Detection Settings
Maro's browser extension uses a language model (LLM) to spot risky activity in real time — catching sensitive data before it leaves the browser and classifying how people use the apps they work in. Detection Settings is where you choose which LLM the extension uses to do that work for everyone in your organization.
You'll find it under Organization → Detection Settings.
Two ways to run detection
There are two modes. By default, organizations use the first one.
Mode | What it means | When to use it |
|---|---|---|
Use extension settings (default) | Each user's extension picks its own local model — for example Gemini Nano running directly in the browser. No API key, no setup. | The default, and the right choice for most organizations. Detection runs on-device and nothing leaves the user's machine. |
Use my LLM (remote) | The extension routes detection requests through an LLM provider you configure here — Anthropic, OpenAI, or any OpenAI-compatible endpoint. | For machines that can't run a local model, or when you want every user on one consistent, centrally-managed model. |
Use extension settings (the default)
When this mode is selected, every user's extension chooses its own local LLM. This is the simplest option — there's nothing to configure and no API key to manage. Because detection happens on-device, activity content is evaluated locally rather than sent to an outside provider.
This is the recommended default. Only switch to Use my LLM if you have a specific reason to.
Use my LLM (remote)
Choose this when local, on-device models aren't an option — for example on locked-down or older machines that can't run a browser-embedded model — or when you want to guarantee that everyone in the org runs detection on the exact same model.
When you select Use my LLM, the extension stops using each user's local model and instead sends detection requests to the provider you configure below.
Configuring a remote provider
These fields appear only when Use my LLM is selected. All of them are needed before you can save.
Provider
The LLM service that will handle detection requests:
- Anthropic — Claude models.
- OpenAI — GPT models.
- OpenAI-compatible — any endpoint that speaks the OpenAI API format (self-hosted models, gateways, or third-party providers).
Host URL
The address Maro sends requests to.
- For Anthropic and OpenAI, this defaults to the provider's public API (https://api.anthropic.com and https://api.openai.com). Leave it as-is unless you route traffic through your own proxy.
- For OpenAI-compatible, this is required — point it at the base URL of your endpoint.
Model
Which model the provider should use.
- For Anthropic, choose from:
- Claude Haiku 4.5 (recommended) — fast and cost-effective.
- Claude Sonnet 4.6 — more capable, higher cost.
- For OpenAI, choose from:
- GPT-5 nano (recommended) — fast and cost-effective.
- GPT-5 mini — more capable, higher cost.
- For OpenAI-compatible, type the exact model id your endpoint expects (for example, llama-3.1-70b-instruct).
The recommended models are tuned for the high-volume, low-latency nature of real-time detection. Start there unless you have a reason to prefer a larger model.
API key
The credential Maro uses to authenticate with your provider.
- Your key is stored encrypted on Maro's servers and is never returned by the API — once saved, you can't read it back.
- If a key is already saved, you'll see a Key configured badge. To change it, click Replace key and enter the new one; click Keep existing key to leave it untouched.
Saving, resetting, and removing
- Save configuration writes your changes. The button stays disabled until you've actually changed something.
- Reset discards unsaved edits and restores the last saved configuration.
- Remove configuration clears your remote setup entirely. The extension reverts to each user's local LLM settings, and any stored API key is deleted and cannot be recovered.
After a successful save you'll get a confirmation, and the change takes effect for your organization's extensions.
Who can change these settings
Only organization administrators can edit Detection Settings. Everyone else sees a read-only view showing the current mode, provider, and model, and whether an API key is configured — but can't make changes.
How this fits with policies
Think of it as two layers working together:
- Detection Settings (this page) decide the engine — the model that reads activity.
- Policies decide the rules — what to watch for, on which apps, and what happens when something is triggered.
Switching detection modes or providers doesn't change your policies. Your rules keep working exactly as configured; only the model evaluating them changes.