Cap LangChain4j output-token limits (OWASP LLM10)

Proprietary

Composite of supported LangChain4j provider remediations. Currently covers OpenAI chat/streaming builders and LangChain4j OpenAI Spring Boot properties. Requires an application-selected positive maximum. Lower budgets can truncate output or conflict with provider minimums. Does not bound input tokens, request counts, retries, or tool loops.

org.openrewrite.ai.security.LimitLangChain4jOutputTokens

Required

maximumTokensint

A positive, application-selected ceiling for explicit output-token limits. Larger literal limits are reduced to this value. Smaller limits are preserved. Choose a budget appropriate for the model and workload: reducing it can truncate responses, reasoning, structured output, or tool calls.

mod run . --recipe=org.openrewrite.ai.security.LimitLangChain4jOutputTokens \
  -P maximumTokens=4096

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.