- Home
- AI Red Teaming Tools
- RedFang
RedFang
What it is
RedFang is a cloud-based AI red-team scanner for indie builders, available through an API and web interface. It scans AI agents, GitHub repositories, application URLs, and listed targets such as customer-service chatbots. Before scanning, it verifies ownership with a TXT-record or file-upload challenge. RedFang says each scan takes five minutes and returns a grade from A+ to F. Its seven v1 threat categories cover direct prompt injection, tool misuse, sensitive data leakage, output-as-attack-vector, agent overreach, denial-of-wallet, and system-prompt extraction. Repository scans look for exposed keys, broken authentication, and AI-introduced bugs. Reports can include plain-English findings, the successful prompt, a curl reproduction command, fix code, and a retest. PDF and HTML exports are listed. Its methodology follows the OWASP LLM Top 10 threat model and tests 12 direct prompt-injection patterns per scan. Customers can embed a badge showing the latest grade, with listed weekly, daily, or continuous scan cadences by tier.
For and against
For
- Five-minute scans return A+ to F grades
- Checks seven listed AI threat categories
- Reports include reproduction commands and fix code
- Supports PDF and HTML report exports
- Free preview requires no credit card
Against
- Full report costs $19 a month
- Ownership verification is required before scanning
- Badge cadence varies by listed tier
The verdict
RedFang combines ownership verification, targeted AI threat checks, repository scanning, and remediation details. The free preview shows a grade and three issue categories, while the paid plan supplies complete reports and retesting.
Who it suits
RedFang suits indie builders checking AI agents, repositories, or application URLs for listed threats. It also fits teams wanting API access, continuous monitoring, or shareable scan grades.
Plans and prices
Free preview
Grade and top 3 issue categories · no credit card
Read 2 Oct 2026 · redfang.org
Full report
Every finding · reproduction prompt and curl command · fix code · retest
Read 2 Oct 2026 · redfang.org
On the record
- Badge scan cadence
- The badge page lists weekly scans for Indie, daily for Team, and continuous scanning for Scale tiers.redfang.org · read 2 Oct 2026
- Cancellation
- The home page says checkout is through Stripe in live mode and customers can cancel anytime.redfang.org · read 2 Oct 2026
- Certification badge
- Customers can embed a badge that updates with the latest scan grade; RedFang says the badge flips within 24 hours if the grade drops.redfang.org · read 2 Oct 2026
- Maker
- The site identifies RedFang as a solo-founder product.redfang.org · read 2 Oct 2026
- Methodology
- RedFang says its methodology is built on the OWASP LLM Top 10 threat model and tests 12 known direct prompt-injection patterns on every scan.redfang.org · read 2 Oct 2026
- Purpose
- RedFang describes itself as an AI red-team scanner for indie builders that scans AI agents, GitHub repositories, and app URLs.redfang.org · read 2 Oct 2026
- Report contents
- Reports include findings in plain English, the prompt that worked, a curl reproduction command, fix code, and a retest after the issue is fixed.redfang.org · read 2 Oct 2026
- Repository scanning
- RedFang says it scans GitHub repositories for exposed keys, broken authentication, and AI-introduced bugs.redfang.org · read 2 Oct 2026
- Scan time
- RedFang says a scan takes five minutes and returns a grade from A+ to F.redfang.org · read 2 Oct 2026
- Target verification
- Before scanning, RedFang sends a TXT-record or file-upload challenge to confirm ownership of the target.redfang.org · read 2 Oct 2026
- Threat coverage
- Its seven v1 threat categories include direct prompt injection, tool misuse, sensitive data leakage, output-as-attack-vector, agent overreach, denial-of-wallet, and system-prompt extraction.redfang.org · read 2 Oct 2026
