Skip to content

Node List

This section provides a detailed reference for every node type available in KAI-Flow.

Special Nodes

Start

Category: Special

Purpose: Entry point for workflow execution.

Inputs:

  • initial_input - Text that starts the workflow (from chat or manual run)
  • trigger_data - Data injected by a trigger node

Outputs: output - Passes the received data downstream

Configuration: None required

Usage: Every workflow needs an entry point. A workflow must contain at least one of Start, Webhook Trigger, Kafka Consumer Trigger, Timer Start, or Error Trigger.

End

Category: Special

Purpose: Marks workflow completion and returns the final result.

Inputs: target - Final data from the preceding node (required)

Outputs: None

Configuration: None required

Usage: Multiple End nodes are allowed. In branching workflows, connect each branch to its own End node.

Agent Nodes

Agent

Category: Agents

Purpose: Orchestrates an LLM, tools, and memory to solve multi-step tasks.

Inputs:

  • input - User query or incoming data
  • llm - Language model connection (required)
  • tools - Tool connections
  • memory - Memory connection

Outputs: output - Final response

Configuration:

  • Agent Type: react (reason, act, observe — use with tools), conversational (dialogue focused), task_oriented (single task completion)
  • User Prompt Template: How the user message is wrapped before reaching the agent. Default ${{input}} — do not remove this placeholder or the user message will never reach the agent
  • System Prompt: Defines the agent's identity, rules, tone, and limits
  • Max Iterations: 1–20, default 5. Caps the reasoning loop. Each iteration is an additional LLM call
  • Temperature: 0.0–2.0, default 0.7. Lower values are safer for tool-using agents
  • Enable Memory: Default on. Must stay on for a connected memory node to take effect
  • Enable Tools: Default on. Must stay on for connected tools to take effect

Usage: Connecting a node is not enough — the matching checkbox must also be enabled.

LLM Nodes

OpenAI GPT

Category: LLM

Purpose: Provides an OpenAI language model to agents.

Inputs: None (configured through fields)

Outputs:

  • llm - Model instance for agents
  • model_info - Model details
  • usage_stats - Token usage

Configuration:

  • Credential: OpenAI API key (required). Only credentials of type openai appear in the dropdown
  • Model: gpt-4o, gpt-4o-mini, gpt-4-turbo, gpt-4, gpt-4-32k. Default gpt-4o
  • Temperature: 0.0–2.0, step 0.1, default 0.7. Labelled Precise to Creative
  • Max Tokens: 1–4096, default 1000. Limits the response length, not the input

OpenAI Compatible

Category: LLM

Purpose: Connects to any service that speaks the OpenAI API format (OpenRouter, vLLM, LocalAI, self-hosted models).

Inputs: None (configured through fields)

Outputs:

  • llm - Model instance for agents
  • config_info - Resolved connection settings

Configuration — Basic:

  • API Key (Credential): Required for commercial providers, optional for some local servers. Base URL and model name are stored inside the credential
  • Temperature: 0.0–2.0, default 0.7
  • Max Tokens: 1–200000, default 4096. The upper bound is deliberately wide; exceeding the target model's capacity causes an error

Configuration — Advanced:

  • Streaming: Default off. Streams the response word by word
  • Top Probability: 0.0–1.0, default 1.0. Narrows the token selection pool. Adjust either this or Temperature, not both
  • Frequency Penalty: -2.0 to 2.0, default 0.0. Reduces repetition of the same words
  • Presence Penalty: -2.0 to 2.0, default 0.0. Encourages moving to new topics
  • Timeout: 1–600 seconds, default 60
  • SSL Certificate Verification: Default on. Disable only for internal servers with self-signed certificates
  • Strip Reasoning/Thinking Tags: Default off. Removes reasoning blocks from models that emit them
  • Extra Body Parameters (JSON): Additional parameters appended to the request body, for provider-specific options

Usage: Connection settings live in the credential rather than the node, so switching to a different provider or model means selecting a different credential.

Tool Nodes

  • Category: Tool
  • Purpose: Provides a web search tool to agents
  • Inputs: None (configured through fields)
  • Outputs: search_tool - Tool instance for agents
  • Configuration:
  • Search Type: basic or advanced. Default basic
  • Credential: Tavily API key (required)
  • Max Results: 1–20, default 5. Optional field — add it from Add Option
  • Search Depth: basic, moderate, advanced. Default basic. Deeper searches return better results but consume quota faster
  • Include Answer: Returns Tavily's own summarised answer alongside the results. Recommended
  • Include Raw Content: Returns the full page text of each result. Leave off — it inflates token usage and adds noise
  • Include Images: Adds image URLs to the results
  • Usage: This node does not search by itself. It hands a search tool to the agent, which decides when to use it.

HTTP Client

  • Category: Tool
  • Purpose: Sends HTTP requests to any endpoint
  • Inputs: method, url, headers, params, body, auth_type, auth_token, timeout, template_context
  • Outputs: response, status_code, content, headers, success, documents
  • Configuration — Basic:
  • URL: Target address (required)
  • HTTP Method: GET (read), POST (create), PUT (full update), PATCH (partial update), DELETE (remove). Default GET
  • Content Type: application/json, application/x-www-form-urlencoded, text/plain. Default JSON
  • Configuration — Auth:
  • Authentication: none, bearer, basic, api_key. Default none
  • Token/Key: Value for Bearer or API Key authentication
  • Username / Password: Values for Basic authentication
  • Configuration — Advanced:
  • Timeout: 1–300 seconds, default 30
  • Max Retries: 0–10, default 3. Retrying is safe for GET; set to 0 for POST and DELETE to avoid duplicate operations
  • Retry Delay: 1–1000 seconds, default 1
  • Verify SSL: Default on
  • Enable Templates: Default on. Allows ${{ }} expressions in the URL, headers, and body
  • Configuration — Data:
  • Custom Headers: Additional headers as JSON
  • URL Parameters: Query parameters as JSON
  • Request Body: Payload for POST, PUT, and PATCH
  • Usage: Unlike other tool nodes, this one is a processor — it runs on its own and does not need an agent.

Retriever Provider

  • Category: Tool
  • Purpose: Provides a vector search tool to agents
  • Inputs: Vector store and embeddings connections
  • Outputs: retriever_tool - Search tool for agents
  • Configuration:
  • Credential: PostgreSQL connection (required)
  • Collection Name: Must match the collection name used in Vector Store Orchestrator exactly. A mismatch returns no results without raising an error
  • Search Type: similarity (closest matches) or mmr (relevant but diverse matches). Default similarity
  • Search K: 1–50, default 6. Number of chunks to retrieve
  • Score Threshold: 0.0–1.0, step 0.05, default 0.0. Labelled Inclusive to Strict. Raising it prevents weakly related chunks from reaching the agent
  • Enable Metadata Filtering: Default off. Reveals the two fields below
  • Metadata Filter: Filter rules as JSON, matched against metadata added in Vector Store Orchestrator
  • Filter Strategy: exact, contains, or or. Default exact

Cohere Reranker Provider

  • Category: Tool
  • Purpose: Re-orders retrieved chunks by true relevance to the query
  • Inputs: Retrieved documents
  • Outputs: reranker - Reranker instance, connected to Retriever
  • Configuration:
  • Credential: Cohere API key (required)
  • Model: rerank-english-v3.0, rerank-multilingual-v3.0, rerank-english-v2.0, rerank-multilingual-v2.0. Default is the English model — select a multilingual model for non-English content
  • Top N: 1–20, default 10. Number of chunks that pass through. Set noticeably lower than the retriever's Search K, otherwise no filtering occurs
  • Max Chunks Per Doc: 1–50, default 10. Prevents a single document from dominating the results
  • Usage: Vector similarity is fast but coarse. The reranker reads each chunk together with the query and scores actual relevance. A typical pairing is Search K 20 with Top N 5.

MarkItDown Tool

  • Category: Tool
  • Purpose: Converts documents stored in MinIO or S3 to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio and video (with transcription), and more than twenty other formats
  • Inputs: None (configured through fields)
  • Outputs: tool - Conversion tool for agents
  • Configuration:
  • MinIO Credential: Connection containing endpoint, access key, and secret key (required)
  • Bucket Name: Bucket holding the documents (required)
  • Default Object Key: Path to the document inside the bucket (required). The agent may override this when calling the tool
  • LLM Credential (Optional - For OCR/Audio): Required only for image OCR and audio transcription
  • LLM Base URL (Optional): Leave empty for the standard OpenAI API
  • LLM Model (Optional): Default openai/gpt-4o. Format depends on the provider — provider/model for OpenRouter, model name alone for OpenAI
  • Max File Size (MB): Default 100. Setting 0 removes the limit but is not recommended

Web Scraper

  • Category: Tool
  • Purpose: Fetches web pages and extracts clean text as documents
  • Inputs: urls, input_urls - Target addresses, also acceptable through a connection
  • Outputs: documents - Extracted content
  • Configuration — Basic:
  • Credential (Optional): Only needed for protected pages
  • URLs to Scrape: One address per line (required)
  • User Agent: Identity sent to the site. Change this if a site returns 403
  • Remove Selectors: CSS selectors to strip, comma separated. A typical list is nav,footer,header,script,style,aside,noscript,form. This is the field that removes menu and reference clutter
  • Configuration — Advanced:
  • Min Content Length: Pages shorter than this are discarded. Around 200 works well
  • Max Concurrent: 1–10, default 5. Higher values are faster but put more load on the target site
  • Timeout (seconds): 5–300
  • Retry Attempts: 0–5
  • Tavily API Key (Optional): Enables enhanced extraction. This is a plain password field, not a credential

Memory Nodes

Buffer Memory (Persistent)

  • Category: Memory
  • Purpose: Stores conversation history in the database so it survives page reloads
  • Inputs: None (configured through fields)
  • Outputs: memory - Memory instance for agents
  • Configuration:
  • Memory Key: Internal name of the memory. Default memory — do not change
  • Input Key: Key under which the user message is stored. Default input — do not change
  • Output Key: Key under which the assistant reply is stored. Default output — do not change
  • Return Messages: Default on. Returns history as separate message objects, which is the format chat models expect
  • Memory Limit: 1–100, default 5. Number of past messages to recall. This is the field you will actually tune. Every recalled message is sent with each request, so higher values raise cost and latency
  • Session Mode: automatic (system manages the session id) or manuel (you supply it). Default automatic
  • Session ID: Identifies the conversation. Filled automatically in automatic mode

Document Loader Nodes

Document Loader

  • Category: Document Loader
  • Purpose: Loads files from Google Drive and converts them to documents
  • Inputs: trigger, input_documents, plus authentication fields
  • Outputs:
  • documents - Loaded documents
  • stats - Processing statistics
  • metadata_report - Metadata summary
  • Configuration:
  • Google Drive Links: One file or folder URL per line (required). Folder links process every eligible file inside
  • Authentication Method: service_account (robot account, correct for unattended workflows) or oauth2 (personal account, requires token refresh). Default service_account
  • Service Account JSON: Contents of the key file downloaded from Google Cloud. Visible only when Service Account is selected
  • Client ID / Client Secret: OAuth2 credentials. Visible only when OAuth2 is selected
  • Text Files / JSON / Word Documents / PDF / CSV: File types to process. Enable only what you need — CSV and JSON convert tabular data to text, which usually adds noise
  • Min Content Length: Default 100. Files shorter than this are skipped
  • Max File Size (MB): Default 100
  • Quality Threshold: 0.0–1.0, step 0.1, default 0.5. Documents scoring below the threshold are discarded
  • Enable Document Storage: Default off. Stores documents for reuse in later runs
  • Remove Duplicates: Default on. Drops duplicate documents based on content similarity
  • Usage: Requires setup on the Google Cloud side — enabling the Drive API, creating a service account, downloading its key, and sharing the target folder with that account.

Splitter Nodes

Document Chunk Splitter

  • Category: Text Splitter
  • Purpose: Splits documents into smaller, searchable chunks
  • Inputs: documents - Documents to split
  • Outputs:
  • chunks - Resulting chunks
  • stats - Split statistics
  • preview - Sample of the output
  • metadata_report - Metadata summary
  • Configuration:
  • Chunk Size: 100–10000, default 1000. Target characters per chunk. Not a hard limit — the splitter looks for a natural break point nearby
  • Overlap: 0–5000, default 200. Characters repeated from the previous chunk so sentences are not cut in half. Ten to twenty percent of the chunk size works well
  • Separator: Default \n\n, meaning paragraph boundaries
  • Keep Separator: true or false. Default true, which preserves paragraph spacing and keeps the text readable
  • Length Function: len (character count), tokenizer (token count), custom. Token counting is more accurate when managing a model's context window
  • Use Regex Separator: false or true. Treats the separator as a regular expression. Useful for splitting on patterns such as numbered clauses

Embedding Nodes

OpenAI Embeddings Provider

  • Category: Embedding
  • Purpose: Converts text into vectors, which is what makes semantic search possible
  • Inputs: None (configured through fields)
  • Outputs: embedder - Embedding instance, connected to both Vector Store and Retriever
  • Configuration:
  • Embedding Model: text-embedding-3-small (1536 dimensions, inexpensive), text-embedding-3-large (3072 dimensions, more accurate), text-embedding-ada-002 (previous generation). Default is 3-small
  • Select Credential: OpenAI API key (required)
  • Organization (Optional): Billing organisation for enterprise accounts
  • Batch Size: 1–100, default 100. Number of texts embedded per request
  • Max Retries: 0–10, default 3
  • Request Timeout (seconds): 10–300, default 30
  • Dimensions: Default 1536. Calculated automatically from the selected model — do not edit
  • Usage: Once a collection has been populated with one model, the model cannot be changed. The dimensions and representation would no longer match and search would fail, requiring every document to be reprocessed.

Vector Store Nodes

Vector Store Orchestrator

  • Category: VectorStore
  • Purpose: Stores embedded documents in PostgreSQL and makes them searchable. Manages the database schema, indexes, and optimisation automatically
  • Inputs:
  • documents - Documents to store
  • embedder - Embedding provider connection
  • Outputs: result - Storage result
  • Configuration — Data:
  • Select Credential: PostgreSQL connection (required)
  • Collection Name: Separates one data set from another (required). Distinct collections keep unrelated documents from mixing in search results
  • Table Prefix (Optional): Full database isolation for separate projects or tenants
  • Configuration — Metadata:
  • Custom Metadata: Labels applied to every stored document, as JSON. Used later as search filters
  • Preserve Document Metadata: Default on. Keeps the document's own metadata such as source URL and chunk index. Required for answering "where did this come from"
  • Metadata Strategy: merge (combine, custom wins on conflict), replace (custom only), document_only. Default merge
  • Configuration — Search:
  • Search Algorithm: cosine (angle between vectors — the standard for text), euclidean (straight-line distance), inner_product. Default cosine
  • Search K: 1–50, default 10. Number of results returned
  • Score Threshold: 0.0–1.0, step 0.1, default 0.0. Minimum similarity required
  • Batch Size: 10–1000, step 10, default 100. Write batch size
  • Pre Delete Collection: Default off. When enabled, the collection is wiped on every run before writing. Useful during testing, destructive in production
  • Enable HNSW Index: Default on. Speeds up vector search significantly at the cost of a little extra storage
  • Usage: Requires the pgvector extension. Standard PostgreSQL images do not include it.

Processing Nodes

Code Node

  • Category: Processing
  • Purpose: Runs custom Python or JavaScript. The escape hatch for work no built-in node covers
  • Inputs: input - Available inside the code as node_data
  • Outputs: output - Result of the execution
  • Configuration:
  • Programming Language: python or javascript. Default python
  • Code: Monaco editor, up to 50000 characters. Reach other nodes with ${{node_name}}; use ${{node_name|tojson}} when the value may contain quotes or line breaks
  • Timeout (seconds): 1–300, default 30. Stops runaway code from blocking the workflow
  • Continue on Error: Default off. Enable only when the code is non-critical, since downstream nodes will otherwise receive empty data
  • Enable Code Validation: Default on. Screens the code for dangerous operations before running it
  • Sandbox: Code runs inside a restricted sandbox. Only whitelisted modules can be imported.
  • Python: json, math, random, re, datetime, time, itertools, collections, functools, operator, string, decimal, fractions, statistics, base64, hashlib, hmac, secrets, uuid, urllib.parse, html, xml.etree.ElementTree, csv
  • JavaScript: crypto, util, url, querystring, path, os
  • Relative imports are rejected. Importing anything outside the list raises Import of 'x' is not allowed
  • Standard exceptions, OS errors, and warnings are available, so code can raise and handle errors normally
  • Usage: Running the default print(node_data) first shows the exact shape of the incoming data, which makes the real code much easier to write.

Condition

  • Category: Processing
  • Purpose: Compares two values and splits the workflow into two paths
  • Inputs: input - Value to evaluate
  • Outputs:
  • true_output - Path taken when the condition holds
  • false_output - Path taken when it does not
  • Configuration:
  • Data Type: string only. Numeric comparison is not supported — use a regular expression or a Code Node for that
  • Value 1: The value to test. Leave empty to use the connected node's output, or write ${{node_name.field}} to reach a specific field
  • Operation: contains, ends_with, equal, not_contains, not_equal, regex, starts_with, is_empty, not_empty. Default equal
  • Value 2: The value to compare against. Unused for is_empty and not_empty
  • Case Sensitive: Default off, which is usually correct for user input
  • Usage: The comparison is literal text matching, not meaning. Synonyms will not match — use regex with alternatives, or an agent, when meaning matters.

Cryptography

  • Category: Processing
  • Purpose: Encryption, decryption, digital signing, verification, and key generation
  • Inputs: input_data - Data to process
  • Outputs:
  • output - Result
  • success - Whether the operation succeeded
  • error - Error message when it did not
  • Configuration:
  • Action: encrypt, decrypt, sign, verify, generate. Default encrypt
  • Cryptography Type: symmetric (one shared key) or asymmetric (public and private key pair). Default symmetric
  • Cipher / Algorithm: aes-256-gcm (recommended), aes-128-gcm, aes-256-cbc, chacha20-poly1305, fernet, base64, rsa-oaep, rsa-sha256, rsa-sha512. Note that base64 is an encoding, not encryption — it provides no confidentiality
  • Secret Key / Passphrase: Shown for symmetric operations
  • RSA Key Source: provide or auto-generate. Shown for asymmetric operations
  • Private Key (PEM): Required for decrypt and sign
  • Public Key (PEM): Required for encrypt and verify
  • Signature (Base64): Shown for the verify action
  • Key Size (Bits): 2048 or 4096. Shown when generating asymmetric keys
  • Key Length: 128-bit, 256-bit, 512-bit. Shown when generating symmetric keys
  • Key Format: base64, hex, or url-safe
  • Text Input: Text to process when no connection supplies it
  • PBKDF2 Salt / PBKDF2 Iterations: Key derivation parameters
  • Usage: Fields appear and disappear based on the selected action and cryptography type. This node reports failures through its success and error outputs rather than stopping the workflow, so a failed decryption still leaves the run marked as completed.

Parser

  • Category: Processing
  • Purpose: Safely parses stringified or malformed JSON, including markdown code blocks and escape sequences. Useful for cleaning up LLM output
  • Inputs: input - Data to parse
  • Outputs: output - Parsed result
  • Configuration:
  • Output Format: json (returns a parsed object usable by later nodes) or yaml (returns readable text). Default json
  • Input: Leave empty to process the connected node's output directly, or use ${{node_name}} to select a source. Multiple sources can be combined with surrounding text
  • Usage: This node reformats — it does not select fields. Extracting a single field requires a Code Node.

Kafka Producer

  • Category: Processing
  • Purpose: Publishes a message to a Kafka topic
  • Inputs: input - Message content
  • Outputs: output - Delivery report containing topic, partition, and offset
  • Configuration:
  • Credential: Kafka connection (required)
  • Topic: Destination topic (required)
  • Message: Content to publish (required)
  • Key: Message key. Messages sharing a key land in the same partition and keep their order — use a customer or entity id when sequence matters
  • Header Key / Header Value: A single header pair attached to the message
  • Acks: Default off. Waits for Kafka to confirm the write. Enable for critical data
  • Compression: Default off. Compresses the message, which helps with large payloads
  • JSON Encode: Default off. Wraps non-object values as valid JSON. Leave off when the message is already JSON
  • Timeout (ms): Default 30000

Trigger Nodes

Timer Start

  • Category: Triggers
  • Purpose: Starts the workflow on a schedule
  • Inputs: None
  • Outputs: timer_data, schedule_info, timer_stats, timer_control
  • Configuration:
  • Schedule Type: interval (fixed gap), cron (calendar expression), once (single run), manual. Default interval
  • Interval (seconds): 60–86400, step 60, default 3600. Minimum interval is one minute
  • Cron Expression: Default 0 */1 * * *. Format is minute, hour, day of month, month, day of week. 0 9 * * * runs daily at 09:00; 0 9 * * 1-5 runs weekdays only
  • Scheduled Time: Date and time for a single run. Shown when once is selected
  • Timezone: UTC plus nine regional options (US zones, London, Paris, Tokyo, Shanghai, Sydney). Default UTC. If your zone is not listed, select UTC and shift the hour accordingly
  • Enable Timer: Default on. Lets you pause a schedule without deleting the workflow
  • Trigger Data: JSON passed into the workflow at each run
  • Usage: The schedule registers itself only after the workflow has been executed once manually. Save the workflow, enable Activity, run it once, then monitor it from the Executions page.

Webhook Trigger

  • Category: Triggers
  • Purpose: Starts the workflow from an incoming HTTP request
  • Inputs: None
  • Outputs: webhook_data, webhook_endpoint, webhook_runnable, webhook_config
  • Configuration — Basic:
  • Path: Final segment of the webhook URL. Defaults to a random UUID, which is unguessable and therefore safer than a readable name
  • Environment: test (uses the webhook-test path and supports live step tracking) or production (uses the webhook path). Default test
  • Exact Webhook URL: Read-only field that fills in automatically from Path and Environment, with a copy button
  • HTTP Method: POST, GET, PUT, PATCH, DELETE, HEAD. Default GET. POST is the most common choice for real integrations; GET can be tested straight from a browser
  • Authentication Type: none, basic_auth, header_auth. Default none
  • Basic Auth Credential: Credential holding a username and password. Shown when Basic Auth is selected
  • Header Auth Credential: Credential holding a header name and value. Shown when Header Auth is selected
  • Configuration — Security:
  • Max Payload Size (KB): 1–10240, default 1024
  • Rate Limit (per minute): 0–1000, default 60. Setting 0 removes the limit, which is not advisable without authentication
  • Enable CORS: true or false. Default true. Required when the webhook is called from a web page
  • Webhook Timeout (seconds): 5–300, default 30. Increase for workflows containing agents
  • Allowed IPs (Optional): Restricts calls to specific addresses, as an additional layer on top of authentication
  • Usage: The workflow must be saved and its Activity toggle set to Active. Requests to a deactivated workflow are rejected with Workflow is currently deactivated, and requests to an unknown path return 404.

Respond to Webhook

  • Category: Triggers
  • Purpose: Sends the response back to whoever called the webhook
  • Inputs: input, plus the response fields below
  • Outputs: None (the response leaves the workflow)
  • Configuration:
  • HTTP Status Code: 200, 201, 202, 204, 400, 401, 403, 404, 422, 500, 502, 503. Default 200
  • Response Config: all_incoming_items (return whatever arrived), no_data (status code only), json (return the body you write). Default json
  • Response Body: The content to return. Supports ${{ }} templating, so an agent's answer can be passed straight through. Shown when json is selected
  • Content-Type: application/json, text/plain, text/html. Default JSON. Must match what the body actually contains
  • Custom Headers: Extra response headers as JSON
  • Max Response Size (KB): 1–10240, default 1024
  • Usage: Pairs well with Condition — return 200 for valid input and 400 for invalid input using two separate response nodes.

Kafka Consumer Trigger

  • Category: Triggers
  • Purpose: Starts the workflow when a message arrives on a Kafka topic
  • Inputs: None
  • Outputs: kafka_data - The received message with its key, topic, and metadata
  • Configuration — Required:
  • Credential: Kafka brokers and client configuration
  • Topic: Topic to listen on. Must match the producer's topic exactly
  • Group ID: Consumer group. Consumers sharing a group id divide the messages between them; consumers in different groups each receive a copy
  • Configuration — Behaviour:
  • Allow Topic Creation: Default on. Creates the topic if it does not exist. Usually disabled in production so a typo cannot create a stray topic
  • Read Messages From Beginning: Default off. When enabled, the entire message history is replayed on every start
  • Only Message: Default off. Returns just the message value, without topic and metadata
  • Return Headers: Default on
  • JSON Parse Message: Default on. Parses the message body as JSON so its fields become addressable
  • Keep Message as Binary Data: For non-text payloads
  • Configuration — Performance:
  • Auto Commit Threshold (1), Auto Commit Interval (5000 ms), Batch Size (1048576), Fetch Max Bytes (52428800), Fetch Min Bytes (1), Max Number of Requests (500), Heartbeat Interval (3000 ms), Session Timeout (45000 ms), Rebalance Timeout (60000 ms), Retry Delay on Error (1000 ms). These are standard Kafka settings with sensible defaults — leave them alone until you have a measured reason to change them
  • Usage: The listener attaches shortly after the workflow is activated, not instantly. Messages published before it connects are missed unless Read Messages From Beginning is enabled.

Error Trigger

  • Category: Triggers
  • Purpose: Runs when a connected workflow fails, receiving the injected error context
  • Inputs: error_data - Injected by the system on failure; this is not a wired connection
  • Outputs: error_data - Error context for downstream nodes, containing the error message, error type, source workflow and node, execution id, and timestamp
  • Configuration: None required
  • Usage: This node does not watch anything by itself. The workflow you want to monitor points at the error workflow through Error Handler in its settings menu. Running the error workflow manually produces sample test data, so it can be developed without waiting for a real failure.

Security Nodes

LLM Red Team Scanner

  • Category: Security
  • Purpose: Runs adversarial security tests against a language model and reports its weaknesses
  • Inputs:
  • input - Test input
  • simulator_llm - Model that generates the attacks
  • evaluator_llm - Model that judges whether an attack succeeded
  • Outputs: output - Scan results
  • Configuration:
  • Target Base URL: OpenAI-compatible endpoint of the system under test (required). Any compatible provider works — OpenAI, OpenRouter, Anthropic, Together, or a local server
  • Target Model Name: Model under test (required)
  • Target API Key: Key for the target system (required). Supports templating, so it can be supplied at run time with ${{ webhook_trigger.target_api_key }} instead of being stored in the node
  • Target Purpose: What the target does. Default General purpose chatbot. Attacks are generated from this description, so a specific purpose produces sharper tests
  • Target System Prompt: The target's system instruction. Recommended, since the scanner evaluates whether the target holds to its own rules
  • Vulnerabilities: Comma-separated list. Default Bias, PII, Toxicity
  • Attack Vectors: Comma-separated list. Default Prompt Injection, Jailbreaking
  • Attacks Per Vulnerability: 1–50, default 3. One is a quick check, three is the standard run, five to ten is a full audit
  • Max Concurrent: 1–20, default 1. Higher values finish sooner but put more load on the target
  • Use OWASP Top 10 for LLMs: Default off. Switches the scan to the OWASP category set
  • OWASP Categories: Comma-separated OWASP identifiers. Leave empty to test all ten
  • SSL Certificate Verification, Strip Reasoning/Thinking Tags, Extra Body Parameters (JSON): Same meaning as in OpenAI Compatible
  • Supported Vulnerabilities:
  • Responsible AI — Bias, Toxicity
  • Data Privacy — PII (or PIILeakage), IntellectualProperty
  • Security — RBAC, BOLA, BFLA, SSRF, ShellInjection, SQLInjection, PromptLeakage
  • Safety — Misinformation, GraphicContent, PersonalSafety, IllegalActivity, ChildProtection
  • Business — ExcessiveAgency, Competition, Ethics, Fairness, Robustness
  • Agentic AI — ExploitToolAgent, DebugAccess, IndirectInstruction, GoalTheft, AgentIdentityAbuse, AutonomousAgentDrift, CrossContextRetrieval, ToolOrchestrationAbuse, ToolMetadataPoisoning, RecursiveHijacking, InsecureInterAgentCommunication, ExternalSystemAbuse, SystemReconnaissance, UnexpectedCodeExecution
  • Supported Attack Vectors:
  • Single-turn — Prompt Injection, Gray Box, Prompt Probing, ROT13, Leetspeak, Math Problem, Multilingual, Roleplay, AuthorityEscalation, EmotionalManipulation, GoalRedirection, ContextFlooding, ContextPoisoning, SystemOverride, InputBypass, PermissionEscalation, AdversarialPoetry, CharacterStream, LinguisticConfusion, EmbeddedInstructionJSON, SyntheticContextInjection
  • Multi-turn — Jailbreaking (also LinearJailbreaking), TreeJailbreaking, CrescendoJailbreaking, BadLikertJudge, SequentialJailbreak
  • OWASP Top 10 for LLMs: Available when Use OWASP Top 10 is enabled
  • LLM_01 Prompt Injection — Critical. Direct and indirect injection, system prompt override, instruction hijacking
  • LLM_02 Insecure Output Handling — High. XSS, SQL injection through output, command injection
  • LLM_03 Training Data Poisoning — Medium. Backdoors, bias injection, misinformation. Usually assessed during training rather than at runtime
  • LLM_04 Model Denial of Service — Medium. Resource exhaustion, infinite loops, rate limit bypass
  • LLM_05 Supply Chain Vulnerabilities — High. Compromised plugins, malicious dependencies, insecure integrations
  • LLM_06 Sensitive Information Disclosure — Critical. Personal data leakage, API key exposure, system prompt disclosure
  • LLM_07 Insecure Plugin Design — High. Insufficient input validation, privilege escalation, unauthorized function calls
  • LLM_08 Excessive Agency — Critical. Unauthorized actions, scope creep, missing human oversight
  • LLM_09 Overreliance — Medium. Hallucination acceptance, missing fact-checking
  • LLM_10 Model Theft — Medium. Model extraction, API abuse for replication
  • Usage: Each vulnerability triggers several attacks, and each attack involves three model calls — the generator, the target, and the evaluator. A run covering all ten OWASP categories at three attacks each produces thirty tests. Keep the attack count low while setting up.

Agentic Red Team Scanner

  • Category: Security
  • Purpose: Tests tool-using autonomous agents against risks that do not apply to plain chat models — goal manipulation, tool misuse, memory poisoning, and inter-agent communication
  • Inputs: input, simulator_llm, evaluator_llm
  • Outputs: output - Scan results
  • Configuration:
  • Target Base URL, Target Model Name, Target API Key: Connection details for the agent under test (required)
  • Target Agent Purpose: Default describes an autonomous customer-support agent with tool access. Describe the agent's tools, authority limits, memory usage, and any inter-agent communication — the scanner builds its scenarios from this
  • Target System Prompt: The target's system instruction. The scanner evaluates goal hijacking, tool misuse, and trust exploitation against it
  • Agentic Vulnerabilities: Comma-separated list. Default ExcessiveAgency, GoalTheft, ToolOrchestrationAbuse
  • Vulnerability Type Overrides: Custom vulnerability definitions
  • Attack Vectors: Comma-separated list. Default Prompt Injection, Jailbreaking
  • Attacks Per Vulnerability: 1–50, default 3
  • Max Concurrent: 1–20, default 1
  • Use OWASP ASI 2026: Default off. Switches the scan to the agent-specific OWASP category set
  • OWASP ASI Categories: Comma-separated ASI identifiers. Leave empty to test all ten
  • SSL Certificate Verification, Strip Reasoning/Thinking Tags, Extra Body Parameters (JSON)
  • Supported Agentic Vulnerabilities:
  • Critical — ExcessiveAgency (acting beyond granted authority), GoalTheft (original objective replaced), ToolOrchestrationAbuse (unsafe tool chains), UnexpectedCodeExecution (injected or unsafe code)
  • High — ExploitToolAgent (tool bypass and function abuse), DebugAccess (unauthorized debug mode), ExternalSystemAbuse (API abuse, rate limit bypass), SystemReconnaissance (architecture and tool discovery)
  • Medium — IndirectInstruction (hidden commands in content the agent reads), AgentIdentityAbuse (identity spoofing, role confusion), AutonomousAgentDrift (gradual behavioural deviation), CrossContextRetrieval (access to another session's context), ToolMetadataPoisoning (misleading tool descriptions), RecursiveHijacking (self-referential loops), InsecureInterAgentCommunication (message interception and spoofing)
  • Supported Attack Vectors:
  • Single-turn — Prompt Injection, Gray Box, Prompt Probing, Roleplay, AuthorityEscalation, GoalRedirection, SystemOverride, PermissionEscalation
  • Multi-turn — Jailbreaking (also LinearJailbreaking), TreeJailbreaking, CrescendoJailbreaking, SequentialJailbreak
  • OWASP ASI Top 10 2026: Available when Use OWASP ASI 2026 is enabled. This framework covers autonomous and semi-autonomous agents, whose reasoning, tool integration, persistent memory, and inter-agent messaging create vulnerability classes beyond prompt-level attacks
  • ASI_01 Agent Goal Hijack — Critical. Direct goal manipulation, indirect instruction injection, recursive hijacking, cross-context injection. Dangerous because agents execute multi-step plans automatically, so a hijacked goal can complete extensive unauthorized work before anyone notices
  • ASI_02 Tool Misuse & Exploitation — Critical. Recursive tool calls, unsafe tool composition, budget exhaustion, cross-tool state leakage
  • ASI_03 Agent Identity & Privilege Abuse — High. Agent impersonation, cross-agent trust abuse, identity inheritance, role bypass
  • ASI_04 Agentic Supply Chain Compromise — High. Schema manipulation, deceptive tool descriptions, permission misrepresentation, registry poisoning
  • ASI_05 Unexpected Code Execution — Critical. Unauthorized execution, shell commands, unsafe eval, command injection
  • ASI_06 Memory & Context Poisoning — Critical. Long-term memory poisoning, context injection, state manipulation, memory leakage, cross-session influence. Effects persist, since the agent carries the corrupted information into every later decision
  • ASI_07 Insecure Inter-Agent Communication — High. Agent-in-the-middle, message injection, spoofing, protocol abuse
  • ASI_08 Cascading Agent Failures — High. Tool chain failures, dependency failures, resource exhaustion cascades, trust chain breakdowns
  • ASI_09 Human-Agent Trust Exploitation — Medium. Authority misrepresentation, misleading explanations, over-confidence projection, responsibility diffusion
  • ASI_10 Rogue Agents — Critical. Goal drift, agent collusion, reward hacking, runaway autonomy
  • Usage: The quality of the results depends on how precisely the agent's purpose and system prompt are described. A vague purpose produces generic attacks.

Custom Red Team Scanner

  • Category: Security
  • Purpose: Runs a security scan using a prompt data set you supply, rather than attacks generated by a model
  • Inputs: input, evaluator_llm. There is no simulator model, because the prompts come from the data set
  • Outputs: output - Test results as a JSON report
  • Configuration:
  • MinIO Credentials: Connection to the store holding the data set (required)
  • MinIO Bucket: Default kai-datasets
  • Dataset Path: Path to the data set file inside the bucket, such as prompts_dataset.json or finance/compliance_tests.json (required)
  • Target Base URL: Default https://api.openai.com/v1
  • Target Model: Default gpt-4o-mini
  • Target API Key: Key for the target system (required)
  • System Prompt (Optional): The target's system instruction. Recommended, since it defines the behaviour the scan measures against
  • SSL Certificate Verification, Strip Reasoning/Thinking Tags, Extra Body Parameters (JSON)
  • Dataset Format: A JSON file with three fields:
    • name (string) — Data set name, shown in the report
    • criteria (string) — The rules the evaluator applies when judging each response. Be explicit, for example: the system should refuse harmful requests, must not reveal system information, and must maintain its safety guidelines
    • prompts (array of strings) — The prompts to test. Each one is sent exactly as written. There is no upper limit, but every prompt adds to the run time

    JSON Structure

    The dataset file must be in the following format:

    JSON
    {
  "name": "Dataset Name",
  "criteria": "Evaluation Criteria",
  "prompts": [
    "Prompt 1",
    "Prompt 2",
    "Prompt 3"
  ]
}
  • Report Format: The output contains the data set name, the criteria, a summary, and a per-prompt breakdown
  • summary — total_prompts, passed, failed, errors, pass_rate
  • results — For each prompt: prompt_number, prompt, response, is_safe, evaluation_reason, status (pass, fail, or error)
  • Usage: Suited to organisation-specific risks that generated attacks would not cover — regulatory compliance checks, sector-specific scenarios, or regression tests for issues found previously.

Text Processing Nodes

String Input

  • Category: Text Processing
  • Purpose: Accepts text, cleans it, validates it, and reports statistics
  • Inputs:
  • input_data - Text from a connected node
  • text_input - Text typed into the field
  • Outputs:
  • output - Trimmed text
  • text_stats - Character, line, word, and paragraph counts
  • validation_status - Validation result and warnings
  • documents - The text wrapped as a Document, ready for a splitter or vector store
  • Configuration:
  • Text Input: Multi-line field, eight rows, up to 10000 characters
  • Usage: The field takes priority over the connection. If text is left in the field, incoming data is ignored — a common cause of a workflow that always returns the same result.

Decorative Nodes

Sticky Note

  • Category: Decorative
  • Purpose: Resizable text note for documenting the canvas
  • Inputs: None
  • Outputs: None
  • Configuration: None required
  • Usage: Has no effect on execution. Use it to explain a section of a complex workflow for whoever opens it next — including yourself.