mizcausevic-dev/otel-genai-validator

# otel-genai-validator Validate OpenTelemetry GenAI spans against the official [semantic conventions](https://opentelemetry.io/docs/specs/semconv/gen-ai/). Library + CLI. ## What it checks | Rule | Severity | Description | |---|---|---| | `missing-provider-name` | error | `gen_ai.provider.name` is required | | `missing-operation-name` | error | `gen_ai.operation.name` is required | | `unknown-operation-name` | warning | not in the well-known set (`chat`, `generate_content`, `text_completion`, `embeddings`, `retrieval`, `execute_tool`, `create_agent`, `invoke_agent`, `invoke_workflow`) | | `missing-request-model` | warning | `gen_ai.request.model` is recommended when known | | `missing-usage-input-tokens` | warning | `gen_ai.usage.input_tokens` is recommended for billable LLM calls | | `missing-usage-output-tokens` | warning | `gen_ai.usage.output_tokens` is recommended for billable LLM calls | | `negative-token-count` | error | a token count is < 0 | | `legacy-token-attribute` | warning | legacy `gen_ai.usage.prompt_tokens` / `completion_tokens` (renamed to `input_tokens` / `output_tokens`) | | `unexpected-span-kind` | warning | GenAI spans are typically CLIENT (3) or INTERNAL (1) | | `span-name-mismatch` | info | `span.name` does not follow `{operation.name} {request.model}` | ## CLI npx otel-genai-validate [--summary] [--strict] [--skip rule,rule] [--out report.json] ## Library import { validate, validateSpans } from "otel-genai-validator"; const payload = JSON.parse(/* OTLP/JSON */); const report = validate(payload); // { spans, findings, counts: { errors, warnings, infos }, ok } if (!report.ok) { for (const f of report.findings) { if (f.severity === "error") console.error(f.ruleId, f.message); } } `validateSpans(spans)` accepts an already-flattened array if you're consuming spans directly from a collector receiver or in-memory exporter. ## Composition - **Pairs with [`llm-cost-span-exporter`](https://github.com/mizcausevic-dev/llm-cost-span-exporter)** — validate the spans it produces against the same conventions. - **Pairs with [`a2a-mcp-bridge`](https://github.com/mizcausevic-dev/a2a-mcp-bridge)** — when an agent calls a tool, validate the underlying GenAI span before correlating. ## Develop npm install npm run lint && npm run typecheck && npm run coverage && npm run build npm run demo ## License [AGPL-3.0-or-later](LICENSE)

标签：自动化攻击