Pentest Report Quality Gate with n8n

Automate FDA 524B compliance checks on pentesting reports using local AI.

Introduction

30 Second Summary

Before a medical device can ship, its cybersecurity testing must pass FDA scrutiny. Reviewing a 50-page pentesting report against a compliance checklist by hand is slow, inconsistent, and easy to get wrong.

In this project, you will build a local AI-powered quality gate that ingests pentesting documents and returns structured compliance assessments. You will use n8n for workflow automation and Ollama for private, on-device LLM analysis.

What You'll Build

Upload a pentesting report PDF, hit send, and watch a structured quality assessment appear showing exactly which FDA criteria pass, which fail, and which scope items were never tested.

By the end of this project, you'll have:

  • A DHF Scope Analyzer webhook you can POST any design document to and get back a JSON checklist of every interface that needs penetration testing, mapped to FDA 524B cybersecurity categories.
  • A Pentest Report Reviewer webhook you can POST a final report to and get back a structured assessment of whether it meets FDA quality standards and covers everything the DHF identified.
  • A fully local pipeline where no data leaves your machine. You can process sensitive medical device documentation through Docker and Ollama with zero cloud dependency.
  • Secret Mission: A weighted scoring matrix that outputs a submission-readiness percentage, turning pass/fail results into a quantified risk score.

Are there any prerequisites?

This project assumes you already have Docker Desktop and Ollama installed on your machine. If you do not have them yet, install both before starting Step 1.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters.

You're building an automated quality gate that reviews pentesting reports against FDA 524B requirements using local AI. This replaces manual checklist reviews and ensures nothing slips through before submission.

Launch n8n in Docker and Connect to Ollama

Your quality gate system needs two pieces running locally: an LLM that can read and analyze documents, and a workflow engine that orchestrates the analysis pipeline.

In this step, you will pull the llama3.1:8b model into Ollama, launch n8n inside a Docker container, and connect them so n8n can send prompts to your local model.

In this step, get ready to:
  • Pull and verify the llama3.1:8b model in Ollama.
  • Start n8n in Docker with persistent storage.
  • Configure Ollama credentials inside n8n.
Pull the llama3.1:8b model in Ollama

Pentesting reports can run 30 to 100+ pages. The default llama3 model only supports 8K tokens of context, which is far too small to ingest a full document.

The llama3.1:8b model gives you a 128K context window at the same hardware requirements (~4.9 GB download).

  • Open a terminal window and pull the model by running this command:
ollama pull llama3.1:8b

What does this command do?

This downloads the llama3.1:8b model weights from the Ollama registry to your machine. The download is approximately 4.9 GB, so it may take a few minutes depending on your connection.

  • Verify the model is available by running:
ollama list

You should see llama3.1:8b listed in the output alongside its size.

Before you run the next command, what do you think the model will respond with?

  • Test the model responds to prompts by running:
ollama run llama3.1:8b "Say hello"

The model will print a greeting and return you to your terminal prompt. This confirms the model loads and generates text correctly.

Model not responding or download failed?

  • Make sure Ollama is running in the background. You can check by running ollama list. If you see an error about connecting, start Ollama from your applications.
  • If the download stalled, re-run ollama pull llama3.1:8b. It resumes from where it left off.
  • If you see an out-of-memory error, close other large applications to free RAM.

Help me troubleshoot why my Ollama model is not responding

Start n8n in Docker with the correct networking

n8n is the workflow automation engine that will chain together your webhook, PDF extraction, and LLM analysis. You will run it inside a Docker container so it stays isolated from the rest of your system.

  • Create a persistent Docker volume for n8n data by running:
docker volume create n8n_data

Why create a volume?

The container uses the --rm flag, which means Docker removes the container when it stops. Without a volume, all your workflows and credentials would disappear every time you stop n8n.

The n8n_data volume persists on your machine independently of the container, so your work survives restarts.

  • Start the n8n container by running this command:
docker run -it --rm \
  --name n8n \
  -p 5678:5678 \
  -e GENERIC_TIMEZONE="UTC" \
  -e TZ="UTC" \
  -e N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true \
  -e N8N_RUNNERS_ENABLED=true \
  -v n8n_data:/home/node/.n8n \
  docker.n8n.io/n8nio/n8n

What does this command do?

  • `-it` runs n8n in the foreground so you can see its logs. This terminal session will be occupied by n8n output.
  • `--rm` removes the container when you stop it. Your data is safe in the n8n_data volume.
  • `-p 5678:5678` maps port 5678 from the container to your machine so you can access n8n in your browser.
  • `-v n8n_data:/home/node/.n8n` mounts the persistent volume inside the container.
  • `docker.n8n.io/n8nio/n8n` is the official n8n Docker image.

This command takes over your terminal

You will see n8n startup logs streaming in this terminal window. Do not close it. For the rest of this project, you will interact with n8n through your browser. If you need to run terminal commands later, open a new terminal tab.

  • Open your browser and navigate to http://localhost:5678.

You should see the n8n signup screen. This is where you create your owner account.

  • Enter your email, first name, last name, and a password. Your password must be at least 8 characters and include at least one number and one capital letter.
  • Click Next to create your owner account and log in.

Browser shows "unable to connect"?

  • Check your terminal where you ran the docker run command. If you see an error about the port being in use, another process is occupying port 5678. Stop it or change the port mapping.
  • Make sure Docker Desktop is running. If the container exited immediately, check the terminal output for error messages.

Help me get n8n running in Docker

Configure Ollama credentials in n8n

n8n needs to know where your Ollama instance is running. Since n8n is inside a Docker container and Ollama is on your host machine, you need to use Docker Desktop's special hostname to bridge the two.

  • In n8n, click on the user menu icon in the bottom-left corner.
  • Click Settings.
  • Click Credentials in the left sidebar.
  • Click Add Credential in the top-right corner.
  • Search for Ollama and select it from the list.

The credential form opens with a Base URL field.

  • Set the Base URL to:
http://host.docker.internal:11434

What is host.docker.internal?

Docker Desktop automatically maps host.docker.internal to your host machine's network. Since Ollama listens on port 11434 on your host, this URL lets the n8n container reach it without any extra networking setup.

  • In the Name field at the top, rename the credential to Local Ollama.
  • Click Save.

You should see a green success banner confirming the credential was saved. The credential now appears in your Credentials list as "Local Ollama".

Credential save failed or connection error?

  • Double-check that Ollama is still running on your host machine. In a new terminal, run ollama list to confirm.
  • Make sure the Base URL is exactly http://host.docker.internal:11434 with no trailing slash.
  • Verify Docker Desktop is running (not just Docker Engine). The host.docker.internal hostname requires Docker Desktop.

Help me connect n8n to Ollama

Your local AI infrastructure is live. n8n is running in Docker, the llama3.1:8b model is ready in Ollama, and the two are connected. Next up, you will build your first workflow that ingests a DHF document and extracts testable scope from it.

Build the DHF Scope Analyzer Workflow

Before you can verify whether a pentesting report covers everything, you need a baseline of what should be tested.

In this step, you will build an n8n workflow that ingests a Design History File (DHF), extracts its text, and sends it to your local LLM with a prompt engineered around FDA 524B Section V.B.4 requirements. The output is a structured JSON scope checklist you can use later to verify the pentest report.

In this step, get ready to:
  • Create a Webhook trigger and PDF extraction chain in n8n.
  • Add a Basic LLM Chain node with an FDA scope analysis prompt.
  • Test the full workflow end-to-end with a sample PDF.
Create the webhook trigger and PDF extraction chain

Every workflow needs a trigger. Yours will accept PDF uploads over HTTP, then immediately extract the text so the LLM can read it.

  • In your browser, return to the n8n editor at http://localhost:5678.
  • Click the + button (or Add workflow) to create a new workflow.
  • Double-click the workflow name at the top and rename it to DHF Scope Analyzer.
  • Click the + node on the canvas and search for Webhook. Select it to add a Webhook node.
  • In the Webhook node settings, set HTTP Method to POST.
  • Set Path to dhf-scope-analyzer.
  • Close the Webhook node panel.

Now add the node that converts the uploaded PDF binary into readable text.

  • Click the + connector on the right side of the Webhook node to add a new node after it.
  • Search for Extract From File and select it.
  • Set Operation to Extract From PDF.
  • Confirm Input Binary Field is set to data (this is the default).
  • Close the Extract From File node panel.

Your canvas now shows Webhook connected to Extract From File. Two nodes, one clean data pipeline from upload to text.

What does Extract From File do?

The Extract From File node takes the raw PDF binary that arrives via the webhook and converts it into a JSON object with a text field containing the full document text. Downstream nodes can reference this extracted text using the expression {{ $json.text }}.

Don't see Extract From File in the search?

Make sure you are searching in the node panel (the + button on the canvas or the connector), not the credentials panel. The node is listed under Core Nodes.

Help me find the Extract From File node in n8n.

Add the LLM chain to analyze scope against FDA requirements

With the PDF text extracted, you need an LLM to read it and identify every testable interface according to FDA 524B Section V.B.4 categories. The Basic LLM Chain node handles this by sending a structured prompt to your local Ollama model.

  • Click the + connector on the right side of the Extract From File node.
  • Search for Basic LLM Chain and select it.
  • In the Basic LLM Chain panel, set Prompt to Define below.

Now you need to attach the Ollama Chat Model as a sub-node so the Basic LLM Chain knows which model to call.

  • At the bottom of the Basic LLM Chain panel, you will see a Model connection slot. Click it and select Ollama Chat Model.
  • In the Ollama Chat Model sub-node, select Local Ollama as the credential (the one you created in Step 1).
  • Set Model to llama3.1:8b.
  • Under Options, set Sampling Temperature to 0.1.
  • Close the Ollama Chat Model sub-node to return to the Basic LLM Chain panel.

Why set temperature to 0.1?

A low temperature makes the model's output more deterministic and consistent. For compliance analysis you want repeatable, structured results rather than creative variation.

Next, paste the FDA scope analysis prompt into the Basic LLM Chain. This prompt tells the model exactly what to extract and how to format its response.

  • In the Basic LLM Chain panel, find the Prompt (User Message) text area and paste the following prompt:
You are an FDA cybersecurity compliance analyst. Analyze the following Design History File (DHF) text and identify all testable interfaces and components relevant to penetration testing.

Map each identified interface to FDA 524B Section V.B.4 categories:
- Network interfaces (wired/Ethernet)
- Wireless interfaces (Wi-Fi, Bluetooth, cellular)
- Firmware/embedded systems
- Web/cloud interfaces (APIs, portals, mobile apps)
- Update mechanisms (OTA, USB, network updates)

Respond ONLY with valid JSON in this exact format:
{
  "device_name": "name of the medical device",
  "identified_interfaces": ["interface1", "interface2"],
  "fda_test_categories": {
    "network": ["items"],
    "wireless": ["items"],
    "firmware": ["items"],
    "web_cloud": ["items"],
    "update_mechanisms": ["items"]
  },
  "missing_scope_items": ["items that should be tested but are not clearly documented"],
  "recommendations": ["recommendations for scope completeness"]
}

DHF Text to analyze:
{{ $json.text }}

What does this prompt do?

The prompt has three jobs. First, it sets the model's role as an FDA cybersecurity analyst. Second, it defines the five FDA 524B Section V.B.4 test categories that the model must map interfaces against. Third, it enforces a strict JSON output schema so the response is machine-readable.

The expression {{ $json.text }} at the bottom dynamically injects the full PDF text extracted by the previous node.

  • Close the Basic LLM Chain panel.

Your canvas now shows three connected nodes: Webhook, Extract From File, and Basic LLM Chain (with the Ollama Chat Model sub-node attached underneath).

Seeing a 'No prompt specified' error?

This happens when the Prompt dropdown is still set to Take from previous node automatically instead of Define below. Go back into the Basic LLM Chain node and change the dropdown, then paste the prompt text.

Help me fix the prompt configuration in my Basic LLM Chain node.

Configure the webhook response and test end-to-end

The workflow can now receive a PDF and analyze it. But without a response node, the webhook will never send anything back to the caller. You need to close the loop.

  • Click the + connector on the right side of the Basic LLM Chain node.
  • Search for Respond to Webhook and select it.
  • Leave the default settings (it returns the incoming data as the HTTP response body).
  • Close the node panel.

Your complete workflow chain is: Webhook, Extract From File, Basic LLM Chain, Respond to Webhook.

  • Click the Active toggle in the top-right corner of the workflow editor to activate the workflow. It should turn green.

Why activate the workflow?

Webhook-triggered workflows only listen for incoming requests when the workflow is active. Without activation, POSTing to the URL returns a 404.

Before you test, what do you expect to see when you send a PDF to the webhook? Think about whether the LLM will return valid JSON or need time to process.

  • Open a new terminal window (keep n8n running in its existing terminal).
  • Send a test PDF to the webhook by running this command (use any PDF file you have available):
curl -X POST http://localhost:5678/webhook/dhf-scope-analyzer -F "data=@sample-dhf.pdf"

No PDF handy?

Use any technical PDF you have on your machine. A product spec, architecture diagram, or even a research paper works. The LLM will do its best to identify interfaces from whatever text it receives. Replace sample-dhf.pdf with the path to your file.

The response may take 30-60 seconds because the local LLM is processing the full document text. When it returns, you should see a JSON object with the fields device_name, identified_interfaces, fda_test_categories, missing_scope_items, and recommendations.

Getting a timeout or empty response?

If the curl command hangs for more than 2 minutes, Ollama may have run out of memory processing a large PDF. Try a shorter document (under 10 pages). Also confirm Ollama is still running by opening another terminal and running ollama list.

If you see a 404 error, make sure the workflow is activated (green toggle) and the webhook path is exactly dhf-scope-analyzer.

Help me troubleshoot my DHF Scope Analyzer webhook request.

Your first workflow is live and analyzing documents. Next up, you will build the second workflow that reviews the actual pentest report against both the FDA quality matrix and this scope checklist.

Build the Pentest Report Reviewer Workflow

In the previous step you built the DHF Scope Analyzer, which identifies what should be tested. Now you need the second half of the quality gate: a workflow that reviews the actual pentest report and checks whether it meets FDA submission standards.

This reviewer workflow applies an eight-criterion quality matrix drawn from FDA 524B requirements. It also cross-references the report against the DHF-derived scope to flag any interfaces that were never tested.

In this step, get ready to:
  • Create a Webhook trigger and PDF extraction chain for the reviewer workflow.
  • Configure an LLM chain with the FDA quality matrix prompt.
  • Activate the workflow and test it with a sample PDF via curl.
Create the webhook trigger and PDF extraction

Just like the DHF Scope Analyzer, this workflow starts with a Webhook that accepts a PDF upload and an Extract From File node that converts the binary into readable text.

  • Return to the n8n editor at http://localhost:5678.
  • Click the + Create Workflow button in the top-right corner.
  • Click the workflow name at the top and rename it to Pentest Report Reviewer.
  • Click the + button on the canvas to add your first node.
  • Search for Webhook and select it.
  • Set HTTP Method to POST.
  • Set Path to pentest-report-reviewer.
  • Close the Webhook node panel.
  • Click the + connector on the right side of the Webhook node to add the next node.
  • Search for Extract From File and select it.
  • Set Operation to Extract From PDF.
  • Confirm Input Binary Field is set to data (the default).
  • Close the Extract From File node panel.

You should now see two nodes connected on the canvas: Webhook followed by Extract From File.

Don't see the Extract From PDF option?

Make sure you selected the Extract From File core node, not a community node with a similar name. The Operation dropdown lists PDF as one of the supported formats.

help me find the Extract From File node in n8n

Add the LLM chain for FDA quality matrix review

The core of this workflow is an LLM prompt that evaluates the pentest report against eight FDA quality criteria. The model checks for tester independence, threat model traceability, CVSS scoring, and more.

  • Click the + connector on the right side of the Extract From File node.
  • Search for Basic LLM Chain and select it.
  • In the Basic LLM Chain panel, set Prompt to Define below.
  • Paste the following FDA quality matrix prompt into the Prompt (User Message) text field:
You are an FDA cybersecurity compliance reviewer for medical device penetration testing reports. Analyze the following report against FDA 524B quality criteria.

REPORT TEXT:
{{ $json.text }}

DHF SCOPE CHECKLIST:
[PASTE DHF SCOPE JSON HERE]

Evaluate against these criteria:
1. Tester Independence - Testers organizationally separate from development
2. Threat Model Traceability - Findings traced to threat model or risk file
3. Attack Surface Coverage - All external interfaces covered (network, wireless, firmware, web/cloud, update mechanisms)
4. CVSS v3.1 Scoring - Findings scored with CVSS v3.1
5. SBOM Reference - SBOM referenced, third-party components assessed
6. Remediation Retest Evidence - Retesting after remediation documented
7. Executive Summary - Includes summary with overall risk rating
8. Scope Coverage - All DHF Scope Checklist items addressed in testing

Return ONLY valid JSON matching this structure:
{"criteria": [{"name": "Tester Independence", "status": "pass", "evidence_found": "description", "gaps": null}], "scope_coverage": {"tested_items": [], "untested_items": [], "coverage_percentage": "75%"}, "overall_assessment": "PASS", "summary": "brief findings summary"}

What does this prompt do?

  • The {{ $json.text }} expression pulls the extracted PDF text from the previous Extract From File node.
  • The [PASTE DHF SCOPE JSON HERE] placeholder is where you will manually paste the scope output from Workflow A in a later step. This lets the reviewer cross-reference what was tested against what should have been tested.
  • The eight criteria map directly to FDA 524B Section V.B.4 requirements for penetration testing submissions.
  • The output structure gives you a machine-readable JSON response with per-criterion pass/fail verdicts and a scope coverage breakdown.

Now connect the Ollama Chat Model sub-node so the Basic LLM Chain has a language model to use.

  • In the Basic LLM Chain panel, look for the Model connector at the bottom of the node. Click it and search for Ollama Chat Model.
  • Select the Local Ollama credential you created earlier.
  • Set Model to llama3.1:8b.
  • Set Temperature to 0.1 for consistent, deterministic output.
  • Close the Ollama Chat Model sub-node panel.

Why set Temperature to 0.1?

A low temperature makes the model's output more predictable and less creative. For compliance reviews you want repeatable, factual assessments rather than varied creative responses. Setting 0.1 keeps the model focused on the evidence in the document.

Your canvas should now show: Webhook, Extract From File, and Basic LLM Chain (with the Ollama Chat Model attached beneath it).

Configure response, activate, and test

The final piece is a Respond to Webhook node that sends the LLM output back to whoever called the webhook.

  • Click the + connector on the right side of the Basic LLM Chain node.
  • Search for Respond to Webhook and select it.
  • Leave the default settings (it will return the incoming data as the HTTP response).
  • Close the node panel.
  • Activate the workflow by toggling the Active switch in the top-right corner.
  • Save the workflow by pressing Cmd+S (macOS) or Ctrl+S (Windows).

Your complete workflow chain is: Webhook, Extract From File, Basic LLM Chain (with Ollama Chat Model), Respond to Webhook.

Before you test, what do you think will happen when you send a random PDF that is not a real pentest report? Will the model return all failures, or attempt to find evidence regardless?

  • Open a new terminal window and test the workflow by running:
curl -X POST http://localhost:5678/webhook/pentest-report-reviewer -F "data=@sample-pentest-report.pdf"

What file should I use?

You can use any PDF you have on hand. A technical document or architecture spec works well. Replace sample-pentest-report.pdf with the path to your file. The model will attempt to evaluate whatever text it finds against the eight criteria.

After a few seconds (Ollama processes locally, so give it time), you should see a JSON response in your terminal containing the criteria array with eight objects and a scope_coverage object.

Getting a timeout or empty response?

  • Make sure Ollama is still running. In a separate terminal, run ollama list to confirm llama3.1:8b is available.
  • Large PDFs take longer to process. Try a smaller file (under 10 pages) for faster testing.
  • Verify the workflow is active (green toggle) and that the webhook path is exactly pentest-report-reviewer.

help me troubleshoot my n8n Pentest Report Reviewer workflow not returning a response when I send a PDF via curl

Your quality gate reviewer is live. Next up, you will connect both workflows together and run them end-to-end to see the scope cross-reference in action.

Connect the Workflows and Test End-to-End

You now have two independent workflows: one that analyzes DHF scope and one that reviews pentest reports. Running them individually confirms each works in isolation, but the real value comes from connecting them.

In this step, you will run both workflows in sequence with real PDF files. The scope output from Workflow A feeds directly into Workflow B as the cross-reference checklist, proving the system works as a connected quality gate.

In this step, get ready to:
  • Send a test DHF PDF to Workflow A and capture the scope JSON output.
  • Paste the scope output into Workflow B's prompt as the cross-reference checklist.
  • Send a test pentest report PDF to Workflow B and verify the cross-reference identifies gaps.
Run Workflow A with a test DHF document

The DHF Scope Analyzer workflow needs a real PDF to extract testable interfaces from. Any technical document works as a stand-in: a product requirements doc, an architecture diagram PDF, or a system design document.

  • Find any technical PDF on your computer to use as a test document.
  • Switch back to the terminal where you previously ran curl commands (not the terminal running the n8n container).
  • Navigate to the folder containing your test PDF by running:
cd ~/Desktop
  • Send the PDF to the DHF Scope Analyzer webhook by running:
curl -X POST http://localhost:5678/webhook/dhf-scope-analyzer -F "data=@[[DHFPDF="your-dhf-file.pdf"]]"

What does this command do?

The -X POST flag sends an HTTP POST request to your webhook URL.

The -F "data=@filename" flag uploads the file as multipart form data. The field name data matches the Input Binary Field configured in the Extract From File node.

After a few seconds (the LLM takes time to process), you should see a JSON response in your terminal.

The response should contain a JSON object with fields like device_name, identified_interfaces, fda_test_categories, missing_scope_items, and recommendations.

LLM response times vary

Running llama3.1:8b locally means response times depend on your hardware. Expect anywhere from 10 seconds to a couple of minutes for a full document analysis.

  • Copy the entire JSON response from your terminal and save it somewhere (a text file, clipboard manager, or a notes app). You will paste this into Workflow B next.

Not seeing a response?

Make sure the DHF Scope Analyzer workflow is set to Active in n8n (toggle in the top-right corner of the workflow editor).

Check that Ollama is still running by opening a new terminal and running ollama list. If it is not running, start it again.

If you see a timeout error, the PDF may be too large for local processing. Try a shorter document (under 10 pages).

Help me debug this

Update Workflow B prompt with the DHF scope output

The Pentest Report Reviewer workflow has a placeholder in its prompt labeled DHF SCOPE CHECKLIST. Pasting the real scope JSON here gives the reviewer a concrete checklist to verify against.

  • Switch back to your n8n browser tab at http://localhost:5678.
  • Open the Pentest Report Reviewer workflow.
  • Double-click the Basic LLM Chain node to open its settings.
  • In the Prompt field, find the section labeled DHF SCOPE CHECKLIST.
  • Replace that placeholder text with the full JSON output you copied from Workflow A.
  • Click Back to canvas to close the node editor.
  • Save the workflow by pressing Cmd+S (macOS) or Ctrl+S (Windows).

Why paste the JSON manually?

In a production setup, you would automate this handoff (store the scope in a database or pass it between workflows via an HTTP request). For this project, manual copy-paste keeps things simple and lets you inspect exactly what data flows between the two workflows.

Run Workflow B with a test pentest report

With the DHF scope now embedded in the reviewer prompt, the workflow can cross-reference any pentest report against the expected test coverage.

Before you run this, think about what you expect the output to look like. The reviewer checks the report against eight FDA quality criteria AND compares tested items against your DHF scope. What do you predict the scope coverage section will show if the report does not mention some of the interfaces from your DHF?

  • In your terminal, send a PDF to the Pentest Report Reviewer webhook by running:
curl -X POST http://localhost:5678/webhook/pentest-report-reviewer -F "data=@[[REPORTPDF="your-pentest-report.pdf"]]"

What PDF should I use?

Use any security-related PDF you have: a vulnerability scan export, a security assessment, or even a general technical report. The LLM will do its best to evaluate whatever document you provide against the FDA criteria.

After the LLM processes the document, your terminal displays a JSON response. The response contains two main sections.

  • A criteria array with per-criterion results. Each criterion includes a name, status (pass or fail), evidence_found, and gaps.
  • A scope_coverage object listing which DHF scope items were tested versus which were missed.

The scope coverage section is the key connection between the two workflows. Items from your DHF scope JSON should appear here, marked as either tested or untested based on what the pentest report actually covered.

Seeing empty or incomplete results?

If the scope_coverage section is empty, confirm that you saved the workflow after pasting the DHF scope JSON into the prompt.

If the criteria are all showing as fail, your test PDF likely does not contain security assessment content. That is expected behavior. The quality gate correctly identifies missing elements.

If the response is cut off or malformed, the LLM may have run out of context for a very large document. Try a shorter PDF.

Help me troubleshoot this

Secret mission

Add a Weighted Scoring Matrix

A pass/fail checklist tells you what failed, but stakeholders want a number. Transform your quality gate into a quantified risk assessment that outputs a submission-readiness percentage per report.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally, so there are no ongoing costs. Decide whether to keep your resources running, pause them to come back later, or delete them entirely.

Resources you used:

  • Docker volume n8n_data (persists n8n workflows and credentials locally).
  • Ollama model llama3.1:8b (~4.9GB disk space).
  • n8n Docker container (running locally on port 5678).

Keep everything running

No action needed. Choose this if you are still actively building or want to keep using the webhook endpoints.

  • Leave the n8n container running to use the webhooks anytime.
  • Stop Ollama when not in use to free RAM. It starts automatically when you next call a model.

Pause - I'll come back to this later

Shut down running processes to free up memory. Your workflows persist in the Docker volume so nothing is lost.

  • Stop the n8n container by pressing Ctrl+C in the terminal where it is running.
  • Your workflows and credentials are saved in the n8n_data volume. Restart anytime by running the same docker run command from Step 1.
  • Ollama does not need to be explicitly stopped. It idles when no model is running.

Delete - I don't want to use this again

Remove all project resources and start fresh. This is permanent.

  • Stop the n8n container first by pressing Ctrl+C in its terminal. Because it was started with --rm, the container is automatically removed when stopped.
  • Remove the Docker volume (this deletes all saved workflows and credentials) by running:
docker volume rm n8n_data
  • Remove the Ollama model to reclaim ~4.9GB of disk space by running:
ollama rm llama3.1:8b
  • Confirm the volume is gone by running:
docker volume ls

You should no longer see n8n_data in the output.

  • Confirm the model is removed by running:
ollama list

You should no longer see llama3.1:8b in the output.

Nice Work!

Nice Work!

Nice work! You've built a local, privacy-preserving quality gate that reviews pentesting reports against FDA cybersecurity requirements using AI running entirely on your machine.

You've learned how to:

  • Build a DHF Scope Analyzer workflow in n8n that extracts testable interfaces from design documents and maps them to FDA 524B Section V.B.4 requirements.
  • Build a Pentest Report Reviewer workflow that checks reports against an FDA quality matrix covering tester independence, threat model traceability, CVSS scoring, SBOM reference, remediation evidence, and scope coverage cross-referenced against the DHF-derived checklist.
  • Master n8n workflow automation fundamentals including webhook triggers, PDF extraction, LLM integration with Ollama, and structured output handling.
  • Secret Mission: Add a weighted scoring matrix that quantifies submission readiness as a percentage with per-criterion breakdowns.

Ready to quiz yourself?