AI red teaming & LLM evaluation
promptmap is an open-source prompt injection scanner from utkusen. It is released under the GPL-3.0 license and is offered as: CLI, Self-hosted.
Best for
promptmap answers a narrow question: does the system prompt behind your own LLM app hold up against injection? First released in 2023 and rewritten in 2025, it takes either the system prompt and model (white-box) or a YAML description of an HTTP endpoint (black-box) and fires more than 50 YAML rules in six categories, from distraction and prompt stealing to jailbreak, hate and bias. A second LLM, the controller, judges each reply. The README warns that a weak controller gives false positives and negatives, so results are only as good as the judge model you pay for. A firewall mode checks a guard LLM placed in front of your main model. Spikee adds multi-turn attacks and payload plugins that this README does not list, and garak covers more risk types. GPL-3.0, with no tagged releases.
This summary is our own wording of the sourced facts on this page.
Each value links to the page that states it, with the date we checked it.
As documented by the vendor or project. The tag is our label from a controlled vocabulary.
Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.
| Layer | Role | How it applies | Based on |
|---|---|---|---|
| L4 Testing Testing and red teaming | Primary | Attack and evaluate models, apps and agents on purpose, before release and after every change, to find what the other layers miss. | Follows its category, AI red teaming & LLM evaluation |
The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.
| Risk | How it applies | Based on |
|---|---|---|
| LLM01 Prompt Injection | Runs prompt injection and jailbreak rules against a target application. | Scans custom LLM applications for prompt injection, including distraction rules; Includes jailbreak rules; Firewall mode tests a guard LLM placed in front of the primary model against the same rules, with a pass condition you set |
| LLM07 System Prompt Leakage | Runs prompt stealing rules that try to extract the system prompt. | Includes prompt stealing rules that try to extract the system prompt |
More in AI red teaming & LLM evaluation, ranked within the category by Coverage Score.
NVIDIA
Probes language models and LLM apps for prompt injection, jailbreaks, data leakage and more.
Best for: Teams that want a free command-line scanner they can point at any model or LLM endpoint before release
Reviewed
Giskard AI
Generates adversarial test suites for LLM agents and RAG apps, runs them and reports failures by threat type.
Best for: Python teams that want a free library to scan an LLM agent or RAG app for prompt injection and harmful output, and to write pass or fail checks for it
Reviewed
OpenAI (Promptfoo)
Runs evals and red team scans against LLM apps from a CLI or CI pipeline and writes a vulnerability report.
Best for: Developer teams that want one open-source CLI for both prompt evals and red teaming, run locally and in CI
Reviewed
Yes. promptmap is released under the GPL-3.0 license, and the code is on GitHub at utkusen/promptmap.
The README lists six rule categories: distraction, prompt stealing, jailbreak, harmful content, hate and social bias, with more than 50 pre-built rules.
A separate controller LLM analyzes the target's responses and judges each attack against pass and fail conditions written in the YAML rule. The README warns that weaker controller models can give false positives or negatives, so use a strong model as the controller.
Yes. Firewall mode sends the rules to a guard LLM placed in front of your primary model, with a pass condition you set, so you can see which attacks the firewall lets through. Each attack is tried three times by default.
promptmap is released under the GPL-3.0 license.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
promptmap is offered as: CLI, Self-hosted.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
Pricing model for promptmap: Free.
Source Source, checked October 21, 2026: github.com (opens in a new tab) Checked
promptmap had 1,288 GitHub stars on October 21, 2026.
Source Source, checked October 21, 2026: api.github.com (opens in a new tab) Checked
We have no commercial relationship with utkusen.