Skip to content
SPECIFICTION
Get listed

Crucible

crucible-security.github.io

Free plan LinuxSelf-hosted
Visit crucible-security.github.io
Spec score 7.8 #14 of 29 in AI Security Testing Tools

What it is

Crucible is a self-hosted security scanner for testing AI agents before production. It checks attack behavior such as prompt injection, goal hijacking, jailbreaks, unsafe output, and tool misuse. Instead of reviewing generated text alone, it evaluates tool calls, side effects, and outcomes. The site lists 11 modules and 153 attack vectors, covering eight of ten OWASP Agentic risks, with two in development. Crucible runs 90 attack payloads in under 60 seconds and produces an A–F report with severity, OWASP mapping, and reproduction steps. It supports LangChain, CrewAI, AutoGen, raw MCP endpoints, and agents with HTTP or MCP interfaces. The pip-installed CLI supports Python 3.10+. Local scanning needs no signup and has no telemetry by default. Community is free; Team and Enterprise add monitoring, dashboards, support, SSO, audit logs, deployment options, and custom modules.

Spec sheet

Purpose
Crucible stress-tests AI agents against attack vectors including prompt injection, goal hijacking, and tool misuse before production.Read 5 Oct 2026 · crucible-security.github.io
Intended users
The Community plan is for individual builders and open-source projects, and Team is for teams shipping agents to production.Read 5 Oct 2026 · crucible-security.github.io
Integrations
It supports LangChain, CrewAI, AutoGen, raw MCP endpoints, and agents with an HTTP or MCP interface.Read 5 Oct 2026 · crucible-security.github.io
Privacy
The site says local scanning requires no signup and has no telemetry by default.Read 5 Oct 2026 · crucible-security.github.io
Support
The Community plan lists Discord support, while Team lists priority support and Enterprise lists dedicated security engineering support.Read 5 Oct 2026 · crucible-security.github.io
License
The core engine and test modules are described as Apache 2.0 and free, with no feature gating on security tests.Read 5 Oct 2026 · crucible-security.github.io
Maker
The team page names Khalid Saifullah Sayyed as Founder & Core and says the team was built in 2026.Read 5 Oct 2026 · crucible-security.github.io
Attack coverage
The site lists 11 modules and 153 attack vectors, with 8 of 10 OWASP Agentic risks covered and two in active development.Read 5 Oct 2026 · crucible-security.github.io
CI/CD
The GitHub Actions integration can fail a build when an agent's security score drops below a configured threshold.Read 5 Oct 2026 · crucible-security.github.io
Install requirements
The CLI installs with pip, supports Python 3.10+, and the site says no Docker, cloud signup, or API key is needed to start.Read 5 Oct 2026 · crucible-security.github.io
Reports
Scans produce an A–F graded report with severity, OWASP mapping, and reproduction steps.Read 5 Oct 2026 · crucible-security.github.io
Scan speed
Crucible says it runs 90 attack payloads against an agent in under 60 seconds.Read 5 Oct 2026 · crucible-security.github.io
Testing approach
Crucible evaluates actual agent tool calls, side effects, and outcomes rather than only generated text.Read 5 Oct 2026 · crucible-security.github.io

Plans and prices

Community Free For individual builders and open-source projects · Full CLI & all 8 test modules · 153 attack vectors across 11 modules · Local & CI reports (JSON/HTML) · Community Discord support Read 5 Oct 2026 · crucible-security.github.io
Enterprise Priced on request Custom For orgs with compliance & scale requirements · Everything in Team · SSO, audit logs, on-prem / VPC deploy · Custom attack modules & SLAs · Dedicated security engineering support Read 5 Oct 2026 · crucible-security.github.io
Team Priced on request Early Access For teams shipping agents to production · Everything in Community · Drift monitoring & Slack alerts · Regression tracking · Hosted dashboards · Priority support Read 5 Oct 2026 · crucible-security.github.io

Every Crucible plan and price →

Strong points and limits

Strong points

  • Tests 153 attack vectors across 11 modules
  • Runs 90 payloads in under 60 seconds
  • Evaluates tool calls and side effects
  • Supports major agent frameworks and MCP
  • Free Apache 2.0 core engine

Limits

  • Two OWASP Agentic risks remain in development

Who it suits

Crucible suits individual builders, open-source projects, and teams shipping AI agents. Organizations with compliance or scale requirements can use its Enterprise plan.

Verdict

Crucible combines local agent attack testing with graded reports and CI integration. Its free Community plan covers core scanning, while paid tiers add monitoring, hosted management, and organizational controls.

Where Specifiction places it

Alternatives to CrucibleAll alternatives →