The risk score
Open core · self-host + all Splyntra Cloud plans. The pipeline redacts and scores risk on every plan; the dedicated Security dashboard on Splyntra Cloud requires the Pro plan or higher.
Splyntra collapses every security signal on a run into a single 0–100 risk score. It is the number you scan first and the entry point into exactly which span went wrong.
What the detectors find
The security service runs five detectors over the spans in a run. Each produces findings that carry a severity.
| Detector | Looks for |
|---|---|
| Secret | Leaked credentials — AWS keys, Stripe keys, JWTs, bearer tokens, API keys |
| PII | Personally identifiable information in prompts, outputs, or tool I/O |
| Moderation | Unsafe or policy-violating content |
| Tool-guard | Unsafe or unexpected tool calls |
| Injection | Prompt-injection attempts against the agent |
From finding to severity to span
Detector findings carry a severity (up to HIGH / CRITICAL), and each finding is
mapped onto the exact span where the risk appeared — a tool_call, an llm_call, or a
step. The run's 0–100 score aggregates those findings, so a high score always resolves
to specific, inspectable spans rather than an opaque number.
Because the score lives on the same spans as the trace timing, you drill from a run's score straight to the offending span in the trace waterfall. See Traces & risk for the span model, and Detection & redaction for how each detector works.
Scored everywhere; surfaced by plan
The pipeline redacts and scores risk on every plan, self-hosted or Cloud — the risk score is core functionality, and redaction runs before storage regardless of edition.
On Splyntra Cloud, the dedicated Security dashboard — which lists incidents (injection, secret, PII, moderation, unsafe tool calls) and lets you triage them — requires the Pro plan or higher. The underlying scoring does not change; only the incident surface is gated.
Scoring happens after the fact. To stop a risky call before it completes, enable the
inline guard with guard="monitor" or guard="block".
Next steps
- Detection & redaction — the detectors in depth.
- Guardrails — blocking risky calls inline.
- Security overview — the detection pillars and incidents.