AI Defense Stack

AI red teaming & LLM evaluation

garak: open-source LLM vulnerability scanner

garak is an open-source LLM vulnerability scanner from NVIDIA. It is released under the Apache-2.0 license and is offered as: CLI, Library, Self-hosted.

  • Last reviewed
Visit garak (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Layer 4: Testing and red teaming

Best for

Teams that want a free command-line scanner they can point at any model or LLM endpoint before release

Consider instead if

What garak does

garak is a command-line scanner that tests language models for weaknesses. You point it at a model or an endpoint, it runs a library of probes, and it reports which attempts passed and which failed. The README lists probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation and jailbreaks. It installs as a Python package, connects to many hosted and local model types, and writes log files you can review afterwards. The code lives in NVIDIA's GitHub organization under the Apache-2.0 license, so it costs nothing to run. It is a scanner you run against a target, not a filter that sits in front of a live application.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
NVIDIA Source, checked October 21, 2026: github.com (opens in a new tab)
Status
Active Source, checked October 21, 2026: api.github.com (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
9,636 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 16, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, Library, Self-hosted Source, checked October 21, 2026: docs.garak.ai (opens in a new tab)
Pricing model
Free Source, checked October 21, 2026: github.com (opens in a new tab)
Website
garak.ai Source, checked October 21, 2026: garak.ai (opens in a new tab)
Documentation
docs.garak.ai Source, checked October 21, 2026: docs.garak.ai (opens in a new tab)
API reference
reference.garak.ai Source, checked October 21, 2026: reference.garak.ai (opens in a new tab)
Quickstart
docs.garak.ai Source, checked October 21, 2026: docs.garak.ai (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
Vulnerability reports are handled through NVIDIA PSIRT under a coordinated disclosure policy Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where garak fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that garak covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L4 Testing Testing and red teaming Primary Attack and evaluate models, apps and agents on purpose, before release and after every change, to find what the other layers miss. Follows its category, AI red teaming & LLM evaluation

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to garak, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Runs prompt injection and jailbreak probes against a target model. Probes for prompt injection; Probes for jailbreaks
LLM02 Sensitive Information Disclosure Runs data leakage probes against a target model. Probes for data leakage
LLM09 Misinformation Runs hallucination and misinformation probes against a target model. Probes for hallucination and misinformation

Not mapped in our analysis: LLM05, LLM06, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in AI red teaming & LLM evaluation, ranked within the category by Coverage Score.

Giskard

Giskard AI

Open sourceApache-2.0 Freemium
  • Library
  • Self-hosted
  • SaaS
  • On-prem

Generates adversarial test suites for LLM agents and RAG apps, runs them and reports failures by threat type.

Best for: Python teams that want a free library to scan an LLM agent or RAG app for prompt injection and harmful output, and to write pass or fail checks for it

Coverage Score 81 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM09 Misinformation

Reviewed

Promptfoo

OpenAI (Promptfoo)

Open sourceMIT Freemium
  • CLI
  • Library
  • Self-hosted
  • SaaS
  • On-prem

Runs evals and red team scans against LLM apps from a CLI or CI pipeline and writes a vulnerability report.

Best for: Developer teams that want one open-source CLI for both prompt evals and red teaming, run locally and in CI

Coverage Score 80 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM09 Misinformation

Reviewed

Augustus

Praetorian

Open sourceApache-2.0
  • CLI
  • Self-hosted

Single-binary Go scanner that runs jailbreak, prompt injection and other attack probes against LLMs.

Best for: Security teams that want a free single-binary scanner to probe models and LLM endpoints with jailbreaks, prompt injection and multi-turn attacks

Coverage Score 75 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure

Reviewed

Head-to-head comparisons

garak FAQ

Is garak open source?

Yes. garak is released under the Apache-2.0 license, and the code is on GitHub at NVIDIA/garak.

What does garak probe for?

The README lists hallucination, data leakage, prompt injection, misinformation, toxicity generation and jailbreaks, among other weaknesses.

Which models can garak scan?

The README lists Hugging Face Hub models, the OpenAI API, AWS Bedrock and LiteLLM among its supported targets, along with other generators.

Key facts you can cite

We have no commercial relationship with NVIDIA.

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.