n8n-nodes-trusera

n8n community node package that scans your workflows for AI security risks using Trusera AI-BOM.

Drop a single node, activate, and visit /webhook/trusera to see a full interactive security dashboard of every AI component in your n8n instance.

Installation

In your n8n instance:

1. Go to Settings > Community Nodes
2. Enter n8n-nodes-trusera
3. Click Install

Or install manually via CLI:

cd ~/.n8n/nodes
npm install n8n-nodes-trusera
# Restart n8n

Quick Start (1 minute)

The Trusera Webhook node gives you a full security dashboard with zero configuration:

1. Create a new workflow
2. Add the Trusera Webhook node
3. Add your n8n API credential (Settings > n8n API > Create API Key)
4. Activate the workflow
5. Visit http://your-n8n-url/webhook/trusera

That's it. One node, full dashboard.

Nodes

This package includes 5 nodes for different use cases:

Trusera Webhook (Recommended)

The one-node solution. This is what most users need.

Self-contained trigger node that:

• Fetches all workflows from your n8n instance via the REST API
• Scans every workflow for AI components and security risks
• Serves an interactive HTML dashboard directly at /webhook/trusera

Parameters:

Setup:

[Trusera Webhook] → (no other nodes needed)

Trusera Dashboard

Use this if you already have a built-in Webhook node configured and want to chain it.

Fetches all workflows, scans them, and returns an HTML dashboard as output. Designed to connect after a built-in n8n Webhook node for custom webhook setups.

Parameters:

Setup:

[Webhook (GET /dashboard, responseMode: lastNode)] → [Trusera Dashboard]

Configure the Webhook node with:

• Response Mode: Last Node
• Response Content Type: text/html
• Response Data: First Entry JSON
• Response Property Name: html

Trusera Scan

Use this for programmatic scanning — pipe workflow JSON in, get structured results out.

Scans workflow JSON for AI components and returns structured scan results. Use this when you want to process scan results programmatically (e.g., send Slack alerts, store in a database, trigger CI/CD gates).

Operations:

Parameters:

Setup:

[HTTP Request (GET /api/v1/workflows)] → [Trusera Scan] → [Slack / Email / DB]

Output example:

{
  "components": [
    {
      "name": "GPT-4o Agent",
      "type": "llm_provider",
      "provider": "OpenAI",
      "modelName": "gpt-4o",
      "risk": { "score": 45, "severity": "medium", "factors": [...] },
      "flags": ["no_error_handling", "unpinned_model"]
    }
  ],
  "totalComponents": 1
}

Trusera Policy

Use this to enforce security gates — block deployments with critical findings.

Evaluates scan results against configurable security policies. Chain after Trusera Scan to implement CI/CD security gates.

Parameters:

Setup:

[Trusera Scan] → [Trusera Policy] → [IF passed] → [Deploy] / [Alert]

Output example:

{
  "passed": false,
  "violations": [
    "Found 2 critical components (max: 0)",
    "Blocked provider: OpenAI"
  ],
  "totalComponents": 15
}

Trusera Report

Use this to generate human-readable reports for Slack, email, or documentation.

Generates formatted security reports from scan results.

Parameters:

Setup:

[Trusera Scan] → [Trusera Report] → [Send Email / Slack Message]

Credentials

n8n API

The Trusera nodes connect to your n8n instance's own REST API to fetch workflows.

What It Detects

The scanner identifies AI components across your workflows:

• LLM Providers — OpenAI, Anthropic, Google Gemini, Mistral, Groq, Ollama, Azure OpenAI, AWS Bedrock, Cohere, HuggingFace
• Agent Frameworks — n8n AI agents, LangChain chains, ReAct agents
• Tools — Code execution nodes, HTTP request tools, vector stores (Pinecone, Qdrant, Weaviate, ChromaDB, Supabase)
• MCP Clients — Model Context Protocol connections to external servers
• Models — Embedding models, chat models, completion models
• Memory — Buffer memory, conversation memory, session-based memory

Risk Flags

Severity Thresholds

Dashboard Features

The interactive HTML dashboard includes:

• Summary cards — total components, workflows scanned, highest risk score, scan duration
• Severity distribution chart — donut chart showing critical/high/medium/low breakdown
• Component types chart — bar chart of LLM providers, agents, tools, models, MCP clients
• OWASP LLM Top 10 chart — risk flags mapped to OWASP categories
• Scanned workflows table — each workflow with trigger type, AI component count, highest risk, severity badge
• Findings table — all detected components with name, type, provider, severity, risk score, workflow
• Filters — search by name, filter by severity/type/workflow
• Export — CSV and JSON export buttons
• Dark/light mode — toggle in the header
• Password protection — optional AES-256-GCM encryption

Example Workflows

Minimal: Security Dashboard

[Trusera Webhook] → activate → visit /webhook/trusera

CI/CD Gate: Block Risky Deployments

[Schedule Trigger] → [HTTP Request: GET /api/v1/workflows]
                    → [Trusera Scan]
                    → [Trusera Policy (maxCritical: 0)]
                    → [IF: passed = true]
                        → Yes: [Deploy]
                        → No: [Slack Alert]

Weekly Report: Email Summary

[Schedule Trigger (weekly)] → [HTTP Request: GET /api/v1/workflows]
                             → [Trusera Scan (scanMultiple)]
                             → [Trusera Report (markdown)]
                             → [Send Email]

License

MIT