Configuration reference

Every parameter mrsentry accepts, generated from the code. Each key can be set in YAML, as an environment variable, or for many keys, as a CLI flag.

Where settings come from

From highest to lowest priority:

1. CLI flags, e.g. --fail-on high or --model azure/gpt-4o.
2. Environment variables named MRSENTRY_<SECTION>__<KEY> (double underscore between levels). Values are parsed as YAML, so MRSENTRY_REVIEW__EXCLUDE='["**/gen/**"]' and MRSENTRY_REVIEW__MAX_INLINE_COMMENTS=10 both work.
3. The repository's .mrsentry.yml, restricted to the keys marked repo below.
4. Org config from --config or MRSENTRY_CONFIG.
5. Defaults.

In GitLab CI, CI_SERVER_URL, CI_PROJECT_ID and CI_MERGE_REQUEST_IID fill in gitlab.url, gitlab.project and gitlab.mr_iid automatically. The GitLab token is looked up in MRSENTRY_GITLAB_TOKEN, then the variable named in gitlab.token_env, then GITLAB_TOKEN.

On this page: GitLab · LLM · Review · ECR · Fix · Output · General

GitLab gitlab.*

Where your GitLab is and how mrsentry authenticates to it.

LLM llm.*

Model profiles, which profile each task uses, fallbacks and spending limits.

Review review.*

What gets reviewed, how strict the reviewer is and how comments are posted.

ECR ecr.*

Which image to scan, which severities matter and what to do with stale results.

Fix fix.*

How vulnerabilities are fixed, verified and delivered.

Output output.*

Artifacts written for GitLab and for humans.

General

Top-level switches.

Annotated example

This is the starter org config produced by mrsentry config init:

# mrsentry org/CI configuration. Pass with --config or MRSENTRY_CONFIG.
# Secrets never go here: use env vars (MRSENTRY_GITLAB_TOKEN, AWS default chain, api_key_env).
gitlab:
  url: https://gitlab.example.com        # default: $CI_SERVER_URL
  verify_ssl: true
  # ca_bundle: /etc/ssl/certs/corp-ca.pem

llm:
  profiles:
    default:                             # Amazon Bedrock (uses the AWS default credential chain)
      model: bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0
      aws_region: us-east-1
    # azure:
    #   model: azure/my-gpt-4o-deployment
    #   api_base: https://my-resource.openai.azure.com
    #   api_version: "2024-10-21"
    #   api_key_env: AZURE_OPENAI_API_KEY
    # anthropic:
    #   model: anthropic/claude-sonnet-4-5
    #   api_key_env: ANTHROPIC_API_KEY
    # proxy:                             # LiteLLM proxy
    #   model: litellm_proxy/claude-sonnet
    #   api_base: https://litellm.internal
    #   api_key_env: LITELLM_API_KEY
    # local:                             # any OpenAI-compatible server (vLLM, Ollama, LM Studio)
    #   model: openai/qwen2.5-coder-32b
    #   api_base: http://vllm.internal:8000/v1
    #   api_key_env: VLLM_API_KEY
  roles: { review: default, summarize: default, fix_repair: default }
  fallbacks: []
  max_cost_usd_per_run: 5.0

review:
  min_severity: medium
  max_inline_comments: 25
  agent: { enabled: true, max_steps: 12 }
  # extra_instructions: |
  #   We use Spring Boot 3 and jOOQ. Flag any raw JDBC.

ecr:
  # image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/my-service:latest
  min_severity: high
  freshness_max_age: 24h
  on_stale: rescan          # rescan | local | warn | fail
  local_scanner: trivy

fix:
  mode: new-mr              # new-mr | existing-mr
  strategy: prefer-direct-upgrade
  verify:
    maven: mvn -B -q -DskipITs verify
    gradle: ./gradlew build -x integrationTest
    npm: npm ci
    pnpm: pnpm install --frozen-lockfile
    yarn: yarn install --frozen-lockfile
    poetry: poetry install --no-root
    uv: uv sync
  allow_llm_repair: true

output:
  dir: mrsentry-out
  formats: [json, markdown, codequality, dotenv]
  # fail_on: critical