Step 19 of 22
Security & red-teaming
Attack your own system before someone else does, and scan what it ships. AI apps add new attack surfaces: prompt injection, leaky tools, poisoned dependencies and AI-written code. Test them like any other software.
How to choose
- Red-team prompts and agents before launch, and again after every model change.
- Scan dependencies and AI-written code in the same pipeline as the rest of your code.
- Pin versions of gateways and SDKs; supply-chain attacks have hit popular AI packages.
What to look for
The questions that separate the options, in order of how much they matter.
01
Coverage mapped to the OWASP Top 10 for LLMs
The OWASP Top 10 for LLM Applications (2025 edition) is the common checklist: prompt injection, sensitive information disclosure, supply chain, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation and unbounded consumption. Ask which items a tool actually tests. DeepTeam ships an OWASP preset; garak covers the model-level items well but not excessive agency; no single tool covers all ten.
02
Automated and multi-turn attack generation
A fixed list of known jailbreaks finds old weaknesses; attacks generated against your system find new ones. PyRIT's Crescendo and TAP escalate over several turns with an attacker model steering, DeepTeam and promptfoo generate attacks with an LLM, and garak runs a large library of published probes. Generated attacks cost tokens on both sides, so budget for them.
03
Agent and tool risks, not just the model
Once a model can call tools, the dangerous failures are excessive agency, broken authorisation and injected instructions in tool output. Test the deployed agent with its real tools (DeepTeam's BOLA, BFLA and tool-poisoning checks, promptfoo's unsafe-tool-use tests, PyRIT against a live endpoint), and review the permissions each MCP server and tool is given; least privilege matters more than any scanner.
04
Supply chain: pin and scan what you install
AI packages are now targets. In March 2026 attackers published two poisoned LiteLLM releases to PyPI using stolen maintainer credentials. Pin exact versions and hashes for gateways and SDKs, update deliberately, and scan dependencies and AI-written code in the same pipeline as the rest of your code. Scan MCP servers and agent skills too: Snyk Agent Scan checks tool descriptions and skills for poisoning and hidden instructions.
05
CI integration and repeatability
Red teaming once before launch is not enough; re-run after every model, prompt or tool change. promptfoo is built for CI with YAML configs; garak and Snyk Agent Scan are CLIs with machine-readable output you can script; PyRIT and DeepTeam are Python libraries you wrap yourself. Fix a seed set of attacks so results are comparable run to run.
06
How findings are judged
Most tools decide pass or fail with an LLM judge or a detector, and both make mistakes. Check whether you can see the full transcript behind each finding, change the judge model and re-score stored results. PyRIT keeps every conversation in a database for re-scoring; garak writes a JSONL log of every attempt. Treat a flagged result as a lead to confirm, not a confirmed vulnerability.
07
Licence and data handling
All the red-teaming tools here are open source (MIT or Apache 2.0) and run locally, sending attack traffic only to the model you point them at. Snyk Agent Scan is the exception: it sends tool descriptions and skill content to Snyk's API for analysis. Confident AI's hosted platform, an optional add-on to DeepTeam, stores results with the vendor.
How the options differ
Security tools for AI apps split by what they attack. Vulnerability scanners (garak) fire a large library of known attacks at a model endpoint and report failure rates; they are quick, repeatable and good after a model swap. Red-teaming frameworks (PyRIT, DeepTeam, promptfoo's red-team mode) generate attacks against your application, including multi-turn escalation and agent-specific abuse of tools and permissions, and suit pre-launch reviews and CI. Evaluation harnesses with a safety focus (Inspect) let you build rigorous custom evaluations of agent behaviour in sandboxes. Supply-chain scanners (Snyk Agent Scan) check the MCP servers and skills your agents trust rather than the model.
Gateways such as LiteLLM appear in this stage only as something to secure: pin their versions and watch their advisories. They are not security tools and are left out of the comparison below.
14 tools, compared
Ranked by our rating. Open any review for sources, prices and the full verdict.
| Tool | Rating | Our verdict | Best for | Price |
|---|---|---|---|---|
| promptfoorepo | 4.5/5 | promptfoo turns LLM regression tests and red-team scans into a YAML file and one CI command; its new owner is the part to watch. | Teams shipping LLM apps who want regression tests and security scans in CI. | CLI free and open source (MIT); Community use includes red teaming up to 10,000 probes a month. Enterprise (managed cloud) and On-Premise are priced by quote. |
| Inspectrepo | 4.4/5 | Inspect is the shared harness of government and independent AI safety testing; product teams checking prompts in CI will find it more framework than they need. | Researchers and safety teams running agent and capability evaluations. | Free and open source under the MIT license. |
| Anthropic Sandbox Runtime (srt)repo | 4.4/5 | Your coding agent can be talked into anything; the operating system can't, and srt puts the operating system in charge. | Every developer running a coding agent on their own machine, as the first layer of protection. | Free and open source under Apache 2.0. |
| Trail of Bits Skillsrepo | 4.4/5 | A generic "check for OWASP issues" prompt is a guess; this is how a working audit firm actually looks for bugs, written down for your agent. | Teams that want structured, credible security review from their coding agent before risky merges. | Free under CC BY-SA 4.0. |
| garakrepo | 4.3/5 | The standard open scanner for model-level weaknesses: run it before launch and after every model swap, but do not mistake it for a test of your agent's tools and permissions. | Teams that want a repeatable, model-level vulnerability scan of an LLM endpoint before launch and after every model change. | Free and open source under Apache 2.0. You pay only for the model calls a scan makes. |
| PyRITrepo | 4.2/5 | PyRIT automates the slow, escalating conversations that break chatbots, provided someone on the team will write the Python that drives it. | Security engineers who need to red-team chatbots and agents in depth, including multi-turn escalation and web front ends. | Free and open source under MIT. You pay for the model calls used by attacks and LLM-based scorers. |
| security-guidance plugin (Claude Code)repo | 4.2/5 | For a Claude Code user this is a one-command security win, with a reviewer that is not grading its own homework. | Claude Code users who want security review on every change without setting anything up. | Free plugin under Apache 2.0; the two model-backed reviews use your Claude or API usage. |
| NVIDIA OpenShellrepo | 4.1/5 | A heavyweight agent sandbox built for agents you leave running unattended, not ones you sit and watch. | Teams running agents unattended or on untrusted code who need per-host and per-method network rules. | Free and open source under Apache 2.0. |
| ToolHiverepo | 4.1/5 | Scanners tell you whether an MCP server looks dangerous; ToolHive limits what it can do if it is. | Platform and security teams that need to run, contain and audit MCP servers across a company. | Open source under Apache 2.0; Stacklok Enterprise adds features and support, priced on request. |
| CC Safety Netrepo | 4.0/5 | The seatbelt for the damage a sandbox allows on purpose: force-pushes, hard resets and rm -rf inside your own project. | Anyone letting a coding agent run shell commands without approving each one. | Free and open source under MIT. |
| DeepTeamrepo | 3.9/5 | The broadest catalogue of agent and application vulnerabilities in an open red-teaming library, but every verdict rests on an LLM judge you will need to check. | Python teams building agents who want OWASP-mapped red-team coverage they can run locally. | Free and open source under Apache 2.0. Confident AI's platform runs from a free tier to $200 and $2,000 a month; its red-teaming module is an Enterprise add-on at custom pricing. |
| Cloudflare Security Audit Skillrepo | 3.9/5 | The rare AI audit tool that assumes its own findings are wrong until another agent fails to knock them down. | Security teams auditing a codebase who want verified findings rather than a long list of maybes. | Free under MIT; audits use a lot of model tokens. |
| Snyk Agent Scanrepo | 3.8/5 | A sensible first check on the MCP servers and skills your agents trust, provided you accept sending their descriptions to Snyk and scan untrusted configs in a sandbox. | Teams that let developers or agents install MCP servers and skills and want a supply-chain check before trusting them. | Free and open source under Apache 2.0; needs a Snyk account and API token. Fleet-wide background scanning reports into Snyk Evo, priced on request. |
| Cisco Skill Scannerrepo | 3.7/5 | Worth putting in front of your skills repo, as long as you believe its own numbers: it catches the obvious, not everything. | Teams running an internal skills repository who want a scan gate before anything reaches developers. | Free under Apache 2.0; optional LLM and cloud analysers bill through their own providers. |
Side by side
The specifications that matter for this step. Checked 2026-10-19; confirm on the vendor’s site before you commit.
| Tool | Focus | Attack generation | Interface | CI fit | Licence |
|---|---|---|---|---|---|
| promptfoo | App red-teaming and regression tests | Generated injection, jailbreak, leaks | CLI + YAML | Built for CI | MIT |
| Inspect | Agent and safety evaluations | You write tasks; evals collection | Python | Not published | MIT |
| garak | Model and endpoint vulnerability scan | Library of published probes | CLI | Scriptable; JSONL report | Apache 2.0 |
| PyRIT | Multi-turn red teaming | Crescendo, TAP, Skeleton Key | Python, CLI, web UI | Scriptable via pyrit_scan | MIT |
| DeepTeam | Agent and app vulnerabilities | 20+ methods, LLM-generated | Python | Not documented | Apache 2.0 |
| Snyk Agent Scan | MCP server and skill supply chain | None; scans tool descriptions | CLI (uvx or binary) | Output still experimental | Apache 2.0 |
Connect it to your agent
MCP servers that let assistants like Claude, ChatGPT and Cursor use these tools directly.
Where this stage fits
- Chat with your documents: we would start with promptfoo.
- Customer support agent: we would start with promptfoo.
- Coding agent: we would start with Snyk MCP Server (Snyk Studio), promptfoo.
- Assistant with long-term memory: we would start with promptfoo.
- Voice agent: we would start with promptfoo.
- Document processing: we would start with Snyk MCP Server (Snyk Studio).
- Your own fine-tuned model: we would start with promptfoo.