Cap explicit LangChain4j tool-calling round trips (OWASP LLM10)

Proprietary

Reduce explicit integer literal maxToolCallingRoundTrips and deprecated maxSequentialToolsInvocations limits above the selected ceiling. Preserve smaller limits, missing settings, constants, expressions, and nonpositive values. Does not migrate the deprecated API, infer missing limits, or bound individual tool counts, request volume, or time. Enforcement depends on the application SDK version and execution path; this recipe changes configuration only.

org.openrewrite.ai.security.LimitLangChain4jToolRoundTrips

Required

maximumRoundTripsint

A positive application-selected ceiling on model responses containing tool calls per LangChain4j AI-service invocation. A round trip may request multiple tools. Reduces only larger explicit integer literal limits; can interrupt longer workflows.

mod run . --recipe=org.openrewrite.ai.security.LimitLangChain4jToolRoundTrips \
  -P maximumRoundTrips=10

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.