AI red teaming & LLM evaluation
Promptfoo is an open-source LLM eval and red teaming tool from OpenAI. It is released under the MIT license and is offered as: CLI, Library, Self-hosted, SaaS, On-prem.
Best for
Developer teams that want one open-source CLI for both prompt evals and red teaming, run locally and in CI
Ownership
Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI. OpenAI's developer documentation now says Promptfoo is part of OpenAI; we found no published closing date. Source, checked October 21, 2026: promptfoo.dev (opens in a new tab)
Consider instead if
Promptfoo is a command-line tool and library for evaluating and red teaming apps built on language models. You describe a red team run in a config file, point it at a target, and read the results in a report view. The red team quickstart says it scans for more than 50 vulnerability types, including jailbreaks and injections, and reports severity levels and suggested mitigations. A GitHub Action runs evals on pull requests. The Community plan is free, while the Enterprise and On-Premise plans have custom pricing. The code is MIT licensed. Promptfoo announced in March 2026 that it had agreed to be acquired by OpenAI, and OpenAI's developer docs now say Promptfoo is part of OpenAI.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L4 Testing Testing and red teaming | Primary | Attack and evaluate models, apps and agents on purpose, before release and after every change, to find what the other layers miss. | Follows its category, AI red teaming & LLM evaluation |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM01 Prompt Injection | Scans a target for jailbreaks and injections as part of its red team run. | Scans for jailbreaks among more than 50 vulnerability types; Scans for injections among more than 50 vulnerability types |
| LLM02 Sensitive Information Disclosure | Documents plugins that test whether a target reveals PII, directly, across sessions, through social engineering or through API and database access. | Provides plugins that test for PII leakage: direct, across sessions, through social engineering and through API or database access |
| LLM09 Misinformation | Documents hallucination and overreliance plugins that test a target for misinformation. | Provides hallucination and overreliance plugins that test for misinformation |
More in AI red teaming & LLM evaluation, ranked within the category by Coverage Score.
NVIDIA
Probes language models and LLM apps for prompt injection, jailbreaks, data leakage and more.
Best for: Teams that want a free command-line scanner they can point at any model or LLM endpoint before release
Reviewed
Giskard AI
Generates adversarial test suites for LLM agents and RAG apps, runs them and reports failures by threat type.
Best for: Python teams that want a free library to scan an LLM agent or RAG app for prompt injection and harmful output, and to write pass or fail checks for it
Reviewed
Praetorian
Single-binary Go scanner that runs jailbreak, prompt injection and other attack probes against LLMs.
Best for: Security teams that want a free single-binary scanner to probe models and LLM endpoints with jailbreaks, prompt injection and multi-turn attacks
Reviewed
Yes. Promptfoo is released under the MIT License, and the code is on GitHub at promptfoo/promptfoo. Its Community plan is free.
Yes, according to OpenAI. OpenAI's developer documentation says Promptfoo is part of OpenAI, and the project's README banner says the same. Promptfoo announced on March 9, 2026 that it had agreed to be acquired by OpenAI, and no page we opened gives a closing date.
Its pricing page lists a free Community plan with 10k red teaming probes per month, and custom pricing for Enterprise and On-Premise plans.
Promptfoo is released under the MIT license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Promptfoo is offered as: CLI, Library, Self-hosted, SaaS, On-prem.
Source Source, checked October 21, 2026: promptfoo.dev (opens in a new tab) Checked
Pricing model for Promptfoo: Freemium: Community: Free Forever, with red teaming at 10k probes per month. Enterprise: Custom, with managed cloud deployment. On-Premise: Custom, deployed on your own infrastructure..
Source Source, checked October 21, 2026: promptfoo.dev (opens in a new tab) Checked
Latest release of Promptfoo: October 8, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with OpenAI (Promptfoo).