Rothalyx treats AI as an optional analysis layer that sits on top of the static pipeline. The pipeline runs fully without a model, and the desktop app can stay in heuristic-only mode. When enabled, the model-backed flow is: run normal static analysis, choose a bounded set of candidate functions, build a compact function-context payload, submit the request to the selected provider, normalize the response into insight records, and persist those results with the run.

The layer supports OpenAI (Responses API), Anthropic (Messages API), Gemini (generateContent), OpenAI-compatible gateways, and local LLM endpoints (chat-completions style), plus a heuristic-only mode and an auto backend. Every provider response is normalized into one internal insight shape: suggested function name, short summary, analyst hints, pattern detections, and vulnerability hints. The parser is conservative; a malformed or unusable response falls back to heuristics rather than blocking analysis.

Two controls define the layer’s safety envelope. First, request bounding: max functions per run, request timeout, and an optional daily remote-request cap, all controllable via rothalyx_ai_options_t (max_model_functions, timeout_ms, backend, base_url, and so on). Second, secret handling: keys live in the OS keyring (Credential Manager, Keychain, Secret Service), never silently in plaintext settings. Local LLM mode preserves the same bounded selection and structured parsing while keeping requests, and any billing implications, local. Measured behavior of these controls is Additional validation required.