Two tools, one table: license, deployment, pricing model, capabilities and OWASP coverage, with the source and date for every cell. Each page says where each tool is stronger.
Teams on AWS and Azure each get a native service that screens prompts and responses for harmful content and prompt attacks, and the safeguards differ. Bedrock Guardrails bundles content filters, denied topics, PII filters, grounding checks and Automated Reasoning checks, and can be called without invoking a model. Azure AI Content Safety offers Prompt Shields, groundedness detection, protected material detection and a task adherence API for agents.
DeepTeam and Promptfoo both attack LLM apps with jailbreaks and prompt injection; the decision is whether your red teaming lives in Python code or in a config file and CLI that also runs evals on pull requests. DeepTeam, from Confident AI, is a Python framework you call from code or a YAML config. Promptfoo is a Node.js CLI and library driven by promptfooconfig.yaml, with a documented GitHub Action.
Choosing between garak and PyRIT decides whether your LLM red teaming starts from a ready-made probe library on the command line or from attack code your team writes in Python. Both are free, open source and ship multi-turn attacks. garak picks detectors for each probe and writes report and hit logs; PyRIT adds configurable scorers, a results database, a local web app for human-led testing and Playwright targets for web apps.
On Google Cloud, Model Armor screens prompts and responses inside your project with templates and project-wide floor settings; Lakera Guard is a hosted API, also offered self-hosted, that adds system prompt leakage and agent tool defenses. Both are closed source and screen for attacks, sensitive data and harmful content. Lakera's docs now carry the Check Point AI Guardrails name.
LLM Guard's README says the project is archived and no longer maintained, so teams that screen LLM traffic with it will get no fixes or new scanners from the project. NeMo Guardrails is a free, open-source Python toolkit whose repository is not archived. This page compares what each documents and what a move from one to the other involves.
A pickle model file can run code the moment it is loaded, as the ModelScan README warns, and ModelScan and Fickling both check such files without loading them. ModelScan reads several model formats, including H5 and SavedModel, and ranks findings by severity. Fickling decompiles and statically analyzes pickle data and adds a runtime import check that can block a load.
Choosing between NeMo Guardrails and Guardrails AI decides where your LLM checks live: in rails around the whole application, or in validators wrapped around each model call. Both are free Apache-2.0 Python projects. NeMo Guardrails scripts input, retrieval, dialog, execution and output rails, with dialog flows in Colang; Guardrails AI combines Hub validators into guards and can return structured output.
To red team a deployed LLM application on every pull request, Promptfoo fits the job; for a quick probe scan of a model or REST endpoint from the command line, garak does. Both are open source and test for jailbreaks and prompt injection. Promptfoo is a Node.js CLI and library driven by a config file that also runs evals; garak is a Python package that runs a library of probes from command-line flags.
Last reviewed
We publish a comparison only when both tools have enough sourced facts and share a category. Looking for a shortlist instead?
Read our guides or browse all tools.
Your privacy choices
We may use analytics and, later, show ads. They stay off until you choose, wherever you are. Declining
never limits what you can read. See our privacy policy and
cookie policy.
Privacy settings
Choose what you allow. Your choice is stored on this device for 13 months. You can change it later from the
"Privacy choices" link in the footer.
