[heydryft]

What this adds

A Runcrate preset in the LLM spec list, so a Runcrate-hosted model can be picked as a scan target in the UI and through GET /v1/llm-specs, the same way the Together.ai and OpenRouter presets work. Runcrate serves open-weight models (DeepSeek, Qwen, Kimi, GLM, gpt-oss and others) behind an OpenAI-compatible chat completions API at https://api.runcrate.ai/v1.

The preset sends <<PROMPT>> as the user message to deepseek-ai/DeepSeek-V4-Flash, with Authorization: Bearer $RUNCRATE_API_KEY.

Files:

• agentic_security/routes/_specs.py: spec appended to _SPECS and a matching Runcrate entry appended to LLM_CONFIGS (same position, so the zip that builds LLM_SPECS stays aligned). It uses the existing fallback icon, /icons/myshell.png.
• agentic_security/static/base.js: the same spec and config appended to the UI lists.
• tests/unit/test_runcrate_spec.py: the preset parses to a POST to https://api.runcrate.ai/v1/chat/completions with the right model and text modality, and probe() sends the prompt as a valid JSON user message (the HTTP call is stubbed).

Checks run

• pytest tests/unit: 353 passed, 1 skipped.
• pytest tests: 430 passed, 3 skipped, 22 deselected, 1 error. The error is tests/system/test_lib.py::TestLibraryLevel::test_class (FileNotFoundError), and it errors the same way on main without this change.
• black --check and flake8 on the changed Python files: clean.
• Live check (local script, not committed): took the Runcrate entry from LLM_SPECS, put a real key in place of $RUNCRATE_API_KEY, and ran LLMSpec.verify(). It returned HTTP 200 from deepseek-ai/DeepSeek-V4-Flash with finish reason stop.

This PR was prepared with AI assistance (omp with Claude): the preset, the test and this description were written with it, and the commands and live call above were run as described.

[msoedov]

@heydryft thx for the patch

[heydryft]

Thanks @msoedov for merging the preset! Glad agentic_security can scan against Runcrate models out of the box.