FlowPilot
AI control plane for Node-RED
An AI that drafts Node-RED flows in plain English and is not permitted to deploy one until it has survived five independent layers of validation.
Problem
Node-RED flows on a factory floor move physical things. An AI that writes one is useful; an AI that deploys one unchecked is a hazard, and the failure is not a bad diff — it is a robot doing something unexpected.
The interesting problem is not generation. It is what has to be true before a generated flow is allowed to run.
What I built
Generation behind a validation pipeline, and a deploy path that can undo itself.
- Five-layer validation — JSON schema, node catalog, function-code static analysis, security scanning, sandboxed runtime simulation
- Safe deployment with snapshots, approval gates, health checks and automatic rollback on failure
- Live monitoring over SSE/WebSocket
- Role-based permission engine gating tool use by risk level
- Outbound-only connector tunnel, so the Node-RED instance is never exposed to the internet
- Audit trail, local model support and a security preflight
Outbound-only by design
The connector tunnels outward from the Node-RED instance rather than accepting inbound connections. An industrial controller should not have an open port facing the internet regardless of how good the authentication is, and this removes the question entirely.
From a sentence to a deployed flow
Generation is the easy half. Everything after it exists because these flows move physical things, and a bad one is not a bad diff — it is a robot doing something unexpected.
Describe the flow in plain English
Five validation passes
JSON schema — is it a well-formed flow at allNode catalog — do these nodes exist on this instanceStatic analysis of function codeSecurity scanSandboxed runtime simulationAny pass fails
The flow does not reach the instance.
Approval gate
A role-based permission engine gates tool use by risk level; approval is not optional.
Snapshot, then deploy
Over an outbound-only connector tunnel — the Node-RED instance is never exposed to the internet.
Health check after deploy
Healthy — keep it, and record the audit trailUnhealthy — automatic rollback to the snapshot
The five passes
In order. A flow has to survive all of them before an approval gate is even offered.
| Pass | Catches |
|---|---|
| JSON schema | Malformed flows, wrong shapes, missing wiring |
| Node catalog | Nodes that do not exist on the target instance |
| Function static analysis | Unsafe or broken code inside function nodes |
| Security scan | Credential exposure and dangerous operations |
| Sandboxed simulation | What the flow actually does at runtime, before it touches hardware |
Limitations and failure modes
- Validation reduces the risk of a bad flow reaching hardware; it does not eliminate it. Approval gates are deliberately not optional.
Gallery
Attribution
- Built by me
- FlowPilot is mine. It came directly out of the Node-RED operator tooling built for the SMR300 deployment.