Promptfoo is an AI security platform that finds vulnerabilities in LLM applications and AI agents while they are still in development. Developers and security teams use it to red team agents and RAG pipelines, scan code for LLM weaknesses, evaluate prompts and models, and protect applications at runtime. It began as an open-source framework, remains open source, and is now part of OpenAI.
The problem it addresses is that LLM applications fail in ways ordinary testing does not catch: direct and indirect prompt injection, PII leaks, business rule violations and insecure tool use by agents. Finding those failures before release is cheaper than finding them in production.
At A Glance
| Vendor | Promptfoo, Inc. (part of OpenAI) |
|---|---|
| Category | AI security testing, red teaming and evaluation |
| Identities covered | AI agents, LLM applications, RAG pipelines, MCP communications |
| Deployment | Local CLI, self-hosted, managed cloud or on-premises |
| Agentic AI | Automated red teaming for agents, MCP Proxy |
| Certifications | SOC 2, ISO 27001 |
| Market classification | Agentic AI Identity |
What Promptfoo Does
Promptfoo’s approach is to attack AI applications before attackers can, and to do it inside the developer’s normal workflow rather than as a separate security review. Testing starts on the developer’s machine and in the pipeline, where adversarial inputs are generated for the specific application and its responses are graded automatically, so weaknesses surface as test failures and pull request comments. Protection then continues once the application is live. Because the core tool is open source and runs locally, teams can adopt it without sending prompts or data to a third party.
Products
Red Teaming
Red Teaming simulates hostile users to find weaknesses specific to an application, aimed at teams shipping agents and RAG systems. It generates malicious intents, wraps them in prompts aimed at the target and grades the responses with deterministic and model-graded metrics. Failure modes are split into adversarial testers called plugins, covering areas such as harmful content and the authorisation flaws BOLA and BFLA, with reference to the OWASP LLM Top 10 and the NIST AI Risk Management Framework.
Guardrails, Model Security And MCP Proxy
These cover AI applications once they are live. Guardrails gives real-time protection against jailbreaks and adversarial attacks in production, managed from a central dashboard. Model Security tests and monitors AI models themselves for security issues, and MCP Proxy places a security layer in front of Model Context Protocol communications between agents and the tools they call.
Code Scanning
Code Scanning finds LLM vulnerabilities in IDEs and CI/CD, and posts findings and remediation steps in pull requests so developers fix them before merge.
Evaluations
Evaluations test prompts, models and RAG pipelines and compare outputs across more than 50 model providers, helping teams choose and tune models.
How It Works
The open-source tool runs entirely on the user’s machine: evaluations talk directly to the LLM without passing through Promptfoo. It is available as a CLI, a Node package or a GitHub Action.
| Component | What it does |
|---|---|
| Self-hosted | The open-source tool can also be self-hosted by the team. |
| Managed cloud | A cloud deployment managed by Promptfoo. |
| On-premises | Runs on the customer’s own infrastructure with complete data isolation and a dedicated runner. |
| Pipeline monitoring | Teams run one-off scans or monitor their deployment pipeline continuously, with the scanner running in GitHub, GitLab or Jenkins. |
Identities And Systems Covered
| AI agents | Insecure tool use and misuse of connected APIs or databases |
|---|---|
| RAG pipelines | Information leakage and access control |
| Chatbots and LLM apps | A core target for red teaming |
| MCP communications | Protected through the MCP Proxy |
| Models | Outputs compared across more than 50 providers |
Company Background
| Founded | 2024. |
|---|---|
| Headquarters | San Francisco, California, United States. |
| Leadership | Ian Webster, co-founder and CEO; Michael D’Angelo, co-founder and CTO. |
| Funding | $23.6 million raised before the acquisition, including an $18.4 million round in July 2025, with investors including Insight Partners and Andreessen Horowitz. |
| Acquisition | Acquired by OpenAI, announced in March 2026, for an undisclosed price. |
| Adoption | A reported 156 of the Fortune 500 and more than 300,000 developers. |
Note: This overview is compiled from Promptfoo’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.