Choose a model for your workflow
Check capabilities, cost and data handling before connecting. You choose the model used for each request.
Start with the task
| Your workflow | What to check |
|---|---|
| Review source files | What to checkEnough input space for your code, instructions and conversation, with room left for the answer. |
| Check a draft finding | What to checkInclude the relevant code, evidence and scope. Compare whether the answer supports its claims, not just whether it agrees. |
| Run an agent with tools | What to checkChoose the tools capability and a client that supports OpenAI-compatible Chat Completions. Your client executes tools; the Model API supplies text and tool calls. |
Check streaming and structured-output support separately. A model’s name or “low refusal” label does not establish tool compatibility or finding quality. Use the exact model ID from the catalog.
Start without buying model credit
Three different routes—not an unlimited free hosted API:
| Route | What you need | Limit to understand |
|---|---|---|
| Use your AI chat | What you needCopy the prepared prompt into your chat and paste its answer back. No Bounty Operator account or API key. | Limit to understandThe three core review types. Your chat provider’s costs and limits still apply. |
| Use your coding agent | What you needConnect the free MCP tools. Your agent’s own model reviews the files and builds the packet. | Limit to understandThe three core review types. No Bounty Operator account; your agent’s model costs still apply. OpenCode setup covers v1 and v2. |
| Choose a free OpenRouter model | What you needYour OpenRouter account/key and a free Bounty Operator account for the hosted review. Open Find a free OpenRouter model on the Run step. | Limit to understandOne hosted review per UTC day on Bounty Operator Free. OpenRouter’s separate rate and capacity limits apply. |
The picker reads OpenRouter’s current catalog when you ask. It only lists zero-priced text models with a documented output allowance large enough for a review. It does not change the selected model until you choose one, and it never switches to a paid model automatically. A listing is not a benchmark result or a promise of capacity.
As checked on 20 October 2026, OpenRouter documents 20 free-model requests per minute and 50 per day below its purchased-credit threshold, or 1,000 per day after at least 10 credits purchased. These are provider account limits, not a shared allowance supplied by Bounty Operator.
Free does not mean confidential. Check OpenRouter provider logging and the actual model host’s terms before sending a private report. OpenCode’s free models and privacy exceptions vary by model; some collect data to improve the model, and NVIDIA trial endpoints prohibit confidential or personal data. Start with public or invented examples unless the program permits the selected data handling.
These are independent services, not claimed partnerships. Bounty Operator’s own hosted Model API remains a separate prepaid product.
Use your own Novita AI key
Novita is an optional provider for hosted reviews, not a free-model route or Bounty Operator’s default. It serves models under your own Novita account and bills their usage separately from Bounty Operator.
- Create a Novita account (affiliate link), or sign in to your existing account. Disclosure: we may earn a commission if you sign up and pay for Novita through this link. Commission does not determine our defaults or benchmark rankings.
- Check Novita’s current model pricing, account limits and available credit before running a review. Do not assume signup includes free inference. Review its data-handling terms before sending a private report.
- Create or manage your Novita API key. Existing account holders can go directly here; the key-management link is not an affiliate link.
- Select Novita AI, choose your files and review type, and paste the key on the Run step under My own API key. Choose an exact model ID supported by Novita, or leave Model empty to use
deepseek/deepseek-v4.1-flash. Then run the review when you are ready.
A Bounty Operator account is still required for hosted reviews. Free covers one hosted review per UTC day; Operator’s review allowance does not include Novita usage. Bounty Operator API credit cannot pay Novita charges. Selecting Novita does not start a request, buy credit or create a paid fallback.
Your files and key pass through Bounty Operator to Novita only when you run a hosted review. The optional signup link sends referral parameters to Novita, not your files or key; Novita may track the visit under its own policies. We add no affiliate scripts or pixels. See affiliate-link privacy and Novita’s API quickstart.
Use your own Nebius Token Factory key
Nebius Token Factory is an optional provider for hosted reviews, not a free-model route or Bounty Operator’s default. It serves open models under your own Nebius account and bills their usage separately from Bounty Operator. We receive no commission from Nebius.
- Sign in to Nebius Token Factory, or create an account. Before it issues an API key, Nebius asks for billing details, including a card it verifies with a $0 authorization. Its setup also offers zero data retention; turn it on before sending a private report. Check its current model pricing and your available credit before running a review.
- Create a Nebius API key.
- Select Nebius Token Factory, choose your files and review type, and paste the key on the Run step under My own API key. Choose an exact model ID from Nebius’s catalog, or leave Model empty to use
deepseek-ai/DeepSeek-V4.1-Flash. Then run the review when you are ready.
A Bounty Operator account is still required for hosted reviews. Free covers one hosted review per UTC day; Operator’s review allowance does not include Nebius usage. Bounty Operator API credit cannot pay Nebius charges. Selecting Nebius does not start a request, buy credit or create a paid fallback.
Your files and key pass through Bounty Operator to Nebius only when you run a hosted review. Each request asks Nebius not to store the answer (store: false). Nebius processes the content under its own terms and your account’s retention setting. See Nebius’s quickstart.
Compare cost and readiness
Check the model’s current availability before starting. In the catalog, switch workload view to compare estimated token costs, including the minimum request charge. An agent can make several requests for one task, so set an output limit and a spending cap on its API key.
Estimates are not quotes for a completed investigation. Credit is reserved before a request, and the unused portion is released after settlement. A self-hosted model may take several minutes to start after idle. Allow for that startup time when choosing a model for interactive work. See charging and timeout details.
Choose where your content goes
Read the hosting provider and source details on the model card. Our self-hosted RunPod deployments disable prompt and response logging and cross-request prefix caching. Managed models use Infron or OrcaRouter, including any downstream providers, under their own terms and retention policies. They do not come with a zero-retention guarantee.
Send only material you are authorized to share with the selected providers. Review the data handling details before connecting confidential work.
Read the evidence in context
Our Paydirt benchmark, published , measures small-file Solidity and TypeScript review and checking draft reports. Compare its errors, costs and evaluation method alongside its scores. It does not measure whole-repository audits or live web and cloud assessments.
Wiz Cyber Model Arena is an external reference for broader tasks. Its results evaluate a model together with its agent harness. They do not score our hosted variants: a base model’s result does not transfer to a fine-tune, quantized version or different harness. If the exact setup has no matching evaluation, its performance is unmeasured here.
Start with a small authorized task whose outcome you can check. Keep the model, harness and settings recorded so comparisons mean something.