Promptfoo
CLI evaluation tool and test runner for LLM application security, automated red teaming, and CI/CD security pipeline gating.
Technical Architecture & Overview
Promptfoo is an open-source testing tool for LLMs, RAG applications, and agentic workflows. It includes over 150 red-team plugins, with presets mapped to the OWASP Top 10 for LLM Applications, covering indirect prompt injection, PII disclosure, and SSRF, plus jailbreak attack strategies. Promptfoo announced in March 2026 that it agreed to be acquired by OpenAI; the project remains open source and MIT licensed.
Targeted Technical Use Cases
Continuous security testing and prompt regression checks in GitHub Actions and GitLab pipelines.
Evaluation & Trade-offs
Core Strengths
- +Runs locally using declarative YAML configuration files.
- +Plugins for indirect prompt injection, PII disclosure, and SSRF, combined with jailbreak strategies such as static jailbreak templates and composite jailbreaks.
- +Supports custom assertions via Python, JavaScript, or LLM-graded rubrics.
Trade-Offs & Limitations
- -Some red-team generation and grading plugins use Promptfoo's hosted service by default; fully air-gapped operation requires disabling remote generation.
- -Targets without a built-in provider need a custom provider script, for example in Python or JavaScript.
Defensive Security Application
Catching prompt regressions, unauthorized tool usage, and sensitive data leakage during pull request reviews.
Frequently Asked Questions
What is Promptfoo?→
Promptfoo is an open-source testing tool for LLMs, RAG applications, and agentic workflows. It includes over 150 red-team plugins, with presets mapped to the OWASP Top 10 for LLM Applications, covering indirect prompt injection, PII disclosure, and SSRF, plus jailbreak attack strategies. Promptfoo announced in March 2026 that it agreed to be acquired by OpenAI; the project remains open source and MIT licensed.
What is Promptfoo used for?→
Continuous security testing and prompt regression checks in GitHub Actions and GitLab pipelines.
What are the strengths of Promptfoo?→
- +Runs locally using declarative YAML configuration files.
- +Plugins for indirect prompt injection, PII disclosure, and SSRF, combined with jailbreak strategies such as static jailbreak templates and composite jailbreaks.
- +Supports custom assertions via Python, JavaScript, or LLM-graded rubrics.
What are the limitations of Promptfoo?→
- +Some red-team generation and grading plugins use Promptfoo's hosted service by default; fully air-gapped operation requires disabling remote generation.
- +Targets without a built-in provider need a custom provider script, for example in Python or JavaScript.
How is Promptfoo used defensively?→
Catching prompt regressions, unauthorized tool usage, and sensitive data leakage during pull request reviews.