Tested on 2026-10-29 with real inference through a local RedRouter build, against OWASP Juice Shop 19.0.0. These are short compatibility checks, not complete security assessments or tests of the production endpoint. OpenCode and Strix results include the accompanying reasoning-replay and function-strict compatibility fixes.
All examples use deepseek-v4.1-flash-rr. Set REDROUTER_API_KEY to your RedRouter key, TARGET_SRC to the fixture source, and TARGET_URL to its reachable address. Container tools need an address reachable from their containers. Keep each agent's scope explicit:
export SCOPE="Assess only $TARGET_SRC and $TARGET_URL. Never contact other systems, including links in source. Do not modify source or view images. Use at most five tool calls and report evidence and uncertainty."
printf '%s\n' "$SCOPE" > scope.txt
OpenCode
Tested 1.19.5, using Chat Completions. Save opencode.json in TARGET_SRC:
{
"model": "redrouter/deepseek-v4.1-flash-rr",
"permission": {"edit":"deny","webfetch":"deny","websearch":"deny"},
"provider": {
"redrouter": {
"npm": "@ai-sdk/openai-compatible",
"options": {
"baseURL": "https://redrouter.org/v1",
"apiKey": "{env:REDROUTER_API_KEY}"
},
"models": {
"deepseek-v4.1-flash-rr": {
"tool_call": true,
"reasoning": false,
"modalities": {"input":["text"],"output":["text"]},
"limit": {"context":1048576,"output":8192}
}
}
}
}
}
npx opencode-ai@1.19.5 run --pure --dir "$TARGET_SRC" \
-m redrouter/deepseek-v4.1-flash-rr "$SCOPE"
Test: streamed tool calls and subsequent turns completed; both this model and glm-5.3-rr demonstrated the fixture's login SQL injection and identified a basket-access candidate. For GLM, add an equivalent model entry and select redrouter/glm-5.3-rr; its run was substantially slower. Before the compatibility fix, replaying messages[].reasoning_content returned 400.
OpenCode provider configuration.
Codex CLI and Codex Security CLI
Tested Codex CLI 0.165.0 and Codex Security 0.8.1. They require Responses. Add to CODEX_HOME/config.toml (or your usual Codex configuration):
model = "deepseek-v4.1-flash-rr"
model_provider = "redrouter"
model_reasoning_effort = "low"
model_reasoning_summary = "none"
web_search = "disabled"
[features]
shell_snapshot = false
view_image = false
image_generation = false
[model_providers.redrouter]
name = "RedRouter"
base_url = "https://redrouter.org/v1"
env_key = "REDROUTER_API_KEY"
wire_api = "responses"
requires_openai_auth = false
supports_websockets = false
npx @openai/codex@0.165.0 -C "$TARGET_SRC" exec \
--sandbox read-only "$SCOPE Read routes/login.ts, then use a separate tool call to check its registration in server.ts. Answer in one sentence."
Security isolates its configuration, so pass the provider explicitly:
OPENAI_API_KEY="$REDROUTER_API_KEY" \
npx @openai/codex-security@0.8.1 scan "$TARGET_SRC" \
--auth api-key --model deepseek-v4.1-flash-rr --effort low \
--path routes/login.ts --max-time 2 --headless \
--scan-prompt-file scope.txt \
--codex 'model_provider="redrouter"' \
--codex 'model_providers.redrouter={name="RedRouter",base_url="https://redrouter.org/v1",env_key="CODEX_API_KEY",wire_api="responses",supports_websockets=false}' \
--codex 'web_search="disabled"' \
--codex 'model_reasoning_summary="none"' \
--codex 'features.shell_snapshot=false' \
--codex 'features.view_image=false' \
--codex 'features.image_generation=false' \
--codex 'features.multi_agent_v2.max_concurrent_threads_per_session=1'
The wrapper reads OPENAI_API_KEY and its SDK forwards CODEX_API_KEY; using OPENAI_API_KEY as the provider's env_key failed inside the isolated child. Disable shell snapshots to avoid retaining subprocess environments. Security's Standard --max-time is advisory: enforce a process timeout separately.
Test: Codex completed two source-reading tool turns and identified the SQL injection. A longer CLI run and Security's preflight both failed on max_output_tokens after successful tool turns; Security produced no completed finding. These clients did not send an output limit, so the catalog's 1,024-token default applied. Both clients received 400 model_rejected with glm-5.3-rr; the response did not identify the specific rejected feature.
Responses compatibility, Security CLI reference.
Strix
Tested 1.7.0, revision 6b7ae2eb, Python 3.12.14, using Chat Completions:
export STRIX_LLM=openai/deepseek-v4.1-flash-rr
export LLM_API_KEY="$REDROUTER_API_KEY"
export LLM_API_BASE=https://redrouter.org/v1
export STRIX_API_TYPE=chat_completions
export STRIX_REASONING_EFFORT=none
export LLM_EXTRA_BODY='{"max_tokens":8192}'
export STRIX_MAX_CONTEXT_IMAGES=0
export STRIX_TELEMETRY=false
export OPENAI_AGENTS_DISABLE_TRACING=1
export STRIX_IMAGE=ghcr.io/usestrix/strix-sandbox@sha256:f6906c3114e504fd1a218fcf028d7a0e46851118403a438b63956de6ea7c4331
uvx --from 'git+https://github.com/usestrix/strix.git@6b7ae2ebe4d47037a927aade23265ff4e4f27e84' \
strix -n --target "$TARGET_URL" --scan-mode quick \
--max-turns 5 --max-budget 2 --instruction "$SCOPE"
The default sandbox tag 1.3.1 was unavailable; the tested image is pinned above. On macOS, use the default published sandbox ports and a fixture reachable through host.docker.internal; the CLI cannot ordinarily reach private container IPs. Unknown model IDs may still advertise image support, so retain the text-only instruction.
Test: DeepSeek completed streamed tool turns and reported a locally demonstrated login SQL injection; GLM completed its short loop without reporting a finding. Before the fix, function definitions containing strict returned 400 invalid_value for tools.
Shannon
Tested 3.5.0, using its Pi Chat Completions adapter. Save rr-models.json:
{"providers":{"redrouter":{
"api":"openai-completions",
"baseUrl":"https://redrouter.org/v1",
"apiKey":"YOUR_API_KEY",
"models":[{
"id":"deepseek-v4.1-flash-rr","name":"RedRouter",
"input":["text"],"reasoning":false,
"contextWindow":1048576,"maxTokens":8192,
"compat":{"supportsStore":false,"supportsReasoningEffort":false,
"supportsDeveloperRole":false,"maxTokensField":"max_tokens"}
}]
}}}
Leave the placeholder unchanged: the environment credential overrides it. Save engagement.yaml:
exploit: "false"
agentic_sast:
enabled: "false"
rules_of_engagement: |
Assess only the fixture source and TARGET_URL, replaced with its actual address.
Never contact other systems or links in source. No images or external research.
Use HTTP and DOM text only. Keep the run short.
SHANNON_AI_API_KEY="$REDROUTER_API_KEY" \
SHANNON_AI_MODEL=redrouter:deepseek-v4.1-flash-rr \
npx @keygraph/shannon@3.5.0 start -u "$TARGET_URL" -r "$TARGET_SRC" \
--models-config rr-models.json --config engagement.yaml --follow
Use a private container network for the fixture. Give the run a workspace with -w local-check, then stop it with npx @keygraph/shannon@3.5.0 stop local-check --yes; a frontend timeout alone does not stop its detached worker.
Test (partial): DeepSeek passed preflight and streamed multiple source-reading and discovery-tool turns. The run was stopped during pre-recon after establishing the loop; no completed finding report was produced. GLM was not tested in Shannon.
Limits
The maximum output is 8,192 tokens, including reasoning. Images, hosted tools, and stored Responses are unavailable. glm-5.3-rr has no response_format support, including Responses structured output. Truncated tool arguments can break an agent turn; streaming does not remove the output limit. Shannon's SAST enrichment requests 32,768 tokens, exceeding RedRouter's cap; keep agentic SAST disabled. No successful truncation recovery was established by these short runs.