Bruno v4 has a built-in AI assistant but no Bruno-hosted model. It runs on your OpenAI or Anthropic key, or an OpenAI-compatible endpoint. It writes tests for you, explains a response you have never seen before, and autocompletes scripts as you type. It uses the model you select from what you already run. And, unlike most AI features in developer tools, it does not send your headers, your bodies, or your secret variables to the model unless you explicitly ask it to. This post walks through what the assistant does, how it works under the hood, and the security posture that shipped with it.
Table of Contents
Every API client has bolted on AI in the last few years. Most of them made the same trade: send everything to the vendor's model behind a single API key you do not control and hope the fine print holds. That model does not work for the teams using Bruno. Half of them run behind proxies, on air-gapped machines, or in regulated shops where "we sent your production headers to OpenAI" is a compliance incident.
So the design started from a different place. Your key. Your provider. Your data leaves your machine only when you decide it does.
The promise in one line: Bruno's AI is off by default. When you turn it on, sensitive headers, secret variables, and real response body values stay on your machine by default.
There are three surfaces today, each one small enough that you can pick it up in a minute.
Chat sidebar
Open it from any tab. It knows what request you have open, what environment is active, and what the last response looked like. Ask why a request is returning 401 or ask for tests and it answers with the context already loaded.
Generate
Right-click a request or open the AI menu and Bruno writes docs, scripts, or tests. The output arrives as a proposed diff you review before it lands, not an autocomplete that overwrites your file.
Scripting autocomplete
Inline ghost text in the script editor. It knows Bruno's bru.* API so suggestions actually run. Set the trigger to aggressive, debounced, or manual depending on how much you want it in your face.
Example: AI auto-suggestions
Example: AI generated test-cases
The provider layer is pluggable. OpenAI and Anthropic are first-class. Anything else that speaks the OpenAI API language (Ollama running locally, Together, or your own self-hosted vLLM) plugs in as an OpenAI-compatible endpoint with a base URL and a key.
| Provider | Models available in the picker | Where you get a key |
|---|---|---|
| OpenAI | GPT-4o, GPT-4o Mini, GPT-5, GPT-5 Mini | platform.openai.com/api-keys |
| Anthropic | Claude Opus 4.7, Claude Sonnet 4.6, Claude Haiku 4.5 | console.anthropic.com/settings/keys |
| OpenAI-compatible endpoint | Whatever the endpoint exposes (Ollama, Together, self-hosted vLLM, and so on) | Configure a base URL and an optional key |
Every AI feature in Bruno follows the same pipeline. It matters because the safety guarantees below only work if every surface goes through it.
Read this. This is the part of the design most likely to matter to your security team.
1. Sensitive headers are redacted
Bruno's built-in list catches Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token, and any name matching common patterns like token, secret, password, or api_key. These get replaced with <redacted> before they ever reach the model.
2. Response bodies go as shape, not values
When the assistant needs to know what the response looks like, it gets a redacted tree: keys, array structure, and value types only. A field with the string sk-abc123 becomes <string>. A field with the number 42 becomes <number>. The model sees enough to help you write assertions and pick correct property paths. It never sees the real values.
3. Secret variables come back redacted
Anything you marked with secret: true in your environment is redacted everywhere the assistant might see it. The variable name stays visible so the model can suggest the right accessor. The value never leaves your machine.
4. You can add your own names to redact
Preferences → AI → Security lets you add custom header names and custom variable names. They redact everywhere, on top of the built-in list, with no toggle required. Explicit opt-in beats a pattern match.
Every redaction rule is a toggle. The four top-level rules (headers, body, variables, response) all ship on by default. You can turn any of them off per machine if your compliance posture allows it. Custom names you add are always redacted because you explicitly asked for them.
Nothing runs without the AI toggle. The whole feature ships behind a single switch in Preferences. Off by default on install. When it is off, no context is built, no key is read, no request goes out.
Open Preferences, go to the AI tab, flip the top toggle, paste your OpenAI or Anthropic key, and pick a default model. That is it. Autocomplete has its own toggle so you can use chat without ghost text if that is your preference.
If you are on a self-hosted model, add an OpenAI-compatible endpoint with your base URL and (optional) key. It will show up in the model picker alongside the built-in providers.
# Preferences → AI → Configuration
1. Enable AI features (top toggle)
2. Add API key (OpenAI, Anthropic, or a custom endpoint)
3. Pick default model
4. (Optional) Autocomplete toggle (off, debounced, aggressive, manual)This is v1 of a bigger direction. In v4.2 we are landing a unified visual language across the chat sidebar, autocomplete, and Generate popovers so the surfaces stop feeling like so different. Longer-term we want the assistant to help with imports (paste a curl, get a request), with debugging (explain a failing assertion), and with collection design (draft a folder structure from an OpenAPI spec).
So download Bruno and turn on the AI features if you find them useful, or the switch stays off and the features stay out of your way.
AI in Bruno is built on a simple, secure posture: you bring the key, you pick the provider, and sensitive data stays on your machine by default. Chat, Generate, and autocomplete all run through the same redaction layer, so guarantees hold no matter which surface you use.
Questions or feedback about the security posture, the provider list, or the surfaces? Open a discussion on GitHub or find us on the Bruno Discord.