What it is
garak is a command-line scanner that checks whether a language model or chat system can be made to fail in ways you do not want. Its 45 probe modules cover prompt injection, jailbreaks such as the DAN family, encoding tricks, data leakage, package hallucination, toxicity and misinformation. Detectors then judge each response, and garak reports a failure rate for every probe and detector pair. The project compares itself to nmap and Metasploit, but for LLMs.
It can target Hugging Face models, OpenAI, AWS Bedrock, Replicate, Cohere, Groq, NVIDIA NIM, llama.cpp models, anything behind LiteLLM, and almost any REST endpoint through a short YAML file. Every run writes a JSONL report with each attempt and its evaluation; release 0.17.1 added a hit@k attack success rate to that report.
garak began as an independent project and now lives in NVIDIA's GitHub organisation. It is Apache 2.0-licensed, needs Python 3.11 or later, and has had seven releases in 2026, the latest being 0.17.1 on 16 October.
Our review
garak is the most established open tool for finding out how easily a model endpoint can be pushed into known failure modes, and its output is the kind a security review accepts: a failure rate per probe and detector, backed by a JSONL log of every attempt. Its attacks come from published research, and NVIDIA's maintenance shows in the cadence, with releases roughly monthly through 2026 and about 9,700 GitHub stars.
The defaults are what new users trip over. Unless told otherwise garak runs every probe, sends each prompt five times (generations: 5 in the core config), caps each probe at a soft 256 prompts and makes requests one at a time. By our arithmetic from that config, that is up to 1,280 calls per probe and tens of thousands for a full run. Narrowing with --spec, for example to probes.promptinject or probes.dan, and switching on parallel requests is what makes a scheduled scan affordable.
Its breadth of targets is the main strength. Bedrock, NIM, LiteLLM and generic REST endpoints mean you can scan the deployed application rather than only the raw model, which matters because the system prompt and any filters in front of the model change the result.
The limits follow from its design. garak probes a text endpoint; it does not model your agent's tools, data stores or permissions, so excessive agency and tool misuse (OWASP LLM06) need PyRIT, DeepTeam or promptfoo's agent plugins. The documentation is still described as a work in progress, and a detector flag is a lead, not a confirmed vulnerability. The 0.17.1 notes list eight detector fixes, one of which stopped FileDetector scoring an unexamined file as a pass, a reminder that a scanner's scores are only as good as its detectors.
Where it earns its place
An AppSec engineer signing off a customer-facing chatbot
Show that the deployed bot resists known jailbreaks before launch
Point garak's REST generator at the staging endpoint with a short YAML file and run the dan, promptinject and encoding probes. The JSONL report gives per-probe failure rates to attach to the review; the cost is model calls, five per prompt by default.
An ML platform team moving from a hosted model to open weights on NVIDIA NIM
Check the new model has not regressed on safety
Run the same narrowed probe set against both models through their generators and compare failure rates. Free apart from inference, though a default full run is far larger than a comparison needs.
A model-risk lead at a bank preparing for an AI audit
Demonstrate a repeatable red-teaming process
Schedule a fixed garak probe set in CI on every model or system-prompt change and archive the reports. It covers model-level weaknesses only, so tool misuse and excessive agency need a separate agent-aware test.
Before you commit
- Setup
- python -m pip install -U garak (Python 3.11 or later), set the provider's API key and run, for example, garak --target_type openai --target_name <model> --spec probes.encoding. Local Hugging Face targets run on your own hardware.
- Integrations
- Generators for Hugging Face, OpenAI, Bedrock (Converse API), Replicate, Cohere, Groq, NVIDIA NIM, llama.cpp, LiteLLM, WebSocket and any REST endpoint via YAML; JSONL reports plus an analyse_log.py script that lists the prompts with the most hits.
- Data and privacy
- Prompts and responses go only to the target you configure; reports and logs stay local in garak_runs. Apache 2.0 allows commercial use, the README describes no telemetry, and no GitHub security advisories have been published.
- Cost at scale
- The tool is free; spend is inference. Five generations and a 256-prompt soft cap per probe mean up to 1,280 calls per probe, so an unnarrowed run across 45 probe modules can reach tens of thousands of calls.
- Limits
- Single-endpoint text focus with no model of agent tools or permissions; requests are sequential unless parallel_requests is set; 287 open issues; detector accuracy is still being fixed release by release.
What's good
- 45 probe modules of published attacks in one CLI
- Scans almost any endpoint, including REST and LiteLLM
- Per-probe failure rates in a JSONL report
- Apache 2.0 with roughly monthly releases
What's not
- Tests text endpoints, not agent tools or permissions
- Default full runs make tens of thousands of calls
- Detector hits need manual triage
- Docs still incomplete
Best for
Teams that want a repeatable, model-level vulnerability scan of an LLM endpoint before launch and after every model change.
Alternatives
garak: common questions
- Is garak worth it?
- The standard open scanner for model-level weaknesses: run it before launch and after every model swap, but do not mistake it for a test of your agent's tools and permissions. We rate it 4.3 out of 5.
- How much does garak cost?
- Free and open source under Apache 2.0. You pay only for the model calls a scan makes.
- What are the downsides of garak?
- Tests text endpoints, not agent tools or permissions; default full runs make tens of thousands of calls; detector hits need manual triage; docs still incomplete.
- Who is garak best for?
- Teams that want a repeatable, model-level vulnerability scan of an LLM endpoint before launch and after every model change.
- How much does garak cost for a team or in production?
- The tool is free; spend is inference. Five generations and a 256-prompt soft cap per probe mean up to 1,280 calls per probe, so an unnarrowed run across 45 probe modules can reach tens of thousands of calls.
- Is garak safe for company data?
- Prompts and responses go only to the target you configure; reports and logs stay local in garak_runs. Apache 2.0 allows commercial use, the README describes no telemetry, and no GitHub security advisories have been published.
- What are the best garak alternatives?
- The closest alternatives we have reviewed are PyRIT, DeepTeam and promptfoo.
Answers checked Oct 23, 2026.
Make garak? Show this rating on your site
