIC_DEFAULT_HAIKU_MODEL=costa/auto
export CLAUDE_CODE_SUBAGENT_MODEL=costa/auto
export DISABLE_PROMPT_CACHING=true
claude
```

```

### Cline

URL: https://docs.costa.security/integrations/cline

```mdx
---
title: "Cline"
description: "Connect Costa to Cline for autonomous AI development"
icon: https://docs-cdn.costa.security/images/cline.svg
---

Cline integration with Costa AI is coming soon. Stay tuned for updates!

---

**Autonomous AI Development**: Cline with Costa provides powerful autonomous development capabilities. Ensure proper oversight and security measures are in place for production environments.

```

### Codex

URL: https://docs.costa.security/integrations/codex

```mdx
---
title: "Codex"
description: "Connect Costa to Codex CLI for secure AI development"
icon: https://docs-cdn.costa.security/images/openai.svg

---

### Quick Setup

Before you can use Codex with Costa, install the Codex CLI or desktop agent from the official Codex downloads page. see the [Codex CLI Quickstart Guide](https://developers.openai.com/codex/cli/).

Codex works seamlessly with Costa through a dedicated Costa profile. Just create a config.toml file (or use environment variables) with the Costa credentials shown below.

### Step 1: Install Codex

Grab the Codex CLI with npm. Use the tabs above if you prefer a different package manager.

```bash
npm i -g @openai/codex
```

### Step 2: Integrate with Costa

```bash
costa setup codex
```
How to install the CLI? [ click here](/cli)

Add the Costa profile to `~/.codex/config.toml`:

```toml ~/.codex/config.toml
model_provider="costa"

[model_providers.costa]
name = "Costa Security AI"
base_url = "https://ai.costa.app/api/v1"
requires_openai_auth = true
http_headers = { "costa-api-key" = "YOUR_COSTA_API_KEY" }
```

Replace `YOUR_COSTA_API_KEY` with your actual Costa API key from [https://ai.costa.app/code/settings](https://ai.costa.app/code/settings).

### Start Coding

That's it! Launch Codex with your usual command:

```bash
codex
```

Your Codex workspace now routes through Costa's secure inference edge, unlocking the following by default:

- **Costa Auto Router** intelligent model selection
- **Zero-trust security** scanning all interactions
- **Enterprise compliance** and audit logging
- **Performance analytics** to track your coding efficiency and model performance

#### Codex CLI

Codex works seamlessly with Costa in the CLI...

Codex running in the command line interface

#### Codex VS Code Extension

... and also in Claude's VS Code extension.

Codex integrated in Visual Studio Code

### Unlock the power of Codex CLI with any model
You can use any model with Codex CLI, including `ray-codex`, `gpt-5`, and others.

If you love Codex CLI, but have ever wondered whether it's the IDE or models that give you that extra edge... with Costa you can break free from your IDE.

Use any model you want and compare cross-model performance with Costa's [ Analytics](/insights) over time and find the combinations that are best for you.

For a full list of available models, visit [https://ai.costa.app/code/models](https://ai.costa.app/code/models).

```

### Continue

URL: https://docs.costa.security/integrations/continue

```mdx
---
description: "Connect Costa to VS Code using Continue.dev"
icon: "https://docs-cdn.costa.security/images/continue.svg"
---

## Quick Setup

### Step 1: Install VS Code
Download and install VS Code from [code.visualstudio.com](https://code.visualstudio.com)

### Step 2: Install Continue.dev Extension
1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X)
3. Search for "Continue" and install it

### Step 3: Get Your Costa Configuration
Use this curl command to fetch your Costa configuration directly:

```bash
curl -fsSL https://raw.githubusercontent.com/costa-security/install/main/continue/init.sh | bash -s --
```

Replace `YOUR_COSTA_API_KEY` with your actual API key from [ai.costa.app](https://ai.costa.app)

### Step 4: Manual Configuration (Alternative)
If you prefer to set it up manually, create `~/.continue/config.yaml`:

```yaml config.yaml
# === AUTO-GENERATED BY COSTA START ===
# This section is automatically generated by Costa.
# You may edit it, but any changes may be overwritten by future updates.
name: Costa Assistant
version: 0.1.0
schema: v1
models:
- name: 💫 Costa Auto
provider: openai
model: costa/auto
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: 💫 Costa Orbit
provider: openai
model: costa/orbit
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: 💫 Costa Nebula
provider: openai
model: costa/nebula
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Claude 4.5 Sonnet
provider: openai
model: claude-sonnet-4.5
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Claude Sonnet 4
provider: openai
model: claude-sonnet-4
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: GPT 5
provider: openai
model: gpt-5
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Gemini 2.5 Flash
provider: openai
model: gemini-2.5-flash
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Gemini 2.5 Pro
provider: openai
model: gemini-2.5-pro
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: GPT 4.1
provider: openai
model: gpt-4.1
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: kimi-k2
provider: openai
model: kimi-k2-instruct
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Llama 4 Maverick
provider: openai
model: llama-4-maverick-17b-128e-instruct
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
- name: Qwen3 Coder
provider: openai
model: qwen3-coder
apiBase: https://ai.costa.app/api/v1
apiKey: REPLACE_WITH_YOUR_API_KEY
useLegacyCompletionsEndpoint: false
capabilities:
- tool_use
# If you would like to add your own configuration(s), place it below.
# With YAML, the last key wins.
# === AUTO-GENERATED BY COSTA END ===
```

### Step 5: Add Your API Key
Replace `REPLACE_WITH_YOUR_API_KEY` with your actual Costa API key in the config file.

### Step 6: Start Coding 🎉
You have now connected Continue to Costa — start coding to your heart's content.

## Usage
- Open the Continue chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Contact us at [support@costa.app](mailto:support@costa.app)

```

### Cursor

URL: https://docs.costa.security/integrations/cursor

```mdx
---
title: "Cursor"
description: "Use Costa in Cursor via Marketplace extension"
icon: "https://docs-cdn.costa.security/images/cursor.svg"
---

## Quick Setup

### Step 1: Download Cursor
Grab the latest Cursor build from [https://cursor.com/download](https://cursor.com/download) (macOS, Windows, Linux) and sign in so settings sync across devices.

### Step 2: Choose Your App inside Cursor
Open **Extensions** (`Cmd/Ctrl+Shift+X`) and pick one of these Costa-ready agents:

- Install Kilo Code — then finish setup at [/integrations/kilo-cursor](/integrations/kilo-cursor)
- Install Roo Code — then finish setup at [/integrations/roo-cursor](/integrations/roo-cursor)
- Install Continue — then finish setup at [/integrations/continue](/integrations/continue)

All three run natively inside Cursor. Pick the one that matches how you like to work.

### Step 5: Set Your API Key
In the snippet above, replace every `REPLACE_WITH_YOUR_API_KEY` with your Costa key. Cursor picks up the Continue config automatically; restart Cursor if the models list doesn’t appear.

### Step 6: Start Coding
- For Continue: open the **Continue** panel (`Cmd/Ctrl+L`), pick a Costa model, and chat/inline-complete.
- For Kilo: open the **Kilo** sidebar and select your Costa-backed model (after importing the profile).
- For Roo Code: open **Providers** and confirm the imported Costa profile, then chat as usual.

## Usage
- Use the agent’s sidebar (Continue/Kilo/Roo) inside Cursor
- Switch models from the dropdown (all Costa models from the config will appear)
- Chat, generate, or ask for edits with the Costa-backed models

## Support
Need help? Contact [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked fast.

```

### JetBrains

URL: https://docs.costa.security/integrations/jetbrains

```mdx
---
title: "JetBrains"
icon: https://docs-cdn.costa.security/images/jetbrains.svg
---

JetBrains IDE integration with Costa is coming soon. Stay tuned for updates!

For now, you can use Costa through our API or VS Code integration.

[→ Try VS Code Integration](/vscode-extension)

```

### Kilo

URL: https://docs.costa.security/integrations/kilo-cursor

```mdx
---
title: "Kilo"
description: "Use Costa inside the Kilo Cursor agent with secure defaults"
icon: "cpu"
---

## Quick Setup

### Step 1: Install Cursor
Download and install Cursor from [cursor.com/download](https://cursor.com/download).

### Step 2: Install Kilo

Install Kilo in Cursor

import KiloConfigure from '/snippets/kilo-configure.mdx'

```

#### Imported Snippets

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

### Kilo

URL: https://docs.costa.security/integrations/kilo-jetbrains

```mdx
---
title: "Kilo"
description: "Use Costa inside the Kilo Jetbrains agent with secure defaults"
icon: "cpu"
---

## Quick Setup

### Step 1: Install Jetbrains
Download and install Cursor from [jetbrains.com/idea/download/](https://www.jetbrains.com/idea/download).

### Step 2: Install Kilo

1. Open JetBrains.
2. Go to **Extensions** (`Ctrl+Shift+X`).
3. Search for **"Kilo"** and install the official extension from Kilo Labs.

import KiloConfigure from '/snippets/kilo-configure.mdx'

```

#### Imported Snippets

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

### Kilo

URL: https://docs.costa.security/integrations/kilo-vscode

```mdx
---
title: "Kilo"
description: "Use Costa inside the Kilo VS Code agent with secure defaults"
icon: "cpu"
---

## Quick Setup

### Step 1: Install VS Code
Download and install VS Code from [code.visualstudio.com](https://code.visualstudio.com).

### Step 2: Install Kilo

Install Kilo in VS Code

import KiloConfigure from '/snippets/kilo-configure.mdx'

```

#### Imported Snippets

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

##### kilo-configure.mdx

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

### Custom Integrations

URL: https://docs.costa.security/integrations/other-agents

```mdx
---
title: "Custom Integrations"
description: "Connect Costa to any AI agent using our OpenAI-compatible API"
icon: "unplug"
---
## Universal API Integration

Costa provides an OpenAI-compatible API that works with virtually any AI agent, custom application, or automation tool. This allows you to integrate enterprise-grade AI capabilities into your existing workflows while maintaining the highest security standards.

## API Configuration

### Base Configuration

```bash Environment Variables
export COSTA_API_KEY="REPLACE_WITH_YOUR_COSTA_API_KEY"
export COSTA_BASE_URL="https://ai.costa.app/api/v1"
export COSTA_MODEL="costa/auto"
```

```yaml Configuration File
api:
provider: costa-code
base_url: https://ai.costa.app/api/v1
api_key: costa_ent_your_key_here

models:
coding: costa/enterprise-coder-v1
reasoning: costa/secure-claude-3-5-sonnet
compliance: costa/compliance-assistant

security:
level: high
data_residency: us-east
audit_enabled: true
zero_retention: false
```

```json JSON Configuration
{
"api": {
"provider": "costa-code",
"baseUrl": "https://ai.costa.app/api/v1",
"apiKey": "costa_ent_your_key_here"
},
"security": {
"level": "high",
"dataResidency": "us-east",
"auditEnabled": true,
"zeroRetention": false
}
}
```

## Integration Examples

### Python SDK Integration

```python OpenAI Python SDK
import openai

# Configure Costa as OpenAI provider
client = openai.OpenAI(
api_key="costa_ent_your_key_here",
base_url="https://ai.costa.app/api/v1"
)

# Basic chat completion
response = client.chat.completions.create(
model="costa/enterprise-coder-v1",
messages=[
{"role": "user", "content": "Write a secure Python function for user authentication"}
],
max_tokens=1000,
temperature=0.7
)

print(response.choices[0].message.content)

# With enterprise security headers
response = client.chat.completions.create(
model="costa/secure-claude-3-5-sonnet",
messages=[
{"role": "user", "content": "Review this code for security vulnerabilities"}
],
extra_headers={
"Costa-Security-Level": "maximum",
"Costa-Data-Residency": "us-east",
"Costa-Audit-Enabled": "true",
"Costa-Zero-Retention": "true"
}
)
```

```python Custom Python Integration
import requests
import json

class CostaCodeClient:
def __init__(self, api_key, base_url="https://ai.costa.app/api/v1"):
self.api_key = api_key
self.base_url = base_url
self.headers = {
"Authorization": f"Bearer {api_key}",
"Content-Type": "application/json"
}

def chat_completion(self, model, messages, **kwargs):
"""Send chat completion request to Costa"""
url = f"{self.base_url}/chat/completions"

payload = {
"model": model,
"messages": messages,
**kwargs
}

response = requests.post(url, headers=self.headers, json=payload)
response.raise_for_status()
return response.json()

def secure_completion(self, model, messages, security_level="high", **kwargs):
"""Send completion with enhanced security"""
secure_headers = {
**self.headers,
"Costa-Security-Level": security_level,
"Costa-Audit-Enabled": "true"
}

url = f"{self.base_url}/chat/completions"
payload = {
"model": model,
"messages": messages,
**kwargs
}

response = requests.post(url, headers=secure_headers, json=payload)
response.raise_for_status()
return response.json()

# Usage example
client = CostaCodeClient("costa_ent_your_key_here")

response = client.secure_completion(
model="costa/enterprise-coder-v1",
messages=[{"role": "user", "content": "Generate a secure API endpoint"}],
max_tokens=500,
security_level="maximum"
)
```

### JavaScript/Node.js Integration

```javascript OpenAI Node.js SDK
import OpenAI from 'openai';

// Configure Costa client
const openai = new OpenAI({
apiKey: 'costa_ent_your_key_here',
baseURL: 'https://ai.costa.app/api/v1'
});

// Basic completion
async function generateCode(prompt) {
const completion = await openai.chat.completions.create({
model: 'costa/enterprise-coder-v1',
messages: [{ role: 'user', content: prompt }],
max_tokens: 1000,
temperature: 0.7
});

return completion.choices[0].message.content;
}

// Enterprise security completion
async function secureGeneration(prompt, securityLevel = 'high') {
const completion = await openai.chat.completions.create({
model: 'costa/secure-claude-3-5-sonnet',
messages: [{ role: 'user', content: prompt }],
max_tokens: 1500,
extra_headers: {
'Costa-Security-Level': securityLevel,
'Costa-Audit-Enabled': 'true',
'Costa-Data-Residency': 'us-east'
}
});

return completion.choices[0].message.content;
}

// Usage
const code = await generateCode('Create a REST API for user management');
const secureCode = await secureGeneration('Review this payment processing code', 'maximum');
```

```javascript Custom Fetch Integration
class CostaCodeAPI {
constructor(apiKey, baseURL = 'https://ai.costa.app/api/v1') {
this.apiKey = apiKey;
this.baseURL = baseURL;
}

async chatCompletion(model, messages, options = {}) {
const response = await fetch(`${this.baseURL}/chat/completions`, {
method: 'POST',
headers: {
'Authorization': `Bearer ${this.apiKey}`,
'Content-Type': 'application/json',
...options.headers
},
body: JSON.stringify({
model,
messages,
...options.params
})
});

if (!response.ok) {
throw new Error(`API request failed: ${response.statusText}`);
}

return response.json();
}

async secureCompletion(model, messages, securityOptions = {}) {
const headers = {
'Costa-Security-Level': securityOptions.level || 'high',
'Costa-Audit-Enabled': 'true',
'Costa-Data-Residency': securityOptions.region || 'us-east'
};

if (securityOptions.zeroRetention) {
headers['Costa-Zero-Retention'] = 'true';
}

return this.chatCompletion(model, messages, {
headers,
params: securityOptions.params || {}
});
}
}

// Usage
const costa = new CostaCodeAPI('costa_ent_your_key_here');

const result = await costa.secureCompletion(
'costa/compliance-assistant',
[{ role: 'user', content: 'Check this healthcare code for HIPAA compliance' }],
{
level: 'maximum',
region: 'us-east',
zeroRetention: true,
params: { max_tokens: 2000 }
}
);
```

### cURL Examples

```bash Basic Chat Completion
curl -X POST "https://ai.costa.app/api/v1/chat/completions" \
-H "Authorization: Bearer costa_ent_your_key_here" \
-H "Content-Type: application/json" \
-d '{
"model": "costa/enterprise-coder-v1",
"messages": [
{
"role": "user",
"content": "Write a secure authentication middleware for Express.js"
}
],
"max_tokens": 1000,
"temperature": 0.7
}'
```

```bash Enterprise Security Request
curl -X POST "https://ai.costa.app/api/v1/chat/completions" \
-H "Authorization: Bearer costa_ent_your_key_here" \
-H "Content-Type: application/json" \
-H "Costa-Security-Level: maximum" \
-H "Costa-Data-Residency: us-east" \
-H "Costa-Audit-Enabled: true" \
-H "Costa-Zero-Retention: true" \
-d '{
"model": "costa/secure-claude-3-5-sonnet",
"messages": [
{
"role": "user",
"content": "Review this financial transaction code for SOX compliance"
}
],
"max_tokens": 2000,
"temperature": 0.3
}'
```

```bash Compliance Check Request
curl -X POST "https://ai.costa.app/api/v1/chat/completions" \
-H "Authorization: Bearer costa_ent_your_key_here" \
-H "Content-Type: application/json" \
-H "Costa-Security-Level: maximum" \
-H "Costa-Audit-Enabled: true" \
-d '{
"model": "costa/compliance-assistant",
"messages": [
{
"role": "user",
"content": "Analyze this healthcare data processing code for HIPAA violations"
}
],
"max_tokens": 1500,
"temperature": 0.2
}'
```

## Popular AI Agent Integrations

### AutoGPT Integration

```yaml AutoGPT Configuration
ai_provider: custom
api_base: https://ai.costa.app/api/v1
api_key: costa_ent_your_key_here

models:
fast_llm: costa/enterprise-coder-v1
smart_llm: costa/secure-claude-3-5-sonnet

security:
audit_enabled: true
data_residency: us-east
security_level: high

headers:
Costa-Security-Level: high
Costa-Audit-Enabled: "true"
Costa-Data-Residency: us-east
```

```python AutoGPT Custom Provider
class CostaCodeProvider:
def __init__(self, api_key):
self.api_key = api_key
self.base_url = "https://ai.costa.app/api/v1"

def chat_completion_request(self, model, messages, **kwargs):
headers = {
"Authorization": f"Bearer {self.api_key}",
"Content-Type": "application/json",
"Costa-Security-Level": "high",
"Costa-Audit-Enabled": "true"
}

payload = {
"model": model,
"messages": messages,
**kwargs
}

response = requests.post(
f"{self.base_url}/chat/completions",
headers=headers,
json=payload
)

return response.json()
```

### LangChain Integration

```python LangChain Setup
from langchain.llms import OpenAI
from langchain.chat_models import ChatOpenAI
from langchain.schema import HumanMessage

# Configure Costa as LangChain provider
costa_llm = ChatOpenAI(
openai_api_key="costa_ent_your_key_here",
openai_api_base="https://ai.costa.app/api/v1",
model_name="costa/enterprise-coder-v1",
temperature=0.7
)

# Use with LangChain chains
from langchain.chains import LLMChain
from langchain.prompts import PromptTemplate

prompt = PromptTemplate(
input_variables=["task"],
template="Write secure, enterprise-grade code for: {task}"
)

chain = LLMChain(llm=costa_llm, prompt=prompt)
result = chain.run(task="user authentication system with MFA")

# Enterprise security configuration
costa_secure = ChatOpenAI(
openai_api_key="costa_ent_your_key_here",
openai_api_base="https://ai.costa.app/api/v1",
model_name="costa/secure-claude-3-5-sonnet",
model_kwargs={
"extra_headers": {
"Costa-Security-Level": "maximum",
"Costa-Audit-Enabled": "true"
}
}
)
```

```python LangChain Custom Integration
from langchain.llms.base import LLM
from typing import Optional, List, Any
import requests

class CostaCodeLLM(LLM):
api_key: str
model: str = "costa/enterprise-coder-v1"
security_level: str = "high"

@property
def _llm_type(self) -> str:
return "costa-code"

def _call(
self,
prompt: str,
stop: Optional[List[str]] = None,
run_manager: Optional[Any] = None,
**kwargs: Any,
) -> str:
headers = {
"Authorization": f"Bearer {self.api_key}",
"Content-Type": "application/json",
"Costa-Security-Level": self.security_level,
"Costa-Audit-Enabled": "true"
}

payload = {
"model": self.model,
"messages": [{"role": "user", "content": prompt}],
"max_tokens": kwargs.get("max_tokens", 1000),
"temperature": kwargs.get("temperature", 0.7)
}

response = requests.post(
"https://ai.costa.app/api/v1/chat/completions",
headers=headers,
json=payload
)

return response.json()["choices"][0]["message"]["content"]

# Usage
costa_llm = CostaCodeLLM(
api_key="costa_ent_your_key_here",
model="costa/compliance-assistant",
security_level="maximum"
)
```

### Custom AI Agent Template

```python Generic AI Agent Template
import requests
import json
from typing import Dict, List, Optional

class EnterpriseAIAgent:
def __init__(self, api_key: str, default_model: str = "costa/enterprise-coder-v1"):
self.api_key = api_key
self.base_url = "https://ai.costa.app/api/v1"
self.default_model = default_model
self.session = requests.Session()
self.session.headers.update({
"Authorization": f"Bearer {api_key}",
"Content-Type": "application/json"
})

def execute_task(
self,
task: str,
model: Optional[str] = None,
security_level: str = "high",
compliance_frameworks: List[str] = None,
**kwargs
) -> Dict:
"""Execute AI task with enterprise security"""

headers = {
"Costa-Security-Level": security_level,
"Costa-Audit-Enabled": "true",
"Costa-Data-Residency": kwargs.get("region", "us-east")
}

if kwargs.get("zero_retention", False):
headers["Costa-Zero-Retention"] = "true"

if compliance_frameworks:
headers["Costa-Compliance-Frameworks"] = ",".join(compliance_frameworks)

payload = {
"model": model or self.default_model,
"messages": [{"role": "user", "content": task}],
"max_tokens": kwargs.get("max_tokens", 1000),
"temperature": kwargs.get("temperature", 0.7)
}

response = self.session.post(
f"{self.base_url}/chat/completions",
headers=headers,
json=payload
)

response.raise_for_status()
return response.json()

def code_review(self, code: str, framework: str = "general") -> Dict:
"""Perform security-focused code review"""

model_map = {
"hipaa": "costa/compliance-assistant",
"sox": "costa/compliance-assistant",
"pci": "costa/compliance-assistant",
"general": "costa/secure-claude-3-5-sonnet"
}

task = f"Perform a comprehensive security review of this code for {framework} compliance:\n\n{code}"

return self.execute_task(
task=task,
model=model_map.get(framework, "costa/secure-claude-3-5-sonnet"),
security_level="maximum",
compliance_frameworks=[framework] if framework != "general" else [],
zero_retention=True
)

def generate_code(self, requirements: str, language: str = "python") -> Dict:
"""Generate enterprise-grade code"""

task = f"Generate secure, enterprise-grade {language} code for: {requirements}"

return self.execute_task(
task=task,
model="costa/enterprise-coder-v1",
security_level="high",
max_tokens=2000
)

# Usage example
agent = EnterpriseAIAgent("costa_ent_your_key_here")

# Generate secure code
code_result = agent.generate_code(
"User authentication system with JWT and rate limiting",
language="python"
)

# Review code for compliance
review_result = agent.code_review(
code="def process_payment(card_data): ...",
framework="pci"
)

print("Generated code:", code_result["choices"][0]["message"]["content"])
print("Security review:", review_result["choices"][0]["message"]["content"])
```

## Enterprise Headers Reference

**Header**: `Costa-Security-Level`

**Values**:
- `standard` - Default security measures
- `high` - Enhanced security protocols
- `maximum` - Highest security, compliance mode

**Usage**:
```bash
-H "Costa-Security-Level: maximum"
```

**Header**: `Costa-Data-Residency`

**Values**:
- `us-east` - US East Coast
- `us-west` - US West Coast
- `eu-west` - European Union
- `asia-pacific` - Asia Pacific

**Usage**:
```bash
-H "Costa-Data-Residency: eu-west"
```

**Header**: `Costa-Audit-Enabled`

**Values**: `true`, `false`

**Usage**:
```bash
-H "Costa-Audit-Enabled: true"
```

**Header**: `Costa-Zero-Retention`

**Values**: `true`, `false`

**Description**: Enable zero data retention mode

**Usage**:
```bash
-H "Costa-Zero-Retention: true"
```

**Header**: `Costa-Compliance-Frameworks`

**Values**: Comma-separated list of `hipaa`, `sox`, `pci-dss`, `gdpr`

**Usage**:
```bash
-H "Costa-Compliance-Frameworks: hipaa,sox"
```

## Error Handling

```python Error Handling Example
import requests
from requests.exceptions import RequestException

def safe_costa_request(api_key, model, messages, **kwargs):
"""Make a safe request to Costa API with error handling"""

headers = {
"Authorization": f"Bearer {api_key}",
"Content-Type": "application/json",
"Costa-Security-Level": kwargs.get("security_level", "high"),
"Costa-Audit-Enabled": "true"
}

payload = {
"model": model,
"messages": messages,
"max_tokens": kwargs.get("max_tokens", 1000),
"temperature": kwargs.get("temperature", 0.7)
}

try:
response = requests.post(
"https://ai.costa.app/api/v1/chat/completions",
headers=headers,
json=payload,
timeout=30
)

# Handle HTTP errors
if response.status_code == 401:
raise Exception("Invalid API key or authentication failed")
elif response.status_code == 403:
raise Exception("Access denied - check model permissions")
elif response.status_code == 429:
raise Exception("Rate limit exceeded - please retry later")
elif response.status_code >= 500:
raise Exception("Costa service error - please retry")

response.raise_for_status()
return response.json()

except RequestException as e:
raise Exception(f"Network error: {str(e)}")
except Exception as e:
raise Exception(f"API request failed: {str(e)}")

# Usage with error handling
try:
result = safe_costa_request(
api_key="costa_ent_your_key_here",
model="costa/enterprise-coder-v1",
messages=[{"role": "user", "content": "Generate secure code"}],
security_level="high"
)
print("Success:", result["choices"][0]["message"]["content"])

except Exception as e:
print("Error:", str(e))
```

## Testing & Validation

```python API Testing Suite
import unittest
import requests

class CostaCodeAPITest(unittest.TestCase):

def setUp(self):
self.api_key = "costa_ent_your_test_key_here"
self.base_url = "https://ai.costa.app/api/v1"
self.headers = {
"Authorization": f"Bearer {self.api_key}",
"Content-Type": "application/json"
}

def test_basic_completion(self):
"""Test basic chat completion"""
payload = {
"model": "costa/enterprise-coder-v1",
"messages": [{"role": "user", "content": "Hello, world!"}],
"max_tokens": 50
}

response = requests.post(
f"{self.base_url}/chat/completions",
headers=self.headers,
json=payload
)

self.assertEqual(response.status_code, 200)
data = response.json()
self.assertIn("choices", data)
self.assertGreater(len(data["choices"]), 0)

def test_security_headers(self):
"""Test enterprise security headers"""
headers = {
**self.headers,
"Costa-Security-Level": "maximum",
"Costa-Audit-Enabled": "true"
}

payload = {
"model": "costa/secure-claude-3-5-sonnet",
"messages": [{"role": "user", "content": "Test security"}],
"max_tokens": 50
}

response = requests.post(
f"{self.base_url}/chat/completions",
headers=headers,
json=payload
)

self.assertEqual(response.status_code, 200)
data = response.json()
self.assertIn("security", data)

def test_model_availability(self):
"""Test available models"""
response = requests.get(
f"{self.base_url}/models",
headers=self.headers
)

self.assertEqual(response.status_code, 200)
data = response.json()
model_ids = [model["id"] for model in data["data"]]
self.assertIn("costa/enterprise-coder-v1", model_ids)

if __name__ == "__main__":
unittest.main()
```

## Best Practices

- Store API keys securely using environment variables
- Rotate API keys regularly
- Use different keys for development and production

- Implement comprehensive error handling
- Add retry logic for transient failures
- Log errors for debugging and monitoring

- Use appropriate security levels for your use case
- Enable audit logging for compliance requirements
- Configure data residency based on regulations

- Use streaming for real-time applications
- Cache responses when appropriate
- Monitor usage and optimize model selection

---

**Enterprise Integration**: When integrating Costa with AI agents, ensure proper security measures are implemented including secure API key storage, appropriate security levels, and compliance configuration for your industry requirements.

{user.firstName}

```

### Roo Code

URL: https://docs.costa.security/integrations/roo-cursor

```mdx
---
title: "Roo Code"
description: "Connect Costa to Roo Code for secure AI assistance"
icon: https://docs-cdn.costa.security/images/roo.svg

---

## Quick Setup

### Step 1: Install Cursor
Download and install Cursor from [cursor.com/download](https://cursor.com/download).

### Step 2: Install Roo Code

Install Roo in Cursor

Use this curl command to fetch your Costa configuration directly:
```bash
curl -fsSL https://raw.githubusercontent.com/costa-security/install/main/roo/cursor_init.sh | bash -s --
```

import RooConfigure from '/snippets/roo-configure.mdx'

```

#### Imported Snippets

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

### Roo Code

URL: https://docs.costa.security/integrations/roo-jetbrains

```mdx
---
title: "Roo Code"
description: "Connect Costa to Roo Code for secure AI assistance"
icon: https://docs-cdn.costa.security/images/roo.svg

---

## Quick Setup

### Step 1: Install Jetbrains
Download and install Cursor from [jetbrains.com/idea/download/](https://www.jetbrains.com/idea/download).

### Step 2: Install Roo Code
1. Open Jetbrains.
2. Go to **Extensions** (`Ctrl+Shift+X`).
3. Search for **"Roo"** (or **"Roo Code"**) and install the official extension from Roo.dev.
4. Sign in with your Roo account so settings can sync across devices.

import RooConfigure from '/snippets/roo-configure.mdx'

```

#### Imported Snippets

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

### Roo Code

URL: https://docs.costa.security/integrations/roo-vscode

```mdx
---
title: "Roo Code"
description: "Connect Costa to Roo Code for secure AI assistance"
icon: https://docs-cdn.costa.security/images/roo.svg

---

## Quick Setup

### Step 1: Install VS Code
Download and install VS Code from [code.visualstudio.com](https://code.visualstudio.com).

### Step 2: Install Roo Code

- Install Roo Code

Install Roo in VS Code

Use this curl command to fetch your Costa configuration directly:
```bash
curl -fsSL https://raw.githubusercontent.com/costa-security/install/main/roo/vscode_init.sh | bash -s --
```

import RooConfigure from '/snippets/roo-configure.mdx'

## Usage
- Open the Roo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we'll get you unblocked.
```

#### Imported Snippets

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

##### roo-configure.mdx

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

### 🤖 Models

URL: https://docs.costa.security/models

```mdx
---
sidebarTitle: Models
title: 🤖 Models
icon: bot
---
import models from "/snippets/models.jsx"

# Other Top Models
Costa provides access to almost 100 models - here are the top ones used for coding:

{models.map((model, index) => (

))}

Model
API
Provider
SWEBench

{model.name}
{model.api}
{model.provider}
{typeof model.swebench === "number" ? model.swebench : "-"}

... and many more. If you are logged in to Costa, you can see all of the models we provide access to from your [Models Page](https://ai.costa.app/code/models).

```

#### Imported Snippets

##### models.jsx

```jsx
export const models = [
{
"type": "model",
"slug": "claude-opus-4.6",
"emoji": null,
"name": "Claude Opus 4.6",
"api": "claude-opus-4.6",
"provider": "Anthropic, Vertex",
"swebench": 77.8,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-opus-4.5",
"emoji": null,
"name": "Claude Opus 4.5",
"api": "claude-opus-4.5",
"provider": "Anthropic, Vertex",
"swebench": 74.4,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Sonnet 4.5",
"emoji": null,
"name": "Claude Sonnet 4.5",
"api": "claude-sonnet-4.5",
"provider": "Anthropic, Vertex",
"swebench": 77.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-haiku-4.5",
"emoji": null,
"name": "Claude Haiku 4.5",
"api": "claude-haiku-4.5",
"provider": "Anthropic, Vertex",
"swebench": 73.3,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "GPT 5.2",
"emoji": null,
"name": "GPT 5.2",
"api": "gpt-5.2",
"provider": "OpenAI, Openrouter",
"swebench": 74.5,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 Pro",
"emoji": null,
"name": "Gemini 3 Pro",
"api": "gemini-3-pro-preview",
"provider": "Vertex, Openrouter",
"swebench": 74.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 flash",
"emoji": null,
"name": "Gemini 3 flash",
"api": "gemini-3-flash",
"provider": "Vertex, Openrouter",
"swebench": 73.8,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "gpt-4.1",
"emoji": null,
"name": "GPT 4.1",
"api": "gpt-4.1",
"provider": "OpenAI",
"swebench": 39.6,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},

{
"type": "model",
"slug": "claude-sonnet-4",
"emoji": null,
"name": "Claude 4 Sonnet",
"api": "claude-sonnet-4",
"provider": "Anthropic, Vertex",
"swebench": 64.9,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},

{
"type": "model",
"slug": "gemini-2.5-pro",
"emoji": null,
"name": "Gemini 2.5 Pro",
"api": "gemini-2.5-pro",
"provider": "Vertex",
"swebench": 53.6,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "gemini-2.5-flash",
"emoji": null,
"name": "Gemini Flash 2.5",
"api": "gemini-2.5-flash",
"provider": "Vertex",
"swebench": 28.7,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},

{
"type": "model",
"slug": "qwen3-coder",
"emoji": null,
"name": "Qwen3 Coder",
"api": "qwen3-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 55.4,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "glm-4.7",
"emoji": null,
"name": "GLM-4.7",
"api": "glm-4.7",
"provider": "Vertex, Openrouter",
"swebench": 66.7,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "o4-mini",
"emoji": null,
"name": "O4 Mini",
"api": "o4-mini",
"provider": "OpenAI",
"swebench": 45.0,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "qwen3-32b",
"emoji": null,
"name": "Qwen3 32b",
"api": "qwen3-32b",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 42.2,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "kimi-k2",
"emoji": null,
"name": "Kimi K2",
"api": "kimi-k2",
"provider": "MoonshotAI (via Groq/Google Vertex)",
"swebench": 43.8,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "gpt-oss-20b",
"emoji": null,
"name": "GPT OSS 20b",
"api": "gpt-oss-20b",
"provider": "OpenAI (via Groq/Google Vertex)",
"swebench": 5,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "qwen-qwen2.5-coder",
"emoji": null,
"name": "Qwen 2.5 Coder",
"api": "qwen-2.5-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 9,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "llama-4-maverick-17b",
"emoji": null,
"name": "Meta Llama 4 Maverick 17b",
"api": "llama-4-maverick-17b-128e-instruct",
"provider": "Meta (via Groq/Google Vertex)",
"swebench": 21.0,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
]

```

##### models.jsx

```jsx
export const models = [
{
"type": "model",
"slug": "claude-opus-4.6",
"emoji": null,
"name": "Claude Opus 4.6",
"api": "claude-opus-4.6",
"provider": "Anthropic, Vertex",
"swebench": 77.8,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-opus-4.5",
"emoji": null,
"name": "Claude Opus 4.5",
"api": "claude-opus-4.5",
"provider": "Anthropic, Vertex",
"swebench": 74.4,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Sonnet 4.5",
"emoji": null,
"name": "Claude Sonnet 4.5",
"api": "claude-sonnet-4.5",
"provider": "Anthropic, Vertex",
"swebench": 77.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-haiku-4.5",
"emoji": null,
"name": "Claude Haiku 4.5",
"api": "claude-haiku-4.5",
"provider": "Anthropic, Vertex",
"swebench": 73.3,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "GPT 5.2",
"emoji": null,
"name": "GPT 5.2",
"api": "gpt-5.2",
"provider": "OpenAI, Openrouter",
"swebench": 74.5,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 Pro",
"emoji": null,
"name": "Gemini 3 Pro",
"api": "gemini-3-pro-preview",
"provider": "Vertex, Openrouter",
"swebench": 74.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 flash",
"emoji": null,
"name": "Gemini 3 flash",
"api": "gemini-3-flash",
"provider": "Vertex, Openrouter",
"swebench": 73.8,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "gpt-4.1",
"emoji": null,
"name": "GPT 4.1",
"api": "gpt-4.1",
"provider": "OpenAI",
"swebench": 39.6,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},

{
"type": "model",
"slug": "claude-sonnet-4",
"emoji": null,
"name": "Claude 4 Sonnet",
"api": "claude-sonnet-4",
"provider": "Anthropic, Vertex",
"swebench": 64.9,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},

{
"type": "model",
"slug": "gemini-2.5-pro",
"emoji": null,
"name": "Gemini 2.5 Pro",
"api": "gemini-2.5-pro",
"provider": "Vertex",
"swebench": 53.6,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "gemini-2.5-flash",
"emoji": null,
"name": "Gemini Flash 2.5",
"api": "gemini-2.5-flash",
"provider": "Vertex",
"swebench": 28.7,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},

{
"type": "model",
"slug": "qwen3-coder",
"emoji": null,
"name": "Qwen3 Coder",
"api": "qwen3-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 55.4,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "glm-4.7",
"emoji": null,
"name": "GLM-4.7",
"api": "glm-4.7",
"provider": "Vertex, Openrouter",
"swebench": 66.7,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "o4-mini",
"emoji": null,
"name": "O4 Mini",
"api": "o4-mini",
"provider": "OpenAI",
"swebench": 45.0,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "qwen3-32b",
"emoji": null,
"name": "Qwen3 32b",
"api": "qwen3-32b",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 42.2,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "kimi-k2",
"emoji": null,
"name": "Kimi K2",
"api": "kimi-k2",
"provider": "MoonshotAI (via Groq/Google Vertex)",
"swebench": 43.8,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "gpt-oss-20b",
"emoji": null,
"name": "GPT OSS 20b",
"api": "gpt-oss-20b",
"provider": "OpenAI (via Groq/Google Vertex)",
"swebench": 5,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "qwen-qwen2.5-coder",
"emoji": null,
"name": "Qwen 2.5 Coder",
"api": "qwen-2.5-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 9,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "llama-4-maverick-17b",
"emoji": null,
"name": "Meta Llama 4 Maverick 17b",
"api": "llama-4-maverick-17b-128e-instruct",
"provider": "Meta (via Groq/Google Vertex)",
"swebench": 21.0,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
]

```

##### models.jsx

```jsx
export const models = [
{
"type": "model",
"slug": "claude-opus-4.6",
"emoji": null,
"name": "Claude Opus 4.6",
"api": "claude-opus-4.6",
"provider": "Anthropic, Vertex",
"swebench": 77.8,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-opus-4.5",
"emoji": null,
"name": "Claude Opus 4.5",
"api": "claude-opus-4.5",
"provider": "Anthropic, Vertex",
"swebench": 74.4,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Sonnet 4.5",
"emoji": null,
"name": "Claude Sonnet 4.5",
"api": "claude-sonnet-4.5",
"provider": "Anthropic, Vertex",
"swebench": 77.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-haiku-4.5",
"emoji": null,
"name": "Claude Haiku 4.5",
"api": "claude-haiku-4.5",
"provider": "Anthropic, Vertex",
"swebench": 73.3,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "GPT 5.2",
"emoji": null,
"name": "GPT 5.2",
"api": "gpt-5.2",
"provider": "OpenAI, Openrouter",
"swebench": 74.5,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 Pro",
"emoji": null,
"name": "Gemini 3 Pro",
"api": "gemini-3-pro-preview",
"provider": "Vertex, Openrouter",
"swebench": 74.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 flash",
"emoji": null,
"name": "Gemini 3 flash",
"api": "gemini-3-flash",
"provider": "Vertex, Openrouter",
"swebench": 73.8,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "gpt-4.1",
"emoji": null,
"name": "GPT 4.1",
"api": "gpt-4.1",
"provider": "OpenAI",
"swebench": 39.6,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},

{
"type": "model",
"slug": "claude-sonnet-4",
"emoji": null,
"name": "Claude 4 Sonnet",
"api": "claude-sonnet-4",
"provider": "Anthropic, Vertex",
"swebench": 64.9,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},

{
"type": "model",
"slug": "gemini-2.5-pro",
"emoji": null,
"name": "Gemini 2.5 Pro",
"api": "gemini-2.5-pro",
"provider": "Vertex",
"swebench": 53.6,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "gemini-2.5-flash",
"emoji": null,
"name": "Gemini Flash 2.5",
"api": "gemini-2.5-flash",
"provider": "Vertex",
"swebench": 28.7,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},

{
"type": "model",
"slug": "qwen3-coder",
"emoji": null,
"name": "Qwen3 Coder",
"api": "qwen3-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 55.4,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "glm-4.7",
"emoji": null,
"name": "GLM-4.7",
"api": "glm-4.7",
"provider": "Vertex, Openrouter",
"swebench": 66.7,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "o4-mini",
"emoji": null,
"name": "O4 Mini",
"api": "o4-mini",
"provider": "OpenAI",
"swebench": 45.0,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "qwen3-32b",
"emoji": null,
"name": "Qwen3 32b",
"api": "qwen3-32b",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 42.2,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "kimi-k2",
"emoji": null,
"name": "Kimi K2",
"api": "kimi-k2",
"provider": "MoonshotAI (via Groq/Google Vertex)",
"swebench": 43.8,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "gpt-oss-20b",
"emoji": null,
"name": "GPT OSS 20b",
"api": "gpt-oss-20b",
"provider": "OpenAI (via Groq/Google Vertex)",
"swebench": 5,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "qwen-qwen2.5-coder",
"emoji": null,
"name": "Qwen 2.5 Coder",
"api": "qwen-2.5-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 9,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "llama-4-maverick-17b",
"emoji": null,
"name": "Meta Llama 4 Maverick 17b",
"api": "llama-4-maverick-17b-128e-instruct",
"provider": "Meta (via Groq/Google Vertex)",
"swebench": 21.0,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
]

```

### ✨ Points

URL: https://docs.costa.security/points

```mdx
---
sidebarTitle: Points
title: ✨ Points
icon: sparkles
---

# What are Points?

Every action in Costa consumes ** Points**. Points are our common currency across models, context sizes, and tiers — making it simple to compare usage and stay within your plan.

# Why Points Matter

### Transparent usage
Points map **different model costs** into a single unit, so you can budget usage clearly without memorizing per-token rates.

### Flexibility
Mix and match models within the same session — Costa will automatically track points based on model tier and context size.

### Predictability
With fixed **points per session** and **sessions per month**, you’ll always know how much coding support is included in your plan.

---

Costa is designed for AI-assisted, humana_in-the-loop coding. We monitor usage and reserve the right to suspend or terminate access if automated activity, abuse, or misuse is detected. For more information, see our [Terms of Service](https://costa.app/terms).

```

### 💵 Pricing

URL: https://docs.costa.security/pricing

```mdx
---
sidebarTitle: Pricing
title: 💵 Pricing
icon: circle-dollar-sign
---

Costa offers flexible plans for individual developers and teams. We are actively evolving our pricing to match how teams actually use AI agents.

Book a quick call to find the right plan for your team.

```

### Rate Limits

URL: https://docs.costa.security/rate-limits

```mdx
---
title: "Rate Limits"
description: "Costa API rate limits and usage guidelines"
---

## Rate Limits by Model

**Standard Coding Model**

**Enterprise Tier**:
- Requests: 5,000 per minute
- Tokens: 1,000,000 per minute
- Concurrent requests: 100

**Professional Tier**:
- Requests: 500 per minute
- Tokens: 200,000 per minute
- Concurrent requests: 20

**Typical Usage**: 1 request = ~500-1,500 tokens

**Advanced Reasoning Model**

**Enterprise Tier**:
- Requests: 2,000 per minute
- Tokens: 800,000 per minute
- Concurrent requests: 50

**Professional Tier**:
- Requests: 200 per minute
- Tokens: 100,000 per minute
- Concurrent requests: 10

**Typical Usage**: 1 request = ~1,000-4,000 tokens

**Fast General Purpose Model**

**Enterprise Tier**:
- Requests: 8,000 per minute
- Tokens: 1,500,000 per minute
- Concurrent requests: 120

**Professional Tier**:
- Requests: 800 per minute
- Tokens: 300,000 per minute
- Concurrent requests: 25

**Typical Usage**: 1 request = ~300-1,000 tokens

**Compliance Specialist Model**

**Enterprise Tier**:
- Requests: 1,000 per minute
- Tokens: 500,000 per minute
- Concurrent requests: 30

**Professional Tier**:
- Requests: 100 per minute
- Tokens: 50,000 per minute
- Concurrent requests: 5

**Typical Usage**: 1 request = ~2,000-6,000 tokens

## Rate Limit Headers

Costa returns standard rate limit headers with every API response:

```http Response Headers
HTTP/1.1 200 OK
X-RateLimit-Limit-Requests: 5000
X-RateLimit-Remaining-Requests: 4999
X-RateLimit-Reset-Requests: 1640995200
X-RateLimit-Limit-Tokens: 1000000
X-RateLimit-Remaining-Tokens: 998500
X-RateLimit-Reset-Tokens: 1640995200
X-RateLimit-Limit-Concurrent: 100
X-RateLimit-Used-Concurrent: 5
```

```python Python Rate Limit Handling
import requests
import time

def make_request_with_retry(url, headers, data, max_retries=3):
for attempt in range(max_retries):
response = requests.post(url, headers=headers, json=data)

if response.status_code == 200:
return response.json()
elif response.status_code == 429:
# Rate limit exceeded
reset_time = int(response.headers.get('X-RateLimit-Reset-Requests', 0))
wait_time = max(1, reset_time - int(time.time()))

print(f"Rate limit exceeded. Waiting {wait_time} seconds...")
time.sleep(wait_time)
else:
response.raise_for_status()

raise Exception("Max retries exceeded")

# Usage
response = make_request_with_retry(
"https://ai.costa.app/api/v1/chat/completions",
headers={"Authorization": "Bearer costa_ent_your_key"},
data={"model": "costa/enterprise-coder-v1", "messages": [...]}
)
```

## Error Responses

When rate limits are exceeded, Costa returns a `429 Too Many Requests` status:

```json Rate Limit Error
{
"error": {
"message": "Rate limit exceeded for requests. Try again in 30 seconds.",
"type": "rate_limit_error",
"code": "rate_limit_exceeded",
"details": {
"limit_type": "requests",
"reset_time": 1640995230,
"retry_after": 30
}
}
}
```

```json Token Limit Error
{
"error": {
"message": "Rate limit exceeded for tokens. Try again in 60 seconds.",
"type": "rate_limit_error",
"code": "token_limit_exceeded",
"details": {
"limit_type": "tokens",
"reset_time": 1640995260,
"retry_after": 60
}
}
}
```

```json Concurrent Request Error
{
"error": {
"message": "Too many concurrent requests. Maximum 100 allowed.",
"type": "rate_limit_error",
"code": "concurrent_limit_exceeded",
"details": {
"limit_type": "concurrent",
"current_usage": 101,
"limit": 100
}
}
}
```

## Rate Limit Optimization

### Token Optimization Strategies

**Reduce Input Tokens**

• Remove unnecessary whitespace and comments
• Use concise, specific prompts
• Exclude irrelevant code context
• Summarize large code blocks

**Control Output Tokens**

• Set appropriate `max_tokens` limits
• Use specific instructions for concise responses
• Request code snippets instead of full files
• Use streaming for real-time applications

## Enterprise Features

### Dedicated Rate Limits

Enterprise customers can request dedicated rate limit pools:

**Separate Limits per Team**

• Independent rate limits for each development team
• Prevent one team from affecting others
• Custom limits based on team size and usage

**Project-Specific Limits**

• Allocate rate limits to specific projects
• Priority queuing for critical applications
• Burst capacity for deployment periods

### Rate Limit Monitoring

**Real-time Usage Tracking**

• Live rate limit consumption graphs
• Historical usage patterns
• Team and project breakdowns
• Alert thresholds and notifications

**Programmatic Monitoring**

• Rate limit usage API endpoints
• Webhook notifications for limit approaches
• Custom alerting integrations
• Usage forecasting and planning

## Support

Contact support for rate limit increases or technical issues

Discuss custom rate limits and dedicated infrastructure options

---

**Rate Limit Increases**: Enterprise customers can request rate limit increases based on legitimate business needs. Contact our support team with your use case details.

```

### 🔒 Security

URL: https://docs.costa.security/security

```mdx
---
sidebarTitle: Security
title: 🔒 Security
icon: lock
---

# What is _Zero Trust AI_ ?

### Our Approach
At Costa, our background is in network security. We take an opinionated, no-holds-barred approach toward securing AI. We believe A represents a danger greater than anything we have seen in the history of computing — and we are here to help.

We call our approach _Zero Trust AI_, and to us, that means:

1. Do not trust the model, no matter the "good intent" of the creator,
2. Do not trust the model provider, no matter the "definitely next level" security they promise,
3. Do not trust the tools, no matter how "absolutely safe" they claim to be, and
4. Do not trust the human or agent operating the model, no matter how much they protest that they will never make a mistake

Practically, this means we wrap every request and response in security. We secure information on its way into the model, sometimes stripping out things (like personal information), sometimes inserting things (like dummy API keys).

We secure information on its way out of models, sometimes putting things back (like that personal information we took out earlier), or running analysis on code that was produced, to make sure it is actually safe.

### AI is a Dynamic Landscape

**Zero Trust AI is a moving target** - there is no definitive list that you could set up today and be done. At Costa, we believe it's our job to sit at the edge of cybersecurity (what we call the cybersecurity 'coast', hence 'Costa') and make sure that we always apply Current Best Practices to AI infrastructure.

---

# Costa's top five for security

The Costa platform includes quite a few security features built in. Here are the five most important things we give you:

### 1. Sensitive information filtering

Every request is filtered for personal information. See [OWASP LLM02: 2025](https://genai.owasp.org/llmrisk/llm022025-sensitive-information-disclosure/). We extract sensitive information and replace it with "dummy" information that is sent to the model, then re-replace before it gets back to the user.

```mermaid
flowchart LR
A[👨‍🚀 Coder via Claude/Cursor/...] -- Unfiltered Request --> B[💫 Costa Auto Router]
B -- Filtered Request --> C[🤖 AI Model]
C -- Filtered Response --> B
B -- Unfiltered Response --> A
```

### 2. Dynamic agency control

We use a combination of the current and prior tool requests and conversation outputs to give each individual request a `Risk Score`. This score is based on things like whether the tool has `read` or `write` access to internal information, whether it talks to the outside world, how powerful the model is, and the nature of any information provided by the user. See [OWASP LLM06: 2025](https://genai.owasp.org/llmrisk/llm062025-excessive-agency/) for a description of excessive agency and why it is critical to prevent it.

### 3. Realtime output analysis

We run both synchronous and asynchronous analysis on outputs from models to make sure your code is protected. We run static code analysis on model outputs _while the engineer is still coding_ and give them feedback _inside their editor_. Many companies analyze code at the time of commit, but we catch errors as they go into or come out of the models. We know which models are producing dangerous code and, if necessary, block further requests. See [OWASP LLM05: 2025 Improper Output Handling](https://genai.owasp.org/llmrisk/llm052025-improper-output-handling/) and [OWASP LLM04: 2025 Data and Model Poisoning](https://genai.owasp.org/llmrisk/llm042025-data-and-model-poisoning/) for why this is necessary.

### 4. Dynamic provider and model routing

At Costa, we provide [💫 Cosmic Routers](/cosmic-routers), which choose the best model for each individual part of a request, sometimes switching between models multiple times in a conversation. This not only dramatically lowers cost, it also protects against [OWASP LLM03: 2025 Supply Chain](https://genai.owasp.org/llmrisk/llm032025-supply-chain/) attacks.

### 5. Realtime analytics

Costa gives you a lot of metrics - both for individual engineers about how they are using AI, and for administrators both for security and productivity. This leads to a deep understanding of how your business uses AI and protects from attacks due to [OWASP LLM10: 2025](https://genai.owasp.org/llmrisk/llm102025-unbounded-consumption/)

---

# Directly control your own security

And most importantly, all of the different security tools we use are controllable through your organization's dashboard. If you don't like a particular model, you can block it. If you want to tune the aggressiveness of the information filtering way up, you can do that. Costa provides the tools, but the power is all yours.

```

### ⏰ Sessions

URL: https://docs.costa.security/sessions

```mdx
---
sidebarTitle: 'Sessions'
title: "⏰ Sessions"
icon: clock
---

# What is a Session?
All Costa usage happens in a **5 hour session window**:

- That window **starts from your first prompt** and **ends exactly 5 hours later**. We call this time window a _session_.

- After a session ends, a new one **automatically starts** the next time you send a prompt.

---

# Why Sessions matter

### Unlock Smarter Insights

Costa analyzes threads from sessions — prompts, context, tool calls, and outcomes — securely and privately, to surface what actually moved the needle. Over time, this data reveals which workflows work, which agents perform best, and how teams build momentum with AI-assisted coding.

Codex running in the command line interface

For more details, see our [ Insights](/insights) page.

### Ensure Smooth Performance

Have you ever been stuck in a conversation that you knew it was going nowhere?

Coding is like that sometimes too. Some of the most expensive model calls (i.e. high context length) are actually the least valuable. Sessions help us balance usage across providers, models and people.

With our highest tier plans, we find people rarely hit session limits.

### Prevent API Abuse

Our sessions and points are designed to give engineers on our Max plan the feeling of _near unlimited assisted coding_. But Costa is designed for humans that are using AI to make themselves better coders, not for agents running 24/7 without humans in the loop.

```

### Kilo Configure

URL: https://docs.costa.security/snippets/kilo-configure

```mdx
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

### Roo Configure

URL: https://docs.costa.security/snippets/roo-configure

```mdx

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```

### 💬 Threads

URL: https://docs.costa.security/threads

```mdx
---
sidebarTitle: 'Threads'
title: "💬 Threads"
icon: messages-square
---

# What are Threads?

Threads are your coding conversation — a complete record of every prompt, context block, model decision, and tool calls. Costa automatically saves these so you can revisit, search, and share Threads with anyone.

Codex running in the command line interface

# Why Threads Matter?

Teams use thread links inside code reviews, incident write-ups, and design docs to provide full context behind every decision. Browsing your team’s threads makes it easy to understand patterns, learn from each other’s workflows, and track how the organization uses AI in practice.

# Sharing Threads:

Costa supports fine-grained sharing controls:

### 🔭 Public

Visible on your public developer profile and indexed for public search.

### 🔗 Unlisted

Accessible to anyone with a direct link.
Not searchable. Automatically shared with your workspace.

### 🌌 Workspace

Visible to everyone in your organization’s workspace.
(Default for companies and teams.)

### 🔒 Private

Visible only to you. Not shared anywhere.

### Defaults

Individual users (no workspace):
All threads default to Private.

Workspace members:
All threads default to Workspace Shared, unless your admin enforces stricter policies.

Enterprise workspaces can enable additional governance controls such as retention rules, auto-classification, and restricted visibility. See Enterprise Thread Governance for details.

```

### VS Code Extension

URL: https://docs.costa.security/vscode-extension

```mdx
---
title: VS Code Extension
description: Use Costa directly inside Visual Studio Code with real-time usage tracking and one-click setup.
---

Install Costa

### What is Costa Extension?

A VS Code extension that integrates Costa’s services with built-in auth, live usage tracking, and automated setup for Claude Code, Codex and many more.

Codex running in the command line interface

[View on VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=Costa.costa-code)

---

### Features

- **Secure authentication**
Log in and out of Costa using an OAuth flow powered by the bundled Costa CLI.

- **Real-time usage tracking**
Monitor points usage and context length directly from the VS Code status bar.

- **One-click setup**
Automatically configure Claude Code and Codex to use Costa’s API.

- **Bundled Costa CLI**
Includes the Costa CLI for macOS, Windows, and Linux with automatic platform detection.

- **Usage dashboard**
Dedicated sidebar panels for usage insights and setup management.

- **System installation (macOS/Linux)**
Optionally install the Costa CLI to `/usr/local/bin` for system-wide access.

---

### Installation

Install the extension directly from the VS Code Marketplace:

- Open the Extensions view (`Cmd+Shift+X` on macOS, `Ctrl+Shift+X` on Windows/Linux)
- Search for **Costa**
- Click **Install**

---

### Authentication

Once installed, authenticate with Costa:

1. Open the Command Palette
2. Run **Costa: Login**
3. Complete OAuth authentication in your browser

After logging in, usage data will appear automatically in the status bar.

---

### Status Bar

When logged in, Costa displays live usage indicators in the VS Code status bar:

- **Costa status (`💫`)**
Click to open the Costa panel or log in if logged out.

- **Points usage**
Color-coded usage indicator:
- Green: 0–25%
- Yellow: 25–50%
- Red: 75%+

---

## Sidebar Panels

Costa adds a dedicated activity bar section with two panels.

---

## Troubleshooting

- **“Costa CLI not found”**
Reinstall the extension or install `costa` on your PATH and restart VS Code.

- **Status bar shows `-`**
Log in first and wait for usage data to load.

- **macOS system install prompts**
Installing to `/usr/local/bin` requires administrator permissions.

```

## All Documentation Summary

- https://docs.costa.security/about-costa — About
- https://docs.costa.security/api-reference/chat/completions — Chat Completions
- https://docs.costa.security/api-reference/endpoint/create — Create Plant
- https://docs.costa.security/api-reference/endpoint/delete — Delete Plant
- https://docs.costa.security/api-reference/endpoint/get — Get Plants
- https://docs.costa.security/api-reference/endpoint/webhook — New Plant
- https://docs.costa.security/api-reference/errors — Errors
- https://docs.costa.security/api-reference/rate-limits — Rate Limits
- https://docs.costa.security/byok — Providers
- https://docs.costa.security/changelog/api_updates — API Updates
- https://docs.costa.security/claude-code-gateway — Claude Code Max Gateway
- https://docs.costa.security/cli — Costa CLI
- https://docs.costa.security/cosmic-routers — 💫 Cosmic Routers
- https://docs.costa.security/custom-routers — 🔀 Custom Routers
- https://docs.costa.security/development — Development
- https://docs.costa.security/enterprise/team-management — Team Management
- https://docs.costa.security/essentials/code — Code Blocks
- https://docs.costa.security/essentials/images — Images and Embeds
- https://docs.costa.security/essentials/markdown — Markdown Syntax
- https://docs.costa.security/essentials/navigation — Navigation
- https://docs.costa.security/essentials/reusable-snippets — Reusable Snippets
- https://docs.costa.security/essentials/settings — Global Settings
- https://docs.costa.security/get-started/anthropic-api-key — Use your Anthropic API key
- https://docs.costa.security/get-started/claude-code — Setup Claude Code
- https://docs.costa.security/get-started/codex — Setup Codex
- https://docs.costa.security/get-started/cosmic-routing — Build a Cosmic Router
- https://docs.costa.security/get-started/openai-api-key — Use your OpenAI API key
- https://docs.costa.security/get-started/opencode — Setup opencode
- https://docs.costa.security/get-started/trim — Turn on Trim
- https://docs.costa.security/insights — 📈 Insights
- https://docs.costa.security/integrations/claude — Claude Code
- https://docs.costa.security/integrations/cline — Cline
- https://docs.costa.security/integrations/codex — Codex
- https://docs.costa.security/integrations/continue — Continue
- https://docs.costa.security/integrations/cursor — Cursor
- https://docs.costa.security/integrations/jetbrains — JetBrains
- https://docs.costa.security/integrations/kilo-cursor — Kilo
- https://docs.costa.security/integrations/kilo-jetbrains — Kilo
- https://docs.costa.security/integrations/kilo-vscode — Kilo
- https://docs.costa.security/integrations/other-agents — Custom Integrations
- https://docs.costa.security/integrations/roo-cursor — Roo Code
- https://docs.costa.security/integrations/roo-jetbrains — Roo Code
- https://docs.costa.security/integrations/roo-vscode — Roo Code
- https://docs.costa.security/models — 🤖 Models
- https://docs.costa.security/points — ✨ Points
- https://docs.costa.security/pricing — 💵 Pricing
- https://docs.costa.security/rate-limits — Rate Limits
- https://docs.costa.security/security — 🔒 Security
- https://docs.costa.security/sessions — ⏰ Sessions
- https://docs.costa.security/snippets/kilo-configure — Kilo Configure
- https://docs.costa.security/snippets/roo-configure — Roo Configure
- https://docs.costa.security/threads — 💬 Threads
- https://docs.costa.security/vscode-extension — VS Code Extension

## All Component Snippets

### kilo-configure

URL: https://docs.costa.security/snippets/kilo-configure

```markdown
### Step 3: Install Costa

```bash
costa setup kilo-code
```
How to install the CLI? [ click here](/costa-code/cli)

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `kilo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json kilo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Kilo
1. In the Kilo sidebar, open **Settings → About** → **Import Settings**.
2. Select the `kilo.settings.json` file you just saved and confirm the import.
3. Prefer manual editing instead of importing? Run **Kilo: Open Settings** from the command palette (`Ctrl+Shift+P`) and append the provider profile block (objects keyed by ID).

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Questions or issues? Reach us anytime at [support@costa.app](mailto:support@costa.app).

```

### models

URL: https://docs.costa.security/snippets/models

```jsx
export const models = [
{
"type": "model",
"slug": "claude-opus-4.6",
"emoji": null,
"name": "Claude Opus 4.6",
"api": "claude-opus-4.6",
"provider": "Anthropic, Vertex",
"swebench": 77.8,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-opus-4.5",
"emoji": null,
"name": "Claude Opus 4.5",
"api": "claude-opus-4.5",
"provider": "Anthropic, Vertex",
"swebench": 74.4,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Sonnet 4.5",
"emoji": null,
"name": "Claude Sonnet 4.5",
"api": "claude-sonnet-4.5",
"provider": "Anthropic, Vertex",
"swebench": 77.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "claude-haiku-4.5",
"emoji": null,
"name": "Claude Haiku 4.5",
"api": "claude-haiku-4.5",
"provider": "Anthropic, Vertex",
"swebench": 73.3,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "GPT 5.2",
"emoji": null,
"name": "GPT 5.2",
"api": "gpt-5.2",
"provider": "OpenAI, Openrouter",
"swebench": 74.5,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 Pro",
"emoji": null,
"name": "Gemini 3 Pro",
"api": "gemini-3-pro-preview",
"provider": "Vertex, Openrouter",
"swebench": 74.2,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "Gemini 3 flash",
"emoji": null,
"name": "Gemini 3 flash",
"api": "gemini-3-flash",
"provider": "Vertex, Openrouter",
"swebench": 73.8,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},
{
"type": "model",
"slug": "gpt-4.1",
"emoji": null,
"name": "GPT 4.1",
"api": "gpt-4.1",
"provider": "OpenAI",
"swebench": 39.6,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},

{
"type": "model",
"slug": "claude-sonnet-4",
"emoji": null,
"name": "Claude 4 Sonnet",
"api": "claude-sonnet-4",
"provider": "Anthropic, Vertex",
"swebench": 64.9,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},

{
"type": "model",
"slug": "gemini-2.5-pro",
"emoji": null,
"name": "Gemini 2.5 Pro",
"api": "gemini-2.5-pro",
"provider": "Vertex",
"swebench": 53.6,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "gemini-2.5-flash",
"emoji": null,
"name": "Gemini Flash 2.5",
"api": "gemini-2.5-flash",
"provider": "Vertex",
"swebench": 28.7,
"lastChanged": null,
"pricingTier": "Premium",
"stability": null
},

{
"type": "model",
"slug": "qwen3-coder",
"emoji": null,
"name": "Qwen3 Coder",
"api": "qwen3-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 55.4,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "glm-4.7",
"emoji": null,
"name": "GLM-4.7",
"api": "glm-4.7",
"provider": "Vertex, Openrouter",
"swebench": 66.7,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "o4-mini",
"emoji": null,
"name": "O4 Mini",
"api": "o4-mini",
"provider": "OpenAI",
"swebench": 45.0,
"lastChanged": null,
"pricingTier": "Super Premium",
"stability": null
},
{
"type": "model",
"slug": "qwen3-32b",
"emoji": null,
"name": "Qwen3 32b",
"api": "qwen3-32b",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 42.2,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "kimi-k2",
"emoji": null,
"name": "Kimi K2",
"api": "kimi-k2",
"provider": "MoonshotAI (via Groq/Google Vertex)",
"swebench": 43.8,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
{
"type": "model",
"slug": "gpt-oss-20b",
"emoji": null,
"name": "GPT OSS 20b",
"api": "gpt-oss-20b",
"provider": "OpenAI (via Groq/Google Vertex)",
"swebench": 5,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "qwen-qwen2.5-coder",
"emoji": null,
"name": "Qwen 2.5 Coder",
"api": "qwen-2.5-coder",
"provider": "Qwen (via Groq/Google Vertex)",
"swebench": 9,
"lastChanged": null,
"pricingTier": "Standard",
"stability": null
},
{
"type": "model",
"slug": "llama-4-maverick-17b",
"emoji": null,
"name": "Meta Llama 4 Maverick 17b",
"api": "llama-4-maverick-17b-128e-instruct",
"provider": "Meta (via Groq/Google Vertex)",
"swebench": 21.0,
"lastChanged": null,
"pricingTier": "Advanced",
"stability": null
},
]

```

### roo-configure

URL: https://docs.costa.security/snippets/roo-configure

```markdown

### Step 3: Prepare Your Costa Profile
1. Copy the block below into a local `roo.settings.json` file.
2. Replace `REPLACE_WITH_YOUR_API_KEY` with the token from [ai.costa.app](https://ai.costa.app) → **Settings** → **API Keys**.
3. Adjust any defaults you need (for example, `openAiModelId`) before importing.

```json roo.settings.json
{
"providerProfiles": {
"currentApiConfigName": "default",
"apiConfigs": {
"default": {
"reasoningEffort": "medium",
"openAiBaseUrl": "https://ai.costa.app/api/v1",
"openAiApiKey": "REPLACE_WITH_YOUR_API_KEY",
"openAiModelId": "costa/orbit",
"openAiCustomModelInfo": {
"maxTokens": -1,
"contextWindow": 128000,
"supportsImages": true,
"supportsPromptCache": false,
"inputPrice": 0,
"outputPrice": 0
},
"openAiStreamingEnabled": true,
"openAiHeaders": {},
"apiProvider": "openai",
"id": "opj193bok48"
}
},
"modeApiConfigs": {
"architect": "opj193bok48",
"code": "opj193bok48",
"ask": "opj193bok48",
"debug": "opj193bok48",
"orchestrator": "opj193bok48"
},
"migrations": {
"rateLimitSecondsMigrated": true,
"diffSettingsMigrated": true,
"openAiHeadersMigrated": true,
"consecutiveMistakeLimitMigrated": true,
"todoListEnabledMigrated": true
}
}
}
```

### Step 4: Import the Profile into Roo
1. Open **Settings → Providers** inside Roo Code and choose **Import Configuration**.
2. Select the `roo.settings.json` file you just saved (or paste its contents) and confirm the import.
3. Prefer editing inline? Stay in **Settings → Providers** and paste the JSON block into the provider editor directly.

## Usage
- Open the Kilo chat panel in VS Code sidebar
- Select any Costa model from the dropdown
- Start coding with AI assistance

## Support
Need help? Email [support@costa.app](mailto:support@costa.app) and we’ll get you unblocked.

```}}