SecureVector icon

SecureVector

AI security: scan prompts and LLM outputs, gate tool calls, track LLM cost and budget. Cloud by default; Local App transport unlocks tool audit, costs, and device ID.

Actions2

Prompt → Scan Output

AI-generated

Summary

Analyzes an LLM response for security threats like PII, secrets, or leakage using SecureVector's API or local threat monitor app.

Inputs

  • transport — Which SecureVector backend to use. Cloud is the default (requires an API key). Local App (127.0.0.1:8741) requires the SecureVector desktop app running on this machine and unlocks additional capabilities.
  • localBaseUrl — URL of the SecureVector local app. Required when Transport is set to Local App. Defaults to http://127.0.0.1:8741. Must be a loopback address (127.0.0.1 or localhost).
  • prompt — Text to analyze. For Scan Output, point this at an LLM response field. Defaults to auto-detecting common field names like chatInput, prompt, message, content, text, title, input, or output.
  • timeout — Maximum time to wait for scan results in seconds (1-300). Defaults to 30.
  • includeMetadata — Whether to send workflow context (workflow ID, execution ID) with the scan request for tracking purposes.
  • blockOnThreat — Whether to stop the workflow if a security threat is detected. Enable for production security gates. Disable for monitoring mode.
  • blockingConditions — Choose which conditions trigger blocking. Options include 'verdict' (BLOCK), 'score' (threshold), and 'riskLevel' (matches configured levels).
  • threatThreshold — Threat score threshold (0-100). If the scan score exceeds this value and 'Block on Threat' is enabled, the workflow will stop. Defaults to 50.
  • blockOnRiskLevels — Block the workflow if the detected risk level matches any of these options. Defaults to 'critical' and 'high'.

Output shape

A single record for each input item containing threat analysis details.

The returned data includes a verdict (ALLOW/BLOCK), threat score, risk level, matched threat rules, and a recommendation. If blocking is enabled and a threat condition is met, the workflow throws a NodeOperationError and stops.

Examples

Example 1: Post-processing an LLM response

Connect an LLM node (e.g., OpenAI or LangChain) to this node. Set 'Prompt to Scan' to an expression like {{$.output}} to analyze the LLM's generated text for security issues.

Example 2: Blocking high-risk outputs in production

Enable 'Block on Threat' and set 'Threat Score Threshold' to 75. If the SecureVector scan returns a score above 75, the workflow will halt and throw an error.

Links

Discussion