powerexploit/Rudra LLM Security Review
Detect GenAI/LLM security issues (OWASP LLM Top 10) in pull requests.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| github-token | Token used to read the PR and post the review comment. | yes | — |
| llm-api-key | API key for the triage/verifier model. If omitted, Rudra runs deterministic-only. | no | — |
| llm-provider | anthropic | openai | none. Leave blank to auto-detect from whichever of ANTHROPIC_API_KEY / OPENAI_API_KEY is set (falls back to deterministic-only 'none' if neither is set). | — | "" |
| llm-model | Model name for the chosen provider. Leave blank to use a sensible per-provider default (claude-sonnet-5 for anthropic, gpt-4o-mini for openai). | — | "" |
| fail-threshold-score | Fail the check if any finding scores at/above this (0-10). | — | 7.0 |
| enable-verifier | Run the adversarial verifier pass (biggest single false-positive reducer, costs 1 extra LLM call per candidate). | — | true |
| require-llm-confirmation | If no LLM is configured, suppress non-deterministic candidates instead of reporting unconfirmed heuristics. | — | true |
| triage-samples | Self-consistency vote count for triage (1 = off; 3 is a good high-signal setting for noisy repos). | — | 1 |
| min-confidence | Minimum final confidence (0-1) for a finding to be reported at all. | — | 0.55 |
| min-score | Minimum Rudra score (0-10) for a finding to be posted to the PR. | — | 4.0 |
Outputs
no outputs