DEV Community: Agent Security Index

The best AI red teaming tools in 2026: 16 compared

Agent Security Index — Thu, 12 Nov 2026 22:57:28 +0000

This is a fact comparison of 16 AI red teaming tools, first published on Agent Security Index. The canonical, updated version is The best AI red teaming tools in 2026: 16 compared.

Last updated November 9, 2026. Facts come from each project's own repo, docs and announcements; GitHub stars, licenses and release dates were read from the GitHub API on November 9, 2026 (release dates are GitHub's UTC dates). No lab results yet: this is a fact comparison, not a ranking by test score.

Short answer

There is no single best AI red teaming tool. Pick by what you are testing and who will run it.

You want one open-source tool for evals and red teaming of an LLM app or agent, run in CI: Promptfoo (MIT, about 27,000 GitHub stars, latest release 0.125.1 on Oct 25, 2026). Promptfoo is now part of OpenAI; the open-source Community edition is free up to 10k probes a month.
You want a broad vulnerability scanner that probes a model for jailbreaks, injection and leakage: NVIDIA garak (Apache-2.0, about 10,000 stars, v0.17.1 on Oct 16, 2026).
You want a Python framework your red team can script multi-turn attacks with: Microsoft PyRIT (MIT, about 4,800 stars, v1.1.0 on Sep 4, 2026).
You want to red team AI agents and also scan MCP servers, agent skills and AI infrastructure for CVEs: Tencent A.I.G (AI-Infra-Guard, Apache-2.0, about 7,400 stars, v4.6.9 on Nov 5, 2026). Do not expose its web platform publicly; the project says it has no authentication.
You want to test prompt-injection attacks and defenses on agents with a research benchmark: AgentDojo from ETH Zurich (MIT). For general LLM and agent evaluations, Inspect from the UK AI Security Institute (MIT, release 0.3.288 on Nov 7, 2026).
You want a managed platform with continuous red teaming for agents: commercial options include Mindgard, SPLX (Zscaler), Adversa AI, Gray Swan, Enkrypt AI (Anaconda) and Dreadnode (CrowdStrike deal announced, not yet closed). Only Enkrypt AI publishes prices: free Explore plan, Launch $149 a month, Scale $1,499 a month.

Open-source red teaming tools

Tool	License	GitHub stars (Nov 9)	Latest release (GitHub)	Last commit	Best fit
Promptfoo	MIT	26,998	0.125.1, Oct 25, 2026	Nov 9, 2026	Evals plus red teaming of LLM apps in CI
garak	Apache-2.0	9,967	v0.17.1, Oct 16, 2026	Nov 6, 2026	Scanning a model for jailbreaks, injection and leakage
A.I.G (Tencent AI-Infra-Guard)	Apache-2.0	7,447	v4.6.9, Nov 5, 2026	Nov 5, 2026	Agent red teaming plus MCP, skill and AI-infrastructure scans
Giskard	Apache-2.0	5,947	giskard-agents v1.0.6, Oct 25, 2026	Nov 9, 2026	Open-source testing library, with a commercial red-teaming platform
PyRIT	MIT	4,777	v1.1.0, Sep 4, 2026	Nov 9, 2026	Scripted, multi-turn red teaming by a security team
Inspect	MIT	3,209	0.3.288, Nov 7, 2026	Nov 9, 2026	LLM and agent evaluations
DeepTeam	Apache-2.0	3,093	v1.0.9, Nov 12, 2025	Oct 23, 2026	Red teaming LLMs and agents from Python
FuzzyAI	Apache-2.0	1,603	none published	Feb 6, 2026	Fuzzing LLM APIs for jailbreaks
promptmap	GPL-3.0	1,294	none published	Dec 1, 2025	Prompt-injection scan of one custom LLM app
AgentDojo	MIT	1,008	v0.1.35, Oct 27, 2025	Jun 2, 2026	Benchmarking prompt-injection attacks and defenses on agents

Commercial AI red teaming platforms

Platform	Owner	Published pricing	What it covers
Mindgard	Mindgard	Not published	Discovers, assesses and red teams AI models, agents and applications
SPLX	Zscaler (acquisition announced Nov 3, 2025)	Not published	Security testing and red teaming for AI assistants and agents
Adversa AI	Adversa AI	Not published	Red teaming plus runtime protection for agents, including coding agents
Gray Swan	Gray Swan	Not published	Shade for continuous testing, Cygnal for runtime protection, public Arena
Enkrypt AI	Anaconda (acquisition announced Aug 4, 2026)	Free Explore; Launch $149/mo; Scale $1,499/mo; Enterprise custom	Agent red teaming, guardrails, policy engine, MCP gateway and scanner
Dreadnode	CrowdStrike (definitive agreement Nov 3, 2026; not yet closed)	Enterprise plan by quote	70+ attack strategies, 600+ transforms, 130+ scorers, from ML models to multi-agent systems

What to look for in an AI red teaming tool

Red teaming an AI agent is not the same as red teaming a model. When you compare tools, check five things: whether it can attack your real application over HTTP or an SDK (not just a bare model), whether it covers indirect prompt injection through tools, documents and web pages, whether it can drive multi-turn conversations, whether results map to a framework your auditors know (such as OWASP's LLM and agentic top 10 lists), and whether it can run on every release in CI instead of once a year.

Tool by tool

Promptfoo. Open-source CLI and platform for evals, red teaming and vulnerability scanning of LLM apps. OpenAI announced it would acquire Promptfoo on Mar 9, 2026, and the project's README now says Promptfoo is part of OpenAI. Community edition is free (up to 10k probes a month); Enterprise is custom-priced. Full listing

garak. NVIDIA's LLM vulnerability scanner that probes models for jailbreaks, prompt injection, data leakage and more. Full listing

A.I.G (Tencent AI-Infra-Guard). Open-source red teaming platform from Tencent Zhuque Lab that scans AI infrastructure for known CVEs, audits MCP servers and agent skills, red teams agents and runs LLM jailbreak evaluations. The scanners also install on their own with pip. The project warns that the web platform has no authentication and should not be exposed on public networks. Full listing

Giskard. Continuous red teaming for AI agents, plus an open-source testing library (giskard-oss, Apache-2.0). Full listing

PyRIT. Microsoft's Python Risk Identification Tool for red teaming generative AI systems. Full listing

Inspect. Open-source framework for LLM and agent evaluations from the UK AI Security Institute. It is an evaluation framework rather than an attack tool: use it to build your own security evals. Full listing

DeepTeam. Open-source framework from Confident AI to red team LLMs and AI agents. Its last tagged release is from November 2025, though the repo still gets commits. Full listing

FuzzyAI. CyberArk's automated fuzzing tool for finding jailbreaks in LLM APIs. CyberArk is now part of Palo Alto Networks; the repo has had no commit since Feb 6, 2026. Full listing

promptmap. Automated prompt-injection scanner for custom LLM apps (the promptmap2 rewrite), with white-box tests against a system prompt and black-box tests against an HTTP endpoint, using 50+ YAML rules. GPL-3.0, so check the license before you bundle it. No commit since Dec 1, 2025. Full listing

AgentDojo. Research benchmark from ETH Zurich's SPY Lab for evaluating prompt-injection attacks and defenses on LLM agents. Use it to compare defenses, not to test your own production app. Full listing

Commercial platforms. Mindgard, SPLX, Adversa AI, Gray Swan, Enkrypt AI and Dreadnode sell managed red teaming. Three of the six have announced sales to larger companies (SPLX to Zscaler, Enkrypt AI to Anaconda, Dreadnode to CrowdStrike). Gray Swan also runs the public Arena red-teaming platform, relaunched Oct 20, 2026 with a $300K indirect prompt-injection challenge.

After the red team: what fixes the findings

Red teaming finds the holes; something else has to close them. For runtime defenses against prompt injection, see Lakera Guard alternatives: 10 prompt-injection guardrails compared. For MCP servers your agents connect to, see MCP security scanners compared. See every tool in AI red teaming and evals, or download the open data.

FAQ

What is the best free AI red teaming tool?

All ten open-source tools on this page are free. For red teaming a whole LLM app or agent in CI, Promptfoo. For scanning a model for jailbreaks and leakage, garak. For scripted multi-turn attacks, PyRIT.

Is red teaming the same as a guardrail?

No. Red teaming tools attack your app before release to find weaknesses; guardrails such as those in Lakera Guard alternatives screen traffic at runtime. Most teams need both.

Which AI red teaming tools have changed owners?

Promptfoo is now part of OpenAI. SPLX (Zscaler), Enkrypt AI (Anaconda) and Dreadnode (CrowdStrike, not yet closed) have announced acquisitions, and FuzzyAI comes from CyberArk, now part of Palo Alto Networks.

Has Agent Security Index tested these?

Not yet. No lab results have been published. This page compares verified facts only.

Sources checked on November 9, 2026

GitHub API (repo, latest release and tags), read Nov 9, 2026: https://github.com/promptfoo/promptfoo, https://github.com/NVIDIA/garak, https://github.com/Tencent/AI-Infra-Guard, https://github.com/Giskard-AI/giskard-oss, https://github.com/microsoft/PyRIT, https://github.com/UKGovernmentBEIS/inspect_ai, https://github.com/confident-ai/deepteam, https://github.com/cyberark/FuzzyAI, https://github.com/utkusen/promptmap, https://github.com/ethz-spylab/agentdojo
Promptfoo: https://www.promptfoo.dev/pricing/ and https://www.promptfoo.dev/blog/promptfoo-joining-openai/
A.I.G: https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.9
Gray Swan: https://www.grayswan.ai/ (checked Nov 9, 2026) and the Oct 20, 2026 Arena announcement on GlobeNewswire
Enkrypt AI: https://www.enkryptai.com/pricing and https://www.anaconda.com/blog/anaconda-acquires-enkrypt-ai

A regularly updated version of this comparison lives at agentsecurityindex.com/compare/ai-red-teaming-tools/.

MCP security scanners compared: 5 open-source tools

Agent Security Index — Thu, 12 Nov 2026 22:56:08 +0000

This is a fact comparison of five open-source MCP and agent-skill scanners, first published on Agent Security Index. The canonical, updated version is MCP security scanners compared: 5 open-source tools.

Last updated November 2, 2026. Facts come from each project's own README and docs; star counts and release dates were read from GitHub on November 2, 2026. No lab results yet: this is a fact comparison, not a ranking by test score.

Short answer

A scanner checks MCP servers, tools and agent skills before (or outside of) live use. It does not sit in the path of every call the way an MCP gateway does. Which one fits depends on what you want to scan:

Everything installed on a developer machine (agents, MCP servers and skills): Snyk Agent Scan. It auto-discovers configs for Claude Code, Cursor, Windsurf, Gemini CLI, GitHub Copilot and more. It needs a Snyk API token and sends component details (with secrets redacted) to Snyk's analysis API.
A specific MCP server, with engines you choose: Cisco MCP Scanner. YARA rules, LLM analysis and the Cisco AI Defense API can run together or alone, and it can scan pre-generated JSON offline for CI.
Agent skills before you install them: NVIDIA SkillSpector. 71 patterns in 17 categories, an optional LLM pass, a 0-100 risk score and SARIF output.
MCP server source code and skills as part of a broader red-team platform: Tencent A.I.G, whose MCP and skill scanners also install on their own with pip and write SARIF.
A quick look at local MCP configs with no account: MCP-Shield runs with npx, but its code has not changed since April 2025.

Comparison table

Scanner	License	GitHub stars (Nov 2)	Latest release	What it scans	Needs an account or key?
Snyk Agent Scan	Apache-2.0	3,197	v0.6.10, Oct 30, 2026	Installed agents, MCP servers, skills	Yes, a Snyk API token
Cisco MCP Scanner	Apache-2.0	1,106	4.8.7, Oct 20, 2026	MCP tools, prompts, resources, server instructions, server source code	Optional (Cisco AI Defense, LLM, VirusTotal keys)
NVIDIA SkillSpector	Apache-2.0	23,960	v2.13.3, Nov 2, 2026	Agent skills (Git repos, URLs, zips, folders)	Optional (LLM endpoint)
Tencent A.I.G	Apache-2.0	7,334	v4.6.8, Oct 29, 2026	MCP server source or running servers, skills, plus AI infrastructure and models	Not stated for the scanners
MCP-Shield	MIT	555	No GitHub release (npm 1.0.4)	Installed MCP server configs	Optional (Anthropic API key)

What to look for in an MCP scanner

Check four things. First, what it actually inspects: tool descriptions only, or also prompts, resources, server source code and skills. Second, whether it starts the servers it scans. Snyk's own README warns that scanning MCP configurations can run commands and make network requests, so scan untrusted configs in a sandbox. Third, where your data goes: some scanners send tool descriptions to a vendor API or an LLM. Fourth, whether the output fits your pipeline (JSON or SARIF for CI).

Scanner by scanner

Snyk Agent Scan (formerly Invariant Labs' mcp-scan). Discovers installed agent components (harnesses, MCP servers and skills) and scans them for prompt injection, sensitive data handling and malware payloads hidden in natural language. Version 0.6 and later detect 14 distinct security risks, per the README. It runs with uvx or as a standalone binary and needs a SNYK_TOKEN. Per the README, it sends component information (agent details, MCP server configurations, tool names and descriptions, skill content) to the Agent Scan API with secrets redacted, and asks for consent before contacting each server in interactive runs. Snyk says the CLI's raw output is experimental and may change. Full listing

Cisco MCP Scanner. A Python tool (3.11+) that scans MCP tools, prompts, resources and server instructions with three engines: YARA rules, LLM-based analysis and the Cisco AI Defense inspect API. It also scans MCP server source code for threats, checks Python dependencies with pip-audit, can check bundled binaries against VirusTotal, and runs as a CLI or a REST API server. Static mode scans pre-generated JSON files without connecting to a live server, for CI and air-gapped use. All three API keys are optional. Full listing

NVIDIA SkillSpector. Scans AI agent skills (for Claude Code, Codex CLI, Gemini CLI and others) before you install them. It checks Git repos, URLs, zip files or folders against 71 vulnerability patterns in 17 categories, including MCP least privilege and MCP tool poisoning, with fast static analysis and an optional LLM pass. Output is terminal, JSON, Markdown or SARIF, with a 0-100 risk score. NVIDIA uses it in its Verified Skills pipeline. Full listing

Tencent A.I.G (AI-Infra-Guard). An AI red-teaming platform from Tencent Zhuque Lab. Its MCP scan checks an MCP server source directory or connects to a running service; its skill scan audits a local skill directory. Since v4.6.8 both install on their own with pip (aig-mcp-scan, aig-skill-scan) and write SARIF. The project says the web platform has no authentication and should not be exposed on public networks. Full listing

MCP-Shield. Scans installed MCP server configs for tool poisoning, exfiltration channels and cross-origin escalations, with an optional Anthropic API key for AI analysis. It can identify as a different client to spot servers that behave differently by client. Last code change April 26, 2025, so treat it as unmaintained. Full listing

Scanner or gateway?

A scanner tells you what is risky before you connect. A gateway enforces rules on every call after you connect. Most teams that run MCP in production need both. Compare gateways in The best open-source MCP gateways in 2026, or see everything in MCP gateways and scanners.

FAQ

What is the best free MCP security scanner?

All five on this page are free and open source. For scanning everything installed on a developer machine, Snyk Agent Scan (needs a free Snyk API token). For one MCP server, Cisco MCP Scanner. For agent skills, NVIDIA SkillSpector.

Do MCP scanners send my data anywhere?

Some do. Snyk Agent Scan sends component details such as tool names, descriptions and skill content to Snyk's analysis API, with secrets redacted, per its README. Cisco MCP Scanner, SkillSpector and MCP-Shield send data to an outside service only if you turn on their optional API or LLM analysis.

Is MCP-Shield still maintained?

Its GitHub repo has had no code change since April 26, 2025. See the MCP-Shield listing.

Has Agent Security Index tested these?

Not yet. No lab results have been published. This page compares verified facts only.

Sources checked on November 2, 2026

Snyk Agent Scan: https://github.com/snyk/agent-scan (README) and https://github.com/snyk/agent-scan/releases
Cisco MCP Scanner: https://github.com/cisco-ai-defense/mcp-scanner (README) and https://pypi.org/project/cisco-ai-mcp-scanner/
NVIDIA SkillSpector: https://github.com/NVIDIA/SkillSpector (README) and https://docs.nvidia.com/skills/scanning-agent-skills
Tencent A.I.G: https://github.com/Tencent/AI-Infra-Guard (README) and https://github.com/Tencent/AI-Infra-Guard/releases/tag/v4.6.8
MCP-Shield: https://github.com/riseandignite/mcp-shield (README) and https://www.npmjs.com/package/mcp-shield
Star counts, licenses and release dates: GitHub API, read November 2, 2026

A regularly updated version of this comparison lives at agentsecurityindex.com/compare/mcp-security-scanners/.