Retrieval (RAG)
A retrieval node queries a vector database and returns matching chunks, so a downstream agent node can answer from your documents instead of only what the model memorised.
Drop a Retrieval node on the canvas and configure it in the right-hand panel.
Supported backends
| Backend | Notes |
|---|---|
| pgvector | Postgres with the pgvector extension |
| Pinecone | Managed vector database |
| Qdrant | Self-hosted or cloud |
| Weaviate | Self-hosted or cloud |
You bring an index that already exists — the platform queries it, it doesn't build it.
Query embedding modes
The node needs a vector to search with. Two ways to get one:
backend mode
Send the raw query text and let the vector store embed it. Simplest, but only works on backends that embed server-side (pgvector and Qdrant are vector-only and require a vector).
byok mode
Embed the query yourself using your own OpenAI or Google key, then send the vector. Works with every backend.
:::warning Model must match your index
The embedding model used for the query must be the same one used to index
your documents. A text-embedding-3-small query vector searched against an
index built with text-embedding-004 returns nonsense, not an error — the
numbers are simply in different spaces.
:::
Configuration
| Setting | Behaviour |
|---|---|
| Backend | Which vector store to query |
| Connection | Endpoint and credentials — encrypted, worker-only |
| Collection / index | What to search |
| topK | How many chunks to return. Defaults to 5, clamped between 1 and 50 |
| Filter | Optional backend-native metadata filter |
Invalid topK values (zero, negative, non-numeric) fall back to the default
rather than failing the run.
Security
Retrieval connections touch your infrastructure, so they carry the same protections as data pipelines:
- Connection configs are AES-256-GCM encrypted and decrypted only inside the worker
- Outbound hosts are SSRF-guarded — localhost, private ranges and the cloud metadata endpoint are blocked
- Requests time out after 30 seconds
- Endpoints and keys never appear in logs or error messages
Grounding an agent on the results
Connect the retrieval node's output into an agent node. The retrieved chunks become available to that node, and your prompt should tell the model to answer from them.
A typical shape:
Input → Retrieval → Agent → Output
Retrieved content is untrusted text. If your documents can be edited by
someone else, a document can carry instructions aimed at your agent — the
indirect prompt injection path. Run a security scan;
static.injection.indirect_tool_feedback exists for exactly this.