| api-key | AI API key (OpenAI-compatible). Store as a GitHub secret. | yes | — |
| api-base-url | Base URL for the AI API (OpenAI, Azure OpenAI, Ollama, etc.) | no | https://api.openai.com/v1 |
| model | Model identifier to use for analysis | no | gpt-4o |
| checks | Comma-separated list of checks to run, or "all". Built-in: code-quality, sast, secret-detection, iac-security, container-security
| no | all |
| config-file | Path to a pr-guard.config.yml with per-check overrides | no | "" |
| custom-checks-dir | Path to a directory with custom check definitions (prompt.md + config.yml) | no | "" |
| full-scan | Scan ALL tracked files regardless of git diff (overrides diff-only) | no | false |
| diff-only | Analyze only files changed in the PR / push (true/false) | no | true |
| severity-threshold | Minimum severity that causes a non-zero exit (info, low, medium, high, critical) | no | high |
| output-format | Report format: markdown, json, or sarif | no | markdown |
| ship-to | Comma-separated destinations: github-summary, file, webhook, github-pr-comment
| no | github-summary |
| ship-webhook-url | Webhook URL for shipping results (used when ship-to includes 'webhook') | no | "" |
| ship-file-path | Base file path for the report (used when ship-to includes 'file') | no | pr-guard-report |
| max-file-size-kb | Skip files larger than this (KB) | no | 100 |
| max-context-tokens | Approximate token budget per AI request | no | 100000 |
| exclude-patterns | Comma-separated glob patterns to exclude from analysis | no | "" |
| github-token | GitHub token (for PR comments). Usually secrets.GITHUB_TOKEN | no | "" |
| request-delay-ms | Minimum delay (milliseconds) between AI API calls to avoid rate limits | no | 0 |
| temperature | AI sampling temperature (0.0 = deterministic, 1.0 = creative). Lower is better for code review. | no | 0.1 |
| api-timeout | Timeout in seconds for each AI API call. Increase for slower models (e.g. gpt-5). | no | 300 |
| debug | Enable verbose debug logging (git commands, file filtering, AI responses) | no | false |