Do I have to change my workflows to use the interceptor?

No. The interceptor sits in the workflow's own run and sees every node, not only the ones you wired. You swap the image on every n8n service that executes workflows, set two environment variables, and the workflows themselves stay as they are.

How do I roll the interceptor back?

Point every service back at the official image, or a previous Privent tag. Rollback is an image/tag change. Every service points at the official n8n image or a previous Privent tag, and nothing else in the deployment changes.

IN-ENGINE INTERCEPTORGHCR · public image · 2.28.7-privent.1

In-engine interception for self-hosted n8n. One image swap.

The interceptor is a Privent build of the n8n image. It sits in the workflow's own run and sees every node, not only the ones you wired: node egress and agent tool-call arguments are transformed inside the engine, with no workflow changes. The preload is baked into the image entrypoint, so it cannot be dropped by clearing NODE_OPTIONS.

INSTALL

Swap the image on every service.

Every n8n process that executes workflows, main, worker, and webhook alike, must run the Privent image. Both variables are required, and the URL is your own Privent backend.

docker-compose.yml

Copied

services:
  n8n:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com   # your Privent backend
      AGENT_SDK_KEY: <your-org-sdk-key>
      # plus your existing n8n env (DB, encryption key, queue Redis, ...)
  n8n-worker:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    command: worker
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com
      AGENT_SDK_KEY: <your-org-sdk-key>
  n8n-webhook:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    command: webhook
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com
      AGENT_SDK_KEY: <your-org-sdk-key>

–Self-hosted n8n on Docker, Compose, or Kubernetes. Not n8n Cloud, not bare-metal npm.
–Designed for async and batch workloads; not recommended for latency-sensitive inline-sync flows.
–Queue mode supported: main, worker, and webhook share the same image.

VERIFY

The boot line, or a refusal that explains itself.

[privent] preload OK | role=...

After start, stderr includes the preload boot line. If the backend is reachable and the vault can tokenize, the first protected egress also logs capability verification once per process.

Fail-closed is the feature

A container started without the Privent variables refuses to start and prints the reason line by line, then exits. An instance that cannot protect data does not run, and you find out at boot, not at the first leak.

ROLLBACK

An image tag, both directions.

Point every service back at the official image, or a previous Privent tag. Rollback is an image/tag change.

docker-compose.yml

Copied

- image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
+ image: n8nio/n8n:2.28.7

A developer cannot drop the preload. They can set one env var that permits unmasked egress, and every payload it lets through is logged.

MEASURED BY OTHERS

223genAI data policy violations per month in the average organizationNetskope, 2026

5.5%of open-source MCP servers studied exhibit MCP-specific tool poisoning, and 7.2% general vulnerabilitiesarXiv, Jun 2025

18,033 TBof enterprise data sent to AI and ML applications in 2025, up 93% year over yearZscaler ThreatLabz, 2026

FAQ

Before you swap the image, the questions we get

The Privent interceptor is a build of the n8n image that transforms node egress and agent tool-call arguments inside the engine: one image swap, no workflow changes.

Image tag: 2.28.7-privent.1
Built on: n8nio/n8n:2.28.7
Fits: self-hosted n8n on Docker, Compose or Kubernetes; main, worker and webhook
Not for: n8n Cloud, or bare-metal npm installs
Without its variables: the container refuses to start and prints why

“The place to control what an agent sends out is the engine that runs it. Anything standing outside the run sees a copy, and a copy is not the data.”

Görkem Yağcı, Co-Founder & CTO

Updated September 2026

Protect the whole pipeline.

Get an Agent SDK key for your organization, swap the image, and watch the first protected run land in your audit trail.

Get an Agent SDK key Book a demo