- Home
- AI Security Testing Tools
- RedForge
RedForge
What it is
RedForge is a free, open-source platform for red teaming and vulnerability scanning of large language models. It lists 49+ probes, full OWASP LLM Top 10 coverage, and YAML probes that can be added without Python. Attack modules include PAIR, Crescendo multi-turn escalation, Skeleton Key, many-shot jailbreaking, and GCG adversarial suffixes. Its mutation engine expands two payloads into 37 variants using encoding, Unicode, cognitive reframing, and structural injection strategies. Adapters cover OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Mistral, Ollama, HuggingFace, and generic REST endpoints. Ollama can run locally without an API key. Scans produce JSON, JSONL audit, and failures reports, with HTML, Markdown, SARIF, JSON, audit, and failures formats also available. Compliance reports cover NIST AI RMF, EU AI Act, ISO/IEC 42001, GDPR, and OWASP LLM Top 10, with custom YAML frameworks. RedForge includes seven detector types, bidirectional guardrails, SARIF export for GitHub Code Scanning, and CI exit status 1 for critical or high findings. It is self-hosted for Linux and API use under Apache 2.0.
For and against
For
- 49+ probes and OWASP LLM Top 10 coverage
- Multiple provider adapters, including local Ollama
- SARIF export for GitHub Code Scanning
- Custom YAML probes and compliance frameworks
- Apache 2.0 open-source software
Against
- Requires authorized, owned, or research use
- Self-hosted deployment requires setup
- Rate limit is 10 scan requests per minute per client
The verdict
RedForge offers broad LLM security testing, reporting, and compliance features in a self-hosted package. Its authorization requirement and deployment controls matter for teams planning operational use.
Who it suits
RedForge suits security teams and developers authorized to test LLM applications. Its self-hosted deployment, provider adapters, compliance reports, and CI integration support engineering workflows.
Plans and prices
RedForge
Apache 2.0 open-source software · install with pip
Read 9 Oct 2026 · github.com
On the record
- Attack methods
- Attack modules include PAIR, Crescendo multi-turn escalation, Skeleton Key, many-shot jailbreaking, and GCG adversarial suffixes.github.com · read 9 Oct 2026
- Attack modules
- Its attack modules include PAIR, Crescendo multi-turn escalation, Skeleton Key, many-shot jailbreaking, and GCG adversarial suffixes.github.com · read 9 Oct 2026
- CI integration
- RedForge can emit SARIF for GitHub Code Scanning and exits with status 1 on critical or high findings for use as a CI gate.github.com · read 9 Oct 2026
- Compliance
- Compliance reporting covers NIST AI RMF, EU AI Act, ISO/IEC 42001, GDPR, and OWASP LLM Top 10, and users can add custom YAML frameworks.github.com · read 9 Oct 2026
- Deployment
- The Docker instructions say the container runs as non-root user redforge (UID 1001) with a read-only filesystem.github.com · read 9 Oct 2026
- Detectors
- The README lists seven detector types, including YARA-style, similarity, refusal, regex, keyword, code, and unsafe-content detectors.github.com · read 9 Oct 2026
- Guardrails
- A bidirectional guardrail pipeline scans inputs and outputs for prompt injection, PII, toxicity, and secrets.github.com · read 9 Oct 2026
- Integrations
- It can export SARIF for GitHub Code Scanning and documents a GitHub Actions workflow that uploads the SARIF file.github.com · read 9 Oct 2026
- License
- The project is released under the Apache 2.0 license, and the README says probe payloads are released under CC0.github.com · read 9 Oct 2026
- License and use
- The repository identifies the license as Apache 2.0 and says the tool is for authorized use only.github.com · read 9 Oct 2026
- Local use
- The Ollama adapter runs locally without an API key, and the README describes it as zero cost.github.com · read 9 Oct 2026
- Model providers
- It lists adapters for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Mistral, Ollama, HuggingFace, and generic REST endpoints.github.com · read 9 Oct 2026
- Mutation engine
- The mutation engine expands two payloads to 37 variants across encoding, Unicode, cognitive reframing, and structural injection strategies.github.com · read 9 Oct 2026
- Probe coverage
- It lists 49+ probes and full OWASP LLM Top 10 coverage, with YAML probes that can be added without Python.github.com · read 9 Oct 2026
- Providers
- The README lists provider adapters for OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, Mistral, Ollama, HuggingFace, and generic REST endpoints.github.com · read 9 Oct 2026
- Purpose
- RedForge is an LLM security testing platform for red teaming and vulnerability scanning.github.com · read 9 Oct 2026
- Reports
- Scans automatically produce JSON, JSONL audit, and failures reports, with additional HTML, Markdown, SARIF, JSON, audit, and failures formats.github.com · read 9 Oct 2026
- Security controls
- Documented controls include masking API keys in logs, setting result files to mode 0600, bearer-token REST API authentication, disabled-by-default CORS, and a rate limit of 10 scan requests per minute per client.github.com · read 9 Oct 2026
