uncensored llm api for security research

redrouter serves models with refusal behavior reduced, for security work you're authorized to do. use it on systems you own or have written permission to test. our terms prohibit using the service to "attack, access, or test systems you do not own or are not authorized to test."

what it's for

• recon. plan and organize attack-surface mapping on an in-scope target. here's a full walkthrough.
• exploit triage. work out whether a known CVE applies, reproduce it in a lab, and write up impact.
• malware analysis and reverse engineering. read a suspicious loader, or pick apart an undocumented file format.
• detection rules. turn what you found into YARA or Sigma rules and a list of what to check next.

built for security work has three scoped workflows with prompt shapes.

agent setup with GLM 5.3 Flash RR

we use GLM 5.3 Flash RR as the default for agent work: $0.20 in / $0.08 cached / $0.80 out per 1M tokens, 1M context. an agent resends the whole conversation on every step, so the input price is what the bill turns on. you'll need an API key with credit.

for claude code:

export ANTHROPIC_BASE_URL="https://redrouter.org"
export ANTHROPIC_AUTH_TOKEN="$REDROUTER_API_KEY"
export ANTHROPIC_API_KEY=""
export ANTHROPIC_MODEL="glm-5.3-flash-rr"
export ANTHROPIC_DEFAULT_SONNET_MODEL="glm-5.3-flash-rr"
export ANTHROPIC_DEFAULT_OPUS_MODEL="glm-5.3-flash-rr"
export ANTHROPIC_DEFAULT_HAIKU_MODEL="glm-5.3-flash-rr"
export CLAUDE_CODE_SUBAGENT_MODEL="glm-5.3-flash-rr"
claude

the base URL has no /v1, because claude code adds it. for opencode, cline and others, see the agent setup guide and the security agents docs. keep a written scope in the working directory and leave the agent's approval prompts on.

what abliteration changes, and what it doesn't

abliterated models are open-weight models modified to reduce refusal behavior. we label ours RR. we don't add a refusal layer on top.

what changes: the model should decline less often on legitimate security work, like the requests in the refusal archive.

what doesn't change:

• reduced refusals isn't no refusals. a model can still decline.
• it can still be wrong. check results against your tool output.
• it doesn't make the model smarter.
• it doesn't change what you're allowed to do. scope, authorization and our terms still apply.
• the RR label doesn't establish an exact weight revision. each model page lists what the host reports and marks anything unknown.

data handling

new API keys don't store prompts or completions. existing keys start with storage on, and browser chat and the mac app store content unless you turn on zero data retention. stored content is encrypted, kept for up to 30 days, and never shown to customers.

zero data retention is an opt-in switch in settings, off until you turn it on and free on monthly plans. if your client contract says no prompt retention, turn it on before you start. it covers every API key and chat on your account, and usage metadata is still recorded for billing.

we ask the host that runs the model not to log requests, but we can't independently verify what it keeps. what redrouter keeps has the full policy, and pricing has what it costs.

evidence

• the refusal archive collects dated public reports of interruptions during security work. the methodology covers evidence and authorization rules.
• when strict JSON changes the score is our 900-run study on how output contracts change refusal scores. it's an exploratory report with provisional labels, not a model ranking.