Prompts

The research model works best when the target, the purpose and the shape of the output are each stated in one sentence. This page writes in the same vocabulary admission uses (task / scope) and shows what stays clear of the guardrails.

The system turn

{"role": "system", "content": "You are reviewing code the user owns (scope: owned). Report concrete findings with file:line evidence. Prefer fixes over descriptions. Output English."}

One leading system turn only: role, scope, output language and format. task is the purpose (code-review / vulnerability-triage / remediation), not a phrase in the prompt; the bearer path defaults to code-review.

Passing files

jq -n --arg m "qwen3.8-flash-next-whitehacker" --rawfile f src/auth.ts \
  '{model:$m,max_tokens:4096,messages:[{role:"user",content:("Review src/auth.ts for auth bypasses.\n\n```ts\n"+$f+"\n```")}]}' \
  | curl -s -X POST https://api.mithril.fund/v1/chat/completions -H "Authorization: Bearer $KOTOBA_API_TOKEN" -H "content-type: application/json" -d @-

• content is a string (no images, audio or attachments); put files in the body as code blocks.
• The input ceiling is 524,288 characters (tool definitions included). For a large repository, narrow to the relevant files or let the agent's tools read them.
• Up to 256 turns; return tool results as role: tool with tool_call_id.

Deciding the output shape

• Bullets, tables, JSON — ask in the body; strict JSON is forced through a tool call (Structured outputs).
• max_tokens covers the answer plus reasoning; 2,048 or more even for short answers.
• temperature and friends are dropped; to reduce variance, demand a shape and evidence.

What to avoid (guardrails)

• csam-block — block: CSAM references are refused on every request (AUP strictly-prohibited).
• cbrn-block — block: CBRN/WMD uplift requests are refused on every request (AUP strictly-prohibited).
• fraud-block — block: Fraud-as-a-service asks are refused (AUP strictly-prohibited).
• secret-hygiene — redact: Live credential shapes in the prompt are masked before the model sees them.
• pii-passkeys — flag: References to passkeys/private keys are flagged for review, never blocked.

Live credential shapes (sk-…, AKIA…, PRIVATE KEY) are masked before the model sees them (redact); use dummy values in tests. A block is 403 guardrail-blocked and leaves a durable receipt.

The offensive band (payload-crafting / c2-tooling) is closed until the contracted rung. Even PoC work inside an authorized engagement is refused on that task — the answer is raising the rung, not rewording the request.