Blog

Use low-refusal models in Claude Code, OpenCode and Cline

By the RedRouter Team · Tested October 27, 2026
October 22, 2026

Claude Code speaks the Anthropic Messages API, and RedRouter serves it at https://redrouter.org/v1/messages, so no proxy is needed. Set a few environment variables and start claude. OpenCode and Cline use RedRouter's OpenAI-compatible endpoint at https://redrouter.org/v1.

This guide is for pentesters, AppSec engineers and defenders who already work inside a coding agent. If your current setup does what you need, keep it.

You need a RedRouter API key with credit on it. The quickstart takes about two minutes.

Which model

All four RedRouter models support tool calling, which every coding agent needs.

Agents resend the whole conversation on every step, so input tokens dominate the bill. Cached input is cheaper only when a cache read is reported.

On the catalog as it stands, we recommend GLM 5.3 Flash RR as the default for agent work. It is the cheapest of the four at $0.20 input and $0.80 output per million tokens, and since an agent resends the whole conversation every step, input price is what the bill turns on. DeepSeek V4.1 Flash RR costs $1.15 and $2.30, with the same million-token context; pick it when you want its abliterated checkpoint. Keep GLM 5.3 RR for the occasional hard problem where you want the full-size model and will pay $1.40 and $2.50 for it; it is also the one model here without JSON mode, so avoid it for agents that need structured output. All four do tool calling, which every coding agent needs.

Claude Code

export ANTHROPIC_BASE_URL="https://redrouter.org"
export ANTHROPIC_AUTH_TOKEN="$REDROUTER_API_KEY"
export ANTHROPIC_API_KEY=""
export ANTHROPIC_MODEL="glm-5.3-rr"
export ANTHROPIC_DEFAULT_SONNET_MODEL="glm-5.3-rr"
export ANTHROPIC_DEFAULT_OPUS_MODEL="glm-5.3-rr"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="glm-5.3-rr"
export ANTHROPIC_DEFAULT_FABLE_MODEL="glm-5.3-rr"
export CLAUDE_CODE_SUBAGENT_MODEL="glm-5.3-rr"
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1"
export ENABLE_TOOL_SEARCH="false"
claude

The base URL has no /v1; Claude Code adds /v1/messages itself. Every model tier points at the same RedRouter model, so subagents and background tasks never fall back to an Anthropic model you are not paying for here. Swap glm-5.3-rr for any other model ID.

Things that behave differently from Anthropic's own API:

• Text and tool blocks work. Images, PDFs and server-side tools return 400, so pasting a screenshot into the session fails.
• The token-counting endpoint returns 404. Claude Code estimates locally instead.
• Extended thinking, prompt-cache hints and effort settings are accepted so the client does not error, and then ignored.
• Each response returns at most 8,192 output tokens. Larger max_tokens values are capped, not rejected.

We ran Claude Code 2.1.311 against RedRouter with ANTHROPIC_MODEL=glm-5.3-rr on October 27, 2026, pointing it at a deliberately vulnerable Flask app in a throwaway directory and asking it to audit and patch the file.

One thing to fix up front: Claude Code does not recognise glm-5.3-rr as a known model, so it assumes a 200k-token context window and prints a warning. The real window is larger. Set it yourself with Claude Code's model-config override if you rely on long context, or the client will compact earlier than it needs to.

Claude Code doesn't recognize the model "glm-5.3-rr", so it assumes a context
window of 200k tokens. [...] see .../model-config to set the window.
[claude-code:unrecognized_model] {"model":"glm-5.3-rr","query_source":"sdk"}

Past the warning it worked. It found and fixed the SQL injection (parameterised the query), the reflected XSS (escaped the output) and the hard-coded Flask secret (moved it to an environment variable), and it flagged the plaintext passwords without silently redesigning the app. The edits applied cleanly:

-    query = f"SELECT name FROM users WHERE name = '{name}' AND password = '{password}'"
-    row = db().execute(query).fetchone()
+    query = "SELECT name FROM users WHERE name = ? AND password = ?"
+    row = db().execute(query, (name, password)).fetchone()

OpenCode

Save this as opencode.json in your project or OpenCode's config directory:

{
  "model": "redrouter/deepseek-v4.1-flash-rr",
  "provider": {
    "redrouter": {
      "npm": "@ai-sdk/openai-compatible",
      "name": "RedRouter",
      "options": {
        "baseURL": "https://redrouter.org/v1",
        "apiKey": "{env:REDROUTER_API_KEY}"
      },
      "models": {
        "deepseek-v4.1-flash-rr": { "name": "DeepSeek V4.1 Flash RR" }
      }
    }
  }
}

Add one entry under models for each RedRouter model you want in OpenCode's model picker.

We tested OpenCode 1.19.4 with redrouter/deepseek-v4.1-flash-rr on October 27, 2026. It read the file and ran a shell command, then the second turn failed:

Error: Unsupported parameter: messages[2].reasoning_content.

OpenCode sends the model's own reasoning_content back in the next request, and RedRouter rejects fields it does not recognise with a 400 instead of ignoring them. That is the strictness this post mentions throughout, and here it stops a reasoning model's multi-turn session. Until it is resolved, use a non-reasoning model such as glm-5.3-flash-rr or qwen3.8-27b-rr with OpenCode, which do not send that field.

Cline

In Cline's settings, choose the OpenAI Compatible provider and fill in:

RedRouter rejects request fields it does not support instead of silently dropping them. If Cline sends one, the request fails with a 400 that names the problem.

We tested the Cline CLI 3.0.74 on October 27, 2026. Configure the OpenAI Compatible provider from the command line:

cline auth openai --baseurl https://redrouter.org/v1 --apikey "$REDROUTER_API_KEY" --modelid qwen3.8-27b-rr

In the VS Code extension (4.1.26) the same three fields are under the OpenAI Compatible provider: Base URL, API Key and Model. Given the same Flask app as above, Cline on qwen3.8-27b-rr fixed the SQL injection, the XSS and the secret, then started the patched app and checked itself:

The run was noisier than the others, with the model fighting its own shell-quoting a few times before it settled, but it finished and cleaned up after itself.

A first task that proves it works

Give the agent something a mainstream model tends to refuse and that you are allowed to do, against a target you own: a local OWASP Juice Shop container, a Metasploitable VM, a CTF box you have access to.

For the Claude Code run above the target was a small Flask app with a SQL injection, a reflected XSS and a hard-coded secret, in a directory the agent could edit. The prompt was:

Audit app.py in this directory for security vulnerabilities. For each finding give the line, the vulnerability class and a one-line fix, then patch app.py to fix them.

A good answer names each flaw by class, patches it correctly (parameterised query, escaped output, secret from the environment) and says what it chose not to change and why, rather than refusing or rewriting the whole file. That is what the run produced.

Before you rely on it

RedRouter's terms prohibit testing systems you do not own or are not authorized to test. By default, prompts and completions are kept encrypted for up to 30 days for abuse prevention, support, debugging and billing disputes. That includes the source code an agent reads into context. Turn on Zero Data Retention in Settings if that is not acceptable for a client engagement. It stops storage of request content and adds 20% to every rate.