Promptfoo

Promptfoo is a cybersecurity tool. Open source tool for testing prompts and red teaming AI applications, with YAML configured evaluations, generated attacks for agents and RAG, and findings surfaced in pull requests and CI/CD pipelines.

Promptfoo is a testing and security platform for AI applications, combining prompt evaluation with automated red teaming. It targets developers and security teams who need to know how a model, agent or retrieval pipeline behaves before and after it reaches production. The tool is open source at its core, with an enterprise layer for remediation reporting and team-wide tracking, and the homepage states that 156 of the Fortune 500 use it in their AI development lifecycle. The workflow follows three stages. Connect the tool to an application, agent or workflow, whether that runs in a CI/CD pipeline, inside GitHub, GitLab or Jenkins, or on an MCP and agent framework, on premise or in the cloud. Attack with generated test cases: direct and indirect prompt injections, jailbreaks tailored to existing guardrails, data and PII leaks, business rule violations, insecure tool use and toxic output, drawn from a catalogue the site describes as covering 50 or more vulnerability types. Fix by pushing findings into pull requests with remediation guidance, then keep monitoring. In practice this is a command line driven tool. Red team setup begins with a single npx command, and evaluations are configured in YAML, a detail OpenAI engineers highlighted when describing how they iterate on prompts and review results locally. That makes Promptfoo closer to a test runner than to a chat playground: it suits teams already comfortable with repositories and pipelines, and it scales from a single application to a hundred or more without hand-writing scenarios. The alternatives fall into two camps. Prompt evaluation products tend to stop at quality scoring, while security scanners tend to ignore the application logic around the model. Promptfoo argues it covers both, testing business rules, RAG and agent tool calls rather than the model alone. The tradeoff is real: configuration lives in files, the vocabulary is security-heavy, and buyers wanting a visual prompt editor will find richer options elsewhere.