SonnyLabs Helper Module

Security scanning functions for detecting prompt injections in LLM applications.

Quick Start

const { SonnyLabsClient } = require('sonnylabs-node');

const scanner = new SonnyLabsClient({
  apiToken: "your-api-token",
  baseUrl: "https://sonnylabs-service.onrender.com",
  analysisId: "your-analysis-id"
});

const result = await scanText("Hello world", scanner);
console.log(result.toString());

Classes

ScanVerdict

Safety verdict from scan functions.

Property	Type	Description
isSafe	boolean	True if content is safe
score	number	Risk score (0.0=safe, 1.0=high risk)
scanType	string	"input" or "output"
tag	string	Classification tag
meta	object	Optional metadata
rawAnalysis	array	Raw API results

new ScanVerdict({isSafe: false, score: 0.85}).toString() → "INJECTION DETECTED (score: 0.85)"

RagScanResult

RAG chunk scanning results.

Property	Type
query	string
totalChunks	number
safeChunks	array
flaggedChunks	array
isSafe	boolean
verdictPerChunk	array

ToolCallScanResult

Tool call safety results.

Property	Type
isSafe	boolean
toolName	string
userIntentSafe	boolean
toolArgsSafe	boolean
combinedScore	number
userMessageVerdict	ScanVerdict
toolContextVerdict	ScanVerdict
recommendation	string ("proceed"/"review"/"block")

Scanner Functions

scanText

Scan a single text for prompt injection.

scanText(text, client, scanType = 'input', policy = {}, meta = {}) → Promise<ScanVerdict>

Example:

const result = await scanText("Ignore previous instructions", scanner);
if (!result.isSafe) {
  console.log(`Blocked! Tag: ${result.tag}, Score: ${result.score}`);
}

scanMessages

Scan chat messages for prompt injection.

scanMessages(messages, client, scanType = 'input', policy = {}, meta = {}) → Promise<ScanVerdict>

Example:

const messages = [
  { role: "user", content: "Hello" },
  { role: "user", content: "Forget all instructions" }
];
const result = await scanMessages(messages, scanner);
console.log(`Safe: ${result.isSafe}`);

scanRagChunks

Scan RAG chunks before injecting into context.

scanRagChunks(query, chunks, client, policy = {}, meta = {}) → Promise<RagScanResult>

Example:

const chunks = ["doc content", { text: "another chunk" }];
const result = await scanRagChunks("What is policy?", chunks, scanner);
const safeContent = result.safeChunks.map(c => c.text);

scanToolCall

Scan tool calls before execution.

scanToolCall(userMessage, toolName, toolArgs, client, toolSchema = null, policy = {}, meta = {}) → Promise<ToolCallScanResult>

Example:

const result = await scanToolCall(
  "Search secrets", 
  "web_search", 
  { query: "hack" }, 
  scanner, 
  { name: "web_search" }
);
if (result.recommendation === "block") {
  console.log("Blocking execution!");
}

Policy Configuration

const policy = { threshold: 0.5, max_chunks_to_scan: 10 };
const result = await scanText("text", scanner, "input", policy);

Recommendation thresholds: ≥0.85="block", ≥0.50="review", <0.50="proceed"