garak is a CLI tool and Python library for automated red-teaming and vulnerability scanning of large language models (LLMs). It systematically probes models with adversarial inputs (jailbreaks, prompt injections, encoding attacks, etc.) and uses detectors to classify model responses for safety failures. It supports multiple model backends (OpenAI, Anthropic, HuggingFace, etc.) and generates structured reports with severity scoring. The system follows a modular plugin architecture with base classes for probes, detectors, generators, harnesses, evaluators, and buffs. Plugins are dynamically loaded and configured via a hierarchical config system. The default harness runs probes with their associated detectors, while a cross-product harness allows all probes against all detectors. Results are logged as JSONL and can be visualized via a React-based web UI (garak-report) that displays DEFCON-level severity, calibration Z-scores, and technique-intent matrices. While primarily an application, garak incorporates significant research elements: it implements state-of-the-art attack techniques (GCG, AutoDAN, BEAST, TAP) and includes curated datasets of adversarial prompts and calibration data. The codebase serves both as a practical security tool and as a research platform for LLM vulnerability assessment.
Agentic Security is an open-source LLM vulnerability scanner that probes AI endpoints for security weaknesses such as jailbreaks, prompt injection, data leakage, and sandbox escapes. It provides both a FastAPI web server (port 8718) with a Vue.js frontend and a Fire-based CLI (server, ci, init, ls, scan). The core scan engine sends adversarial prompts (text, image, audio) to target LLMs via configurable HTTP specs, classifies responses using a multi-layered refusal detection system (phrase-based, OneClassSVM, PII detector, LLM-as-judge, hybrid voting), and generates detailed reports with failure rates and cost metrics. The architecture is modular: LLM provider abstraction (OpenAI, Anthropic, LiteLLM), resilience primitives (rate limiter, circuit breaker, concurrent executor), plugin-based refusal classifiers, and a dataset registry supporting HuggingFace, CSV, Google Sheets, and dynamic transformations (stenography, encoding). It also integrates external red-teaming tools (Garak, Inspect AI) and includes reinforcement learning and Bayesian optimization for adaptive prompt selection. While primarily an application, it contains significant data/research components (ML models, datasets, refusal classification research) that support its scanning mission.