NVIDIA Security Models — `mcp__nvidia-security`

Decision rules by task type

Vulnerability analysis / threat modeling / compliance audit

• nemotron-ultra (audit-reasoner) — primary. Reasons about attack surface, impact, remediation.
• Combine with qwen3-coder for line-level code evidence.

SAST / secure code review / taint analysis

• qwen3-coder (code-auditor) — file/function-scope review.
• devstral (code-auditor) — repo-scale, dependency/IaC audits.

Prompt-injection / jailbreak detection

• llama-guard — multimodal (text+image). First choice for LLM I/O gates.
• nemotron-safety — lightweight 8B guard, LLM I/O moderation.
• nemotron-safety-reason — when you need a justification for the classification (NeMo reasoning).

PII detect / redact (GDPR, HIPAA pre-processing)

• gliner-pii — only PII-specialized model. Use it for scrub pipelines.

Risk classification (bias, harm, hallucination)

• granite-guardian — enterprise risk signals.

Combining models (pipelines)

Common pipelines:

1. Secure code review: qwen3-coder → line-level findings → nemotron-ultra → impact + remediation.
2. LLM output gate: user input → gliner-pii (redact) → model call → llama-guard (classify output) → deliver or block.
3. Compliance audit: devstral → repo scan → nemotron-ultra → compliance report.

Dispatch pipeline steps as parallel Agent subagents when independent, serial when chained.

Invocation pattern

// Via mcp__nvidia-security__nvidia_security_chat
{
  "model": "nemotron-ultra",
  "messages": [
    { "role": "system", "content": "You are a security auditor. Output findings as CWE-tagged JSON." },
    { "role": "user", "content": "<code or policy>" }
  ]
}

Authorization check (before invoking)

These models support authorized security work: pentesting engagements, CTF competitions, defensive code review, compliance, LLM safety research. Do NOT use for: credential harvesting on targets you don't own, exploit weaponization for mass campaigns, detection evasion for malicious purposes.

If the context is unclear, ask the user for the authorization context before dispatching.

Common pitfalls

• google/shieldgemma-9b reached EOL 2026-04-15. Use llama-guard (NIM) or nemotron-safety (security) instead.
• Using a NIM coding model instead of nvidia-security qwen3-coder — they're the same weights but the security MCP sets safer defaults.
• Skipping gliner-pii before shipping free-text to a general model in regulated domains (GDPR, HIPAA).
• Using llama-guard alone for full audit — it classifies, it doesn't reason about impact. Chain with nemotron-ultra.
• Picking nemotron-safety when you need justifications — use nemotron-safety-reason instead.