Find LLM endpoints reached over cleartext HTTP (OWASP LLM02)

Proprietary

Find LLM base URLs and endpoints that use http://, configured through the OpenAI, Anthropic, Azure AI, LangChain4j, or Spring AI Java SDK builders, or through the spring.ai.* and langchain4j.* Spring Boot properties. Prompts, completions, and API keys then cross the network unencrypted. Loopback addresses and single-label host names, such as a local or in-cluster Ollama server, are not reported.

org.openrewrite.ai.security.FindCleartextLlmEndpoint

Optional

Hosts that may be reached over plain HTTP, such as an internal model gateway. Glob patterns are supported. Loopback addresses and single-label host names, such as a Docker Compose or Kubernetes service name, are always allowed. Separate values with commas.

mod run . --recipe=org.openrewrite.ai.security.FindCleartextLlmEndpoint

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.