Cap OpenAI output-token limits (OWASP LLM10)

Proprietary

Composite for OpenAI through its SDK, LangChain4j, and Spring AI configuration. Does not include generic Spring AI ChatOptions calls, whose provider is unknown. Requires an application-selected positive maximum. Lower budgets can truncate output or conflict with provider minimums. Does not bound input tokens, request counts, retries, or tool loops.

org.openrewrite.ai.security.LimitOpenAiOutputTokens

Required

maximumTokensint

A positive, application-selected ceiling for explicit output-token limits. Larger literal limits are reduced to this value. Smaller limits are preserved. Choose a budget appropriate for the model and workload: reducing it can truncate responses, reasoning, structured output, or tool calls.

mod run . --recipe=org.openrewrite.ai.security.LimitOpenAiOutputTokens \
  -P maximumTokens=4096

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.