AIFT uses a layered configuration system. Settings are resolved in this order (highest priority first):

1. Environment variables — API keys from shell environment
2. config/config.yaml — User overrides under the project root
3. Hardcoded defaults — Built-in values in app/utils/config.py

If config/config.yaml does not exist on startup, AIFT creates one from the defaults automatically.

Headless automation entry points (aift_cli.py --config, REST /api/automation/run config_path, and MCP config_path) can use any existing YAML config file path, including custom filenames such as config/acme-analysis-settings.yml. When omitted, they use config/config.yaml.

Controls which AI provider is active and per-provider connection settings.

For OpenAI-compatible local endpoints (Ollama, LM Studio, vLLM, etc.).

The archive_max_* limits apply to every archive extraction entry point: GUI evidence intake, the GUI Scan Directory helper, headless automation discovery, and the MCP aift_discover_evidence tool — including nested archives found inside extracted archives.

Controls headless automation run retention.

Values below 60 seconds are rejected.

Note: max_merge_rounds is not in the hardcoded defaults but can be set in config/config.yaml or via the UI advanced settings. It controls the maximum number of hierarchical merge iterations when chunked analysis produces multiple findings. The UI defaults to 5.

Environment variables override config/config.yaml values. Only API keys are mapped:

If an environment variable is set and non-empty, it always wins over the config/config.yaml value.

The settings gear icon in the web UI exposes a Basic tab and an Advanced tab.

• AI provider selection (ai.provider)
• Per-provider fields: API key, model, base URL (where applicable)
• Server port (server.port)

• analysis.ai_max_tokens
• analysis.ai_response_max_tokens
• analysis.ai_input_safety_margin_tokens
• analysis.shortened_prompt_cutoff_tokens
• analysis.connection_test_max_tokens
• analysis.citation_spot_check_limit
• analysis.artifact_csv_row_limit
• analysis.artifact_deduplication_enabled
• analysis.max_merge_rounds
• automation.run_retention_seconds
• evidence.large_file_threshold_mb (displayed in GB as "Evidence Size Threshold"; fractional GB values are accepted and stored in MB)
• evidence.intake_timeout_seconds
• ai.local.request_timeout_seconds
• ai.<provider>.attach_csv_as_file (per-provider toggles for Claude, OpenAI, Kimi, Local)

• server.host — must be edited in config/config.yaml
• analysis.artifact_ai_columns_config_path — must be edited in config/config.yaml

File: config/artifact_ai_columns.yaml

This file controls which CSV columns are sent to the AI for each artifact type. By default, all columns from a parsed artifact CSV are included. When an artifact has an entry in this file, only the listed columns are sent — reducing token usage and focusing the AI on forensically relevant data.

artifact_ai_columns:
  <artifact_key>:
    - column_name_1
    - column_name_2
    - ...

artifact_ai_columns:
  runkeys:
    - ts
    - name
    - command
    - username
  shimcache:
    - last_modified
    - name
    - path

The shipped config/artifact_ai_columns.yaml contains projections for the current Windows and Linux registry keys. Use that file as the source of truth for the exact artifact keys and column names. OS-suffixed keys such as services_linux apply only when that OS matches.

Some projection entries target combined artifact keys, including thumbcache, ual, certlog, and dpapi.keyprovider.

• To include all columns for an artifact: remove its entry from the file.
• To restrict columns: list only the column names you want the AI to see.
• Column names must match the CSV headers exactly (as produced by the Dissect parser).
• Changes take effect on the next analysis run — no restart required.