IN-ENGINE INTERCEPTORGHCR · public image · 2.28.7-privent.1

In-engine interception for self-hosted n8n. One image swap.

The interceptor is a Privent build of the n8n image. It sits in the workflow's own run and sees every node, not only the ones you wired: node egress and agent tool-call arguments are transformed inside the engine, with no workflow changes. The preload is baked into the image entrypoint, so it cannot be dropped by clearing NODE_OPTIONS.

INSTALL

Swap the image on every service.

Every n8n process that executes workflows, main, worker, and webhook alike, must run the Privent image. Both variables are required, and the URL is your own Privent backend.

docker-compose.yml

Copied

services:
  n8n:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com   # your Privent backend
      AGENT_SDK_KEY: <your-org-sdk-key>
      # plus your existing n8n env (DB, encryption key, queue Redis, ...)
  n8n-worker:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    command: worker
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com
      AGENT_SDK_KEY: <your-org-sdk-key>
  n8n-webhook:
    image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
    command: webhook
    environment:
      PRIVENT_EVALUATE_URL: https://api.example.com
      AGENT_SDK_KEY: <your-org-sdk-key>

–Self-hosted n8n on Docker, Compose, or Kubernetes. Not n8n Cloud, not bare-metal npm.
–Designed for async and batch workloads; not recommended for latency-sensitive inline-sync flows.
–Queue mode supported: main, worker, and webhook share the same image.

VERIFY

The boot line, or a refusal that explains itself.

[privent] preload OK | role=...

After start, stderr includes the preload boot line. If the backend is reachable and the vault can tokenize, the first protected egress also logs capability verification once per process.

Fail-closed is the feature

A container started without the Privent variables refuses to start and prints the reason line by line, then exits. An instance that cannot protect data does not run, and you find out at boot, not at the first leak.

ROLLBACK

An image tag, both directions.

Point every service back at the official image, or a previous Privent tag. Rollback is an image/tag change.

docker-compose.yml

Copied

- image: ghcr.io/privent-ai/n8n-privent:2.28.7-privent.1
+ image: n8nio/n8n:2.28.7

A developer cannot drop the preload. They can set one env var that permits unmasked egress, and every payload it lets through is logged.

Protect the whole pipeline.

Get an Agent SDK key for your organization, swap the image, and watch the first protected run land in your audit trail.

Get an Agent SDK key Book a demo