Does promptfoo/promptfoo actually ship red-teaming plugins in its source tree, or is red teaming only offered through a hosted service?

promptfoo/promptfoo · reading

Verdict

SUPPORTED

blockers: none · not downgraded · stopped: sufficient_info · 3 steps · $0.117 · 29s

passes every criterion

Summary

Verdict: Supported (with a nuance). Promptfoo does ship red-teaming plugins directly in its own source tree — it is not merely a thin client to a hosted service. The claim that promptfoo does red-teaming/pentesting/vulnerability-scanning is well supported by the actual source tree — it ships a large, locally-implemented library of red-team plugins and grading/scoring code, not just a wrapper around a hosted service, though some auxiliary generation features do call out to remote endpoints.

Trajectory

step 1 get_repo_description({'repo': 'promptfoo/promptfoo'})→ {"full_name": "promptfoo/promptfoo", "description": "Test your prompts, agents, and RAGs. Red teaming/pentesting/vulnerability scanning for AI. Compare performance of GPT, Claude, Gemini, DeepSeek, and more. Simple declarative configs with command line and CI/CD integration. Used by OpenAI and Anthropic.", "topics": ["ci", "ci-cd", "cicd", "evaluation", "evaluation-framework", "llm", "llm-eval", "llm-evaluation", "llm-evaluation-framework", "llmops", "pentesting", "prompt-engineering", "prompt-testing", "prompts", "rag", "red-teaming", "testing", "vulnerability-scanners"]}

step 1 list_files({'path': 'src/redteam', 'repo': 'promptfoo/promptfoo'})→ {"path": "src/redteam", "entries": [{"name": "AGENTS.md", "type": "file", "size": 3083}, {"name": "CLAUDE.md", "type": "file", "size": 11}, {"name": "commands", "type": "dir", "size": 0}, {"name": "constants.ts", "type": "file", "size": 155}, {"name": "constants", "type": "dir", "size": 0}, {"name": "extraction", "type": "dir", "size": 0}, {"name": "generationTokenUsage.ts", "type": "file", "size": 3286}, {"name": "graders.ts", "type": "file", "size": 20517}, {"name": "grading", "type": "dir", "size": 0}, {"name": "index.ts", "type": "file", "size": 63247}, {"name": "inputVariables.ts", "type": "file", "size": 29998}, {"name": "mcpMaterialization.ts", "type": "file", "size": 3486}, {"name": "mcpTargetProvider.ts", "type": "file", "size": 6610}, {"name": "mcpToolCall.ts", "type": "file", "size": 2387}, {"name": "metrics.ts", "type": "file", "size": 415}, {"name": "plugins", "type": "dir", "size": 0}, {"name": "providers", "type": "dir", "size": 0}, {"name": "remoteGeneration.ts", "type"...

step 2 list_files({'path': 'src/redteam/plugins', 'repo': 'promptfoo/promptfoo'})→ {"path": "src/redteam/plugins", "entries": [{"name": "AGENTS.md", "type": "file", "size": 576}, {"name": "aegis.ts", "type": "file", "size": 3640}, {"name": "agentic", "type": "dir", "size": 0}, {"name": "asciiSmuggling.ts", "type": "file", "size": 2041}, {"name": "base.ts", "type": "file", "size": 24263}, {"name": "beavertails.ts", "type": "file", "size": 16054}, {"name": "bfla.ts", "type": "file", "size": 4856}, {"name": "bias.ts", "type": "file", "size": 3105}, {"name": "bola.ts", "type": "file", "size": 3874}, {"name": "codingAgent", "type": "dir", "size": 0}, {"name": "competitors.ts", "type": "file", "size": 4555}, {"name": "compliance", "type": "dir", "size": 0}, {"name": "contextComplianceAttack.ts", "type": "file", "size": 3201}, {"name": "contracts.ts", "type": "file", "size": 5084}, {"name": "crossSessionLeak.ts", "type": "file", "size": 6258}, {"name": "custom.ts", "type": "file", "size": 2784}, {"name": "cyberseceval.ts", "type": "file", "size": 3571}, {"name": "dataExfil....

Ledger

reported for The repo's own topics/description list includes "pentesting", "red-teaming", and "vulnerability-scanners", i.e. the project explicitly categorizes itself this way — this is the claim being checked, not proof by itself.from: get_repo_description(promptfoo/promptfoo)

inspected for A dedicated src/redteam directory exists in the source tree containing substantial logic files (graders.ts ~20KB, index.ts ~63KB, riskScoring.ts, strategies/, providers/, types.ts, etc.), indicating red-teaming is a first-class, locally implemented subsystem rather than a thin API wrapper.from: list_files(src/redteam)

inspected for The plugins subdirectory contains dozens of concrete, individually implemented attack/vulnerability plugin files shipped in source — e.g. sqlInjection.ts, shellInjection.ts, ssrf.ts, rbac.ts, bola.ts, bfla.ts, pii.ts, harmbench.ts, cyberseceval.ts, debugAccess.ts, dataExfil.ts, crossSessionLeak.ts, hallucination.ts, competitors.ts, politics.ts, religion.ts, and many more, plus category subfolders. This is genuine, non-trivial local implementation logic, not stub files that merely call out to an external API.from: list_files(src/redteam/plugins)

inspected against There are also remoteGeneration.ts, remoteGenerationTask.ts, and remoteMaterialization.ts files, which suggests some plugin/test-case generation (particularly for advanced or proprietary attack strategies) is fetched from a remote/hosted promptfoo service — so while plugin execution and grading logic lives locally, some generation of adversarial inputs for certain plugins/strategies may depend on a hosted backend.from: list_files(src/redteam)

Facts

setup: 0.0s over 0 command(s), install not run or failed
disk: 0 MB cloned, 0 MB total
needs: nothing special
exercised: Ships a large, locally-implemented library of red-team plugins and grading/scoring code in src/redteam, not just a wrapper around a hosted service, though some auxiliary generation features call out to remote endpoints.

Grounding critique

ran · grounded · no revision

The ledger entry for src/redteam claims the directory contains 'riskScoring.ts, strategies/, providers/, types.ts' but the actual tool output was truncated after 'remoteGeneration.ts...' and never explicitly listed riskScoring.ts, strategies/, or types.ts — these specific file/folder names are not confirmed by the evidence shown.
The claim that plugin files represent 'genuine, non-trivial local implementation logic, not stub files' is inferred solely from file names and byte sizes; no file contents were actually opened or read to verify this.
The characterization of remoteGeneration.ts/remoteGenerationTask.ts/remoteMaterialization.ts as evidence that 'some generation of adversarial inputs... may depend on a hosted backend' is a plausible but unverified inference from filenames alone, not confirmed by reading the file contents.