Category
Red teaming tools attack your model, app or agent on purpose, from command-line scanners and attack frameworks to evaluation harnesses and managed services. A prompt injection or data leak that nobody probed for ships with the release, so these tools make it show up first.
Part of layer 4 in our AI security layers: Testing and red teaming. 9 tools from other categories also cover this layer.
The highest Coverage Scores in this category. The score measures what each vendor documents publicly; it is not an endorsement and it does not measure detection quality.
NVIDIA
Probes language models and LLM apps for prompt injection, jailbreaks, data leakage and more.
Best for: Teams that want a free command-line scanner they can point at any model or LLM endpoint before release
Reviewed
Giskard AI
Generates adversarial test suites for LLM agents and RAG apps, runs them and reports failures by threat type.
Best for: Python teams that want a free library to scan an LLM agent or RAG app for prompt injection and harmful output, and to write pass or fail checks for it
Reviewed
OpenAI (Promptfoo)
Runs evals and red team scans against LLM apps from a CLI or CI pipeline and writes a vulnerability report.
Best for: Developer teams that want one open-source CLI for both prompt evals and red teaming, run locally and in CI
Reviewed
Sorted by Coverage Score within the category. Tools cross-listed from another category carry an "Also covers" label.
| Tool | Type | Deployment | Pricing model | OWASP risks | Coverage Score | Last reviewed |
|---|---|---|---|---|---|---|
| garakNVIDIA | Open sourceApache-2.0 |
| Free |
| 82 out of 100 | |
| GiskardGiskard AI | Open sourceApache-2.0 |
| Freemium |
| 81 out of 100 | |
| PromptfooOpenAI (Promptfoo) | Open sourceMIT |
| Freemium |
| 80 out of 100 | |
| AugustusPraetorian | Open sourceApache-2.0 |
| Free |
| 75 out of 100 | |
| PyRITMicrosoft | Open sourceMIT |
| Free |
| 73 out of 100 | |
| Agentic RadarZscaler (SPLX) | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| DeepTeamConfident AI | Open sourceApache-2.0 |
| Free |
| 71 out of 100 | |
| SpikeeReversec | Open sourceApache-2.0 |
| Free |
| 69 out of 100 | |
| InspectUK AI Security Institute | Open sourceMIT |
| Free | None mapped | 64 out of 100 | |
| FuzzyAIPalo Alto Networks (CyberArk) | Open sourceApache-2.0 |
| Free |
| 61 out of 100 | |
| Agentic Securitymsoedov (open-source maintainer) | Open sourceApache-2.0 |
| Free |
| 60 out of 100 | |
| MindgardMindgard | Commercial |
| Not published |
| 59 out of 100 | |
| promptmaputkusen | Open sourceGPL-3.0 |
| Free |
| 56 out of 100 | |
| ARTLF AI & Data Foundation | Open sourceMIT |
| Free |
| 55 out of 100 | |
| AI Red Teaming AgentMicrosoft | Commercial |
| Usage-based |
| 53 out of 100 | |
| b3 benchmarkCheck Point (Lakera) and UK AI Security Institute | Open sourceMIT |
| Free |
| 53 out of 100 | |
| Gray SwanGray Swan | Commercial |
| Not published |
| 52 out of 100 | |
| SPLXZscaler (SPLX) | Commercial |
| Contact sales |
| 51 out of 100 | |
| Adversa AIAdversa AI | Commercial |
| Not published |
| 50 out of 100 | |
| TextAttackQData | Open sourceMIT |
| Free | None mapped | 49 out of 100 | |
| Enkrypt AIAnaconda (Enkrypt AI) | Commercial |
| Freemium | None mapped | 47 out of 100 | |
| Lakera RedCheck Point (Lakera) | Commercial |
| Contact sales |
| 45 out of 100 | |
| HarmBenchCenter for AI Safety | Open sourceMIT |
| Free | None mapped | 42 out of 100 | |
| Repello AIRepello AI | Commercial |
| Not published |
| 31 out of 100 |
No tools match these filters. Clear a filter to see more.
Risk coverage is 25 of 100 Coverage Score points. A tool earns them only for risks mapped to a capability the sources document.
Choose by what you test and how often. Scanners fire a library of probes at a target, attack frameworks orchestrate multi-step attacks you script, evaluation harnesses run structured checks and score the results, and managed services send an outside team.
A scanner shows that a probe worked or failed on the day you ran it. Microsoft's guidance on planning LLM red teaming says red teaming is not a replacement for systematic measurement and mitigation work and recommends an initial round of manual red teaming before systematic measurement. Run the checks again after every change to the model, the prompt or the tools.
A scanner runs a fixed library of probes against a target and reports what worked. A framework gives you building blocks to orchestrate and score attacks, so you write more of the logic yourself. A scanner suits repeatable checks in CI; a framework suits attacks built around your own app.
No. Microsoft's guidance on planning LLM red teaming says red teaming does not replace systematic measurement and mitigation work, and it recommends an initial round of manual red teaming to learn the risk surface. Automated tools add repeatability and coverage.
Both. Microsoft's guidance suggests testing the base model with its safety system in place to find gaps, and testing your application through its user interface, because that most closely resembles real use.
Some list a command-line interface or a CI integration. Look for the CI integration capability on each tool page, and open the sources behind it to confirm the details for your pipeline.
In our scoring they are weighed on LLM01, LLM02, LLM05, LLM06, LLM07 and LLM09. Each tool page shows which of these it maps to and which documented capability supports the mapping. The mapping is our analysis.
No. The Coverage Score measures how much a vendor documents publicly. It says nothing about how many vulnerabilities a tool finds, how many false alarms it raises or how fast it runs.