garak

What it does

LLM vulnerability scanner. Runs probes spanning prompt injection, encoding bypasses, toxic generation, and known jailbreaks against a wide range of model endpoints, then reports per-probe pass/fail with examples.

What it doesn't do

Coverage is broad but uneven; some probes are dated relative to current model capabilities. Not designed for stateful, multi-turn agentic systems out of the box. Reporting is geared to engineers, not auditors.

Best for

• Baseline scanning a new model or model version
• Continuous integration regression for fundamental risks
• Triaging which broad categories warrant deeper bespoke testing

Not for

• Sole tool for an enterprise red team — pair with a more targeted framework like PyRIT
• Agentic / multi-turn testing without scaffolding

Pricing

Free (Apache 2.0).

Integration effort

low

Team skill required

Python familiarity; tolerance for noisy results that require triage.

Vendor / project page →

Last reviewed: 2026-05-01