$ show confident-ai/deepteam
DeepTeam is a production-oriented Python library and CLI for red-teaming LLM applications. It does not merely document vulnerabilities; it executes automated adversarial campaigns against a user-supplied model callback, generating attack prompts through LLM-driven templates (single-turn, multi-turn, tree/crescendo jailbreaks), scoring target responses with LLM-as-judge metrics, and aggregating outcomes into risk assessments with CVSS scoring. It also ships a code scanner for static AI-security review, a trace scanner for agent executions, and deployable input/output guardrails. Main entry points are the red_team() Python API and the deepteam CLI (login, run, scan), with YAML configuration driving model selection, vulnerability types, and attack budgets. Architecturally, the repo is a modular Python package built on deepeval: vulnerabilities inherit from BaseVulnerability, all metrics inherit from BaseRedTeamingMetric, attacks implement configurable templates and schemas, and frameworks (OWASP, MITRE ATLAS, NIST, EU AI Act, BeaverTails, Aegis) map risks to pre-built categories. Results flow through RTTestCase objects and can be saved locally as JSON or pushed to the Confident AI platform. The library is dual sync/async and includes progress reporting, cost accumulation, and retry logic. Although it embeds research-style synthetic data generation and dataset-driven framework integrations, the dominant character is an application library/CLI rather than a data research project. Strengths include broad vulnerability and attack coverage, clear base-class contracts, a substantial test suite, and active CI. Weaknesses include heavy copy-paste duplication across 30+ vulnerability, metric, and template modules, tight coupling to deepeval internals, reliance on hardcoded model defaults such as gpt-3.5-turbo-0125, and a known logic bug where is_successful in the metric base class compares instead of assigns, always returning False unless an error is set. Telemetry code also contains hardcoded service keys. Overall, it is a functional, well-documented framework with real reuse value, but it would benefit from deduplication and dependency hardening.
The LLM identified 3 files worth highlighting for reuse:
Provides a nested context-manager accumulator that tracks LLM simulation/evaluation costs across calls without global state, plus retry helpers for flaky LLM generation. It is self-contained, solves a recurring problem in LLM tooling, and can be lifted into any project that needs per-run cost accounting or resilient generation.
Implements early-exit screening of model replies before expensive LLM judge calls, detecting declined or empty outputs that should be treated as non-vulnerable rather than sent to a grader. This is a reusable guard for any LLM evaluation pipeline and demonstrates non-obvious handling of degenerate outputs.
Contains functions for computing per-test-case and average CVSS scores from red-team findings, converting qualitative vulnerability assessments into standardized severity metrics. The module is mostly isolated from the rest of the framework and can be reused by security tooling that needs CVSS scoring without pulling in the whole package.