# ShinrAI for Open WebUI Connect Open WebUI to the customer-run ShinrAI relay. A mandatory global filter checks every outgoing model call after retrieval context and tool definitions have been assembled. The relay protects the request before invoking your model provider. Source and connector license: MIT. Direct installation is available; this package is not listed in a marketplace. Tested application: Open WebUI **0.11.3**, including its supported `request` hook. The reference installation uses cached local MiniLM embeddings. Automated tests cover both reply modes, streaming, five document fixtures, local indexing, malformed-file rejection, and real browser retrieval with citations. Full release acceptance is tracked separately in the QA report. ## Install 1. Download and unpack the ShinrAI Open WebUI bundle. Enter its `open-webui` directory; keep the sibling `python` directory beside it. Copy `.env.example` to `.env` and restrict it to the server administrator. 2. Enter your ShinrAI service URL and API key. Enter the upstream model URL, model name and credential in the relay settings. Generate independent random values for `RELAY_API_KEY` and `WEBUI_SECRET_KEY` (at least 32 characters each). Set a private administrator email/password and your application's URL. 3. Run `docker compose up -d --build` in the unpacked directory. Place the application behind your authenticated HTTPS ingress when used outside a trusted local network. Only the application port is published; the relay remains internal. 4. Sign into Open WebUI. Open **Admin Panel → Functions → Import**, and import `shinrai-filter.json`. Enable the function and mark it **Global**. It has no end-user toggle. Its Relay URL must match the OpenAI connection, normally `http://shinrai-relay:8080/v1`. 5. In **Admin Panel → Settings → Connections**, keep the single relay connection with its separate relay key. Open `/shinrai/` as administrator and select **Enable protected models for users**. This registers the two original model IDs and grants read access to signed-in users. Administrators may then restrict access to selected users/groups in **Admin Panel → Settings → Models**. Without this step, Open WebUI 0.11.3 exposes unregistered models only to administrators. Expose only `shinrai-private` and `shinrai-restored`. Disable direct connections, Ollama, arena models and alternate model routes. Use these original models; workspace model overrides are rejected by the filter. Keep the ShinrAI filter last if you install other request filters. 6. Keep local storage, local content extraction and local embeddings. The document adapter refuses uploads if these settings select an external processor. 7. Open `/shinrai/` on your Open WebUI site. Select **Test connection and protection**. The example name and email must be replaced. In chat, ask a protected model to repeat `max.mustermann@example.org`; private mode returns a replacement, restored mode returns the original recognized value. 8. Upload a synthetic TXT, PDF or DOCX through the normal chat upload control. Open WebUI indexes protected extracted text. Its protected PDF copy is available under `/shinrai/` for 24 hours. Download it and check the result before using your own content. You can install just `shinrai_filter.py` into an existing Open WebUI 0.11.3 deployment and configure the relay manually. The packaged application image adds protected document ingestion and the download page; importing the filter alone does not add these upload features. Back up existing application data before changing images, keep a persistent `WEBUI_SECRET_KEY`, and restore the prior image/data together to roll back. ## Coverage - Relay protection covers messages, retrieved context, supported textual tool definitions, tool arguments/results and subsequent calls. Numeric schema defaults and protocol identifiers remain structural settings; numeric runtime values are protected or rejected if their types cannot be preserved. Unsupported image/audio/file model payloads stop with an error. - **Retain pseudonyms** keeps replacements in replies. **Restore recognized values** restores only replacements recognized for that model request, inside your relay. Restoration maps never become model input. Documents uploaded through the adapter are already protected; their original-bearing restoration maps are not retained, so their original identities are not restored in chat. - Your Open WebUI server receives what users type, and its chat interface may retain a locally selected original filename. These are inside your environment. The upload adapter sends the original document to ShinrAI for protection, then stores/indexes only protected text with a generated filename. It discards multipart metadata. Set `SHINRAI_RELAY_PROTOCOL=openwebui` on the relay. This mode removes generated attachment/source names from outgoing context and preserves only validated resource IDs and fixed protocol attributes. Unknown retrieval metadata stops the request. - TXT, PDF and DOCX: 10 MB, 100 pages, 125,000 extracted characters, five-minute processing deadline. Documents containing scans or embedded images pass through ShinrAI's isolated OCR worker. PDF copies are flattened, not editable originals. Unsupported or incomplete files are rejected. - PDF downloads require the current Open WebUI account. Copies are encrypted locally, expire after 24 hours, and can be deleted with authenticated `POST /shinrai/documents/{id}/delete`. Deleting a PDF copy does not delete the separately indexed protected text or its chat; manage those through Open WebUI Files/Knowledge. The original file on the user's device remains unchanged. - New uploads through `/api/v1/files/` are covered. Existing libraries, direct storage imports, external connectors, image/audio services and arbitrary installed plugin network calls are not rewritten by the upload adapter. Keep external embeddings and ancillary external processors disabled in this reference configuration. ## Troubleshooting A protection error stops the affected model call or upload. Check the ShinrAI key, allowance, service URL, and relay connection. An unsupported-field error means that a model/plugin introduced an untested payload; do not configure an unprotected fallback. A missing PDF copy means it expired, was deleted, or belongs to another account. After restoring an application backup, retain the matching secret key so encrypted copies remain readable. Upload concurrency is capped at four; retry a busy upload once earlier documents complete. Detection is probabilistic. Use the synthetic demonstration and inspect representative results for your data types; the connector does not claim to detect every possible sensitive value. References: [Open WebUI request filter](https://docs.openwebui.com/features/extensibility/plugin/functions/filter/), [0.11.3 source](https://github.com/open-webui/open-webui/tree/v0.11.3). ## Validated example The [screenshots](screenshots/) show the actual installed test application with synthetic data. Replacement values vary between runs. The download includes shared example documents and an executable connection test in `../fixtures/`.