Declarative Testing and Red-Teaming for AI Systems
Promptfoo is a command-line tool and library designed for evaluating and red-teaming large language model (LLM) applications. It replaces ad-hoc trial-and-error methods with structured, automated testing, enabling developers to ship secure and reliable AI systems. Since its inception in 2023, Promptfoo has grown into a widely adopted solution, with over 300,000 developers and 156 of the Fortune 500 companies integrating it into their AI development workflows.
Acquired by OpenAI in March 2026, Promptfoo remains open-source under the MIT license, maintaining its permissive and community-driven nature. The acquisition aligns with OpenAI’s goal of integrating security and evaluation tools directly into AI development pipelines, ensuring vulnerabilities are identified early in the process. Despite the transition, Promptfoo continues to support a broad ecosystem of 60+ AI providers, including OpenAI, Anthropic, Google, and local models like Ollama, reflecting its commitment to interoperability and flexibility.
It is also compatible with CI/CD pipelines, allowing teams to automate security and compliance checks as part of their development workflow. Promptfoo’s flexibility extends to its configuration format, which uses YAML for defining test cases, assertions, and model comparisons, making it accessible to developers across different programming languages and environments.
How It Works
Promptfoo operates through a declarative configuration system where test cases are defined in YAML files. Users specify prompts, inputs, providers (AI models), and assertions to validate outputs. The tool then executes these tests across multiple models simultaneously, generating side-by-side comparisons of responses. This approach allows developers to identify inconsistencies, biases, or security vulnerabilities in real time.
To begin using Promptfoo, users install the tool globally via npm, brew, or pip, or run it directly using npx. Configuration files are created either through an interactive CLI walkthrough or by initializing a pre-built example. The core workflow involves defining prompts, selecting providers, and adding test inputs. Assertions can be applied to enforce specific output requirements, such as factual accuracy, tone consistency, or adherence to security policies. Results are displayed in a web-based viewer or exported as spreadsheets, JSON, YAML, or HTML for further analysis.
Promptfoo supports a wide range of use cases, from basic prompt evaluation to advanced red-teaming and vulnerability scanning. For example, developers can test Retrieval-Augmented Generation (RAG) pipelines by evaluating factuality, relevance, and context recall. Similarly, agent-based workflows can be assessed for task completion and trajectory adherence. The tool also integrates with code scanning to review pull requests for LLM-related security issues, ensuring compliance and reducing risks in production environments.
Automated Prompt and Model Evaluation
Promptfoo enables developers to systematically test prompts across multiple AI models, comparing outputs for consistency, accuracy, and performance. For instance, a developer might evaluate how different models handle the same translation task or solve riddles, using assertions to grade responses against expected criteria. This capability is particularly useful for organizations deploying AI in customer-facing applications, where response quality directly impacts user experience and trust.
The tool’s support for over 60 providers—including OpenAI’s GPT-6 Astra, Google’s Gemini 3.8, Anthropic’s Claude Fable, and local models like Ollama—ensures compatibility with diverse AI ecosystems.
Red-Teaming and Security Vulnerability Scanning
Promptfoo’s red-teaming capabilities allow developers to simulate adversarial attacks, identifying injection vulnerabilities, jailbreaks, and other security risks in LLM applications. The tool generates context-aware attack scenarios tailored to specific business logic, RAG workflows, or agent integrations. Security vulnerability reports are automatically generated and can be integrated into CI/CD pipelines, ensuring continuous monitoring and remediation.
The tool’s ability to uncover over 50 types of vulnerabilities—ranging from prompt injection to adversarial prompt crafting—makes it a critical component of enterprise AI security strategies.
Integration with Development Workflows
Promptfoo seamlessly integrates with existing development tools and processes. Its CLI and library support allow developers to embed evaluations directly into their workflows, whether through local testing, automated CI/CD pipelines, or pull request reviews. The tool’s output formats—including spreadsheets, JSON, and HTML—facilitate collaboration by providing clear, actionable insights for teams.
Enterprises leveraging Promptfoo have reported significant reductions in the time and effort required for comprehensive prompt testing. The tool’s enterprise adoption underscores its role in scaling AI security across complex, high-stakes environments.
Declarative YAML Configuration
Promptfoo’s configuration system is built around YAML, allowing users to define prompts, providers, test cases, and assertions in a structured format. This declarative approach simplifies the creation and maintenance of test suites, enabling developers to version-control configurations alongside their code. For example, a YAML file might define a translation prompt with variable placeholders for language and input, ensuring reusable and adaptable test cases.
Assertions in Promptfoo can be rule-based or model-graded. Rule-based assertions use predefined criteria (e.g., output length, keyword presence) to pass or fail tests automatically. Model-graded assertions leverage another LLM to evaluate responses against free-form instructions, such as grading the quality of a riddle’s answer.
Support for 60+ AI Providers
Promptfoo supports a diverse range of AI providers, including cloud-based APIs (OpenAI, Anthropic, Google, Azure), local models (Ollama), and custom Python or JavaScript implementations. This broad support ensures developers can test their applications against the latest advancements in AI without vendor lock-in.
These features are particularly valuable for organizations experimenting with multimodal or agentic AI systems.
Automated Vulnerability Scanning and CI/CD Integration
Promptfoo’s vulnerability scanning capabilities extend beyond prompt evaluation to include static code analysis for LLM-related security risks. These reports can be integrated into CI/CD pipelines, enabling teams to catch vulnerabilities early in the development cycle.
For example, a developer might configure Promptfoo to scan pull requests for LLM-related security flaws, ensuring that new features or updates adhere to organizational guardrails. The tool’s ability to automate these checks reduces manual effort and human error, making it a scalable solution for enterprises deploying AI at scale.
Real-Time Threat Intelligence and Community Collaboration
Promptfoo benefits from a large and active community of over 300,000 developers, many of whom contribute to its ongoing improvement. The tool’s open-source nature ensures transparency and collaboration, with contributors from leading tech companies like OpenAI, Google, Microsoft, and Amazon. This community-driven approach accelerates innovation, with new attack vectors and evaluation techniques deployed automatically.
The tool’s adoption by Fortune 500 companies—spanning industries such as healthcare, telecommunications, retail, and enterprise software—demonstrates its effectiveness in addressing real-world AI security challenges. These use cases highlight the tool’s versatility across diverse AI applications.
Developer-First Design and Performance Optimizations
Additionally, the tool supports multiple installation methods, including npm, brew, pip, and npx, ensuring accessibility across different development environments.
For example, a developer testing a RAG pipeline with thousands of documents can leverage caching to avoid redundant API calls, significantly speeding up the evaluation process. The tool’s ability to handle complex workflows—such as multi-turn agent interactions or multimodal inputs—further solidifies its role as a comprehensive AI testing solution.