Promptfoo is an AI security platform for uncovering weaknesses in LLM-powered applications while they are still in code, before they ship. Automated red teaming (simulated attacks) surfaces prompt injection, jailbreaks, and sensitive data leaks, and the same tool also evaluates the quality of prompts, models, and RAG pipelines. You can get started from the CLI in a few lines with something like npx promptfoo@latest init, and the core is open source under the MIT license. The GitHub repository has over 24,000 stars and the tool is used inside Fortune 500 companies. In March 2026 OpenAI announced its acquisition of Promptfoo, stating that the open source edition will remain available under its current license.
Key Features
- Automated red teaming: Generates large volumes of attack-like inputs to detect prompt injection, jailbreaks, data leaks, business rule violations, and unsafe tool use. According to the official site, it covers more than 50 vulnerability types
- Prompt, model, and RAG evaluation: Score and compare outputs from multiple prompts and models side by side using YAML-defined test cases. It supports major providers including OpenAI, Anthropic, Azure, Bedrock, and Ollama, so you can quantify the impact of swapping models
- Real-time protection with guardrails: Beyond testing, it offers runtime mechanisms that block jailbreaks and adversarial inputs
- Code scanning in IDEs and CI/CD: Plug it into your editor or into pipelines such as GitHub, GitLab, and Jenkins to check for LLM-related vulnerabilities on every change
- MCP proxy and model security: Includes a proxy that mediates Model Context Protocol traffic for safety, plus continuous testing and monitoring for foundation models themselves
- Runs locally or self-hosted: Evaluations and red teaming run locally by default, so prompts and test data never have to leave your environment
Pricing
| Plan | Price | What’s included |
|---|---|---|
| Community | Free forever | All evaluation features, all model providers and integrations, red teaming with 10,000 probes/month, vulnerability scanning, local or self-hosted deployment, community support |
| Enterprise | Contact for pricing | Everything in Community plus custom red teaming limits, team sharing, continuous monitoring, a security/compliance dashboard, SSO and granular permissions, API access, managed cloud, priority support and SLAs |
| On-Premise | Contact for pricing | Everything in Enterprise plus deployment on your own infrastructure, complete data isolation, a dedicated runner, and an assigned deployment engineer |
Pricing is current as of August 2026. Check the official site for the latest details.
Pros & Cons
✅ Pros
- The core is MIT-licensed open source, so both evaluation and red teaming are usable for real work at no cost
- Its CLI-first design drops cleanly into existing development flows and CI/CD
- Tests can run entirely locally, which makes it viable for prompts and data that cannot leave the organization
- Red teaming (“break it”) and evaluation (“measure it”) live in one tool, unifying security and quality work
- It is not tied to a single model vendor, so you can compare across providers
⚠️ Cons
- Configuration is centered on YAML and the CLI, making it hard for non-engineers to use on their own
- The free plan caps red teaming at 10,000 probes per month, so large-scale continuous testing pushes you toward Enterprise
- Team sharing, continuous monitoring, and SSO sit on the paid tiers
- Enterprise and On-Premise prices are not published, so adoption requires a quote conversation
- Setups that use an external model to generate attacks incur separate API costs
Comparison with Similar Services
| Criteria | Promptfoo | NVIDIA Garak | Lakera Guard | Langfuse |
|---|---|---|---|---|
| Main purpose | Red teaming + evaluation + guardrails | LLM vulnerability scanning | Runtime prompt defense | LLM app observability and evaluation |
| Delivery | CLI / self-hosted / cloud | CLI tool | API / SDK | Self-hosted / cloud |
| Security testing | Core feature | Core feature | Runtime defense focused | Supplementary |
| Quality evaluation | Supported | Limited | Not supported | Core feature |
| Open source | Yes (MIT) | Yes | Partial | Yes |
(Check each vendor’s site for details. The table above is a broad sketch of how their purposes differ.)
Who Is It For
- Developers building internal or customer-facing LLM apps and AI agents who want to verify safety before launch
- Teams that want to compare the impact of prompt or model changes with numbers rather than intuition
- Organizations handling sensitive data that cannot send tests to an external SaaS and need everything local or on-premise
- Engineers who want vulnerability checks wired into CI/CD and run automatically on every release
- Anyone who wants to start free and consider a paid plan only when the need arises
Summary
Promptfoo bundles security testing and quality evaluation for LLM applications into a single open source CLI tool. The MIT-licensed free edition alone covers a practical range of work, and you can move to Enterprise once team operations and continuous monitoring become necessary. Its YAML-and-command-line foundation makes it distinctly developer-oriented, but if you want to systematize the “try to break it” step before putting AI agents into production, it is a strong option. Note that OpenAI announced its acquisition of Promptfoo in March 2026; the open source edition is said to continue, but it is worth following official announcements for how features and support evolve.