Skip to content
SPECIFICTION
Get listed

PyRIT

azure.github.io

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit azure.github.io
Spec score 7.6 #18 of 29 in AI Security Testing Tools

What it is

PyRIT is a free, open-source framework for automated and human-led red teaming of generative AI systems, aimed at assessing their security and safety. It supports single-turn and multi-turn attack strategies, including Crescendo, TAP, and Skeleton Key. Scenarios combine strategies and datasets for repeatable assessments of content harms, psychosocial risks, data leakage, and other objectives. Assessments can run through a command-line scanner, an interactive shell, the CoPyRIT graphical interface, or custom workflows. Documented targets include OpenAI, Azure, Anthropic, Google, Hugging Face, custom HTTP endpoints and WebSockets, and web apps tested with Playwright. Its modular components include targets, converters, scorers, memory, datasets, attacks, and scenarios. Converters can encode, obfuscate, translate, or semantically alter prompts, and transform among text, images, audio, video, and files. Scorers can return Boolean or normalized 0.0–1.0 scores using LLMs, Azure AI Content Safety, or custom logic. Built-in memory tracks conversations, scores, and attack results using SQLite or Azure SQL. PyRIT is self-hosted and requires a Python environment and configured AI endpoints.

Spec sheet

Purpose
PyRIT is an open-source framework for automated and human-led red teaming to assess the security and safety of generative AI systems.Read 30 Sep 2026 · microsoft.github.io
Security
PyRIT recommends Azure Key Vault for shared or deployed configuration and warns that plaintext .env files are less secure.Read 30 Sep 2026 · microsoft.github.io
Attack strategies
It supports single-turn and multi-turn strategies including Crescendo, TAP, and Skeleton Key.Read 30 Sep 2026 · microsoft.github.io
Compatibility limit
The local installation page lists Python 3.10 through 3.14 as prerequisites, and the contributor setup page requires Node.js 22 or higher for the frontend.Read 30 Sep 2026 · microsoft.github.io
Components
The modular framework includes targets, converters, scorers, memory, datasets, attacks, and scenarios.Read 30 Sep 2026 · microsoft.github.io
Credential handling
In CoPyRIT, an API key entered when creating a target is stored in memory only and is not persisted to disk.Read 30 Sep 2026 · microsoft.github.io
Installation
The documentation provides local installation with pip or uv and separate Docker installation options.Read 30 Sep 2026 · microsoft.github.io
Interfaces
Users can run assessments with the command-line scanner and interactive shell, use the CoPyRIT graphical interface, or build workflows with the framework.Read 30 Sep 2026 · microsoft.github.io
Memory
Built-in memory can track conversations, scores, and attack results using SQLite or Azure SQL.Read 30 Sep 2026 · microsoft.github.io
Prompt conversion
Converters transform prompts through text operations such as encoding, obfuscation, translation, and semantic changes, as well as conversions among text, images, audio, video, and files.Read 30 Sep 2026 · microsoft.github.io
Scenarios
Its scenarios package attack strategies and datasets for repeatable assessments of content harms, psychosocial risks, data leakage, and other objectives.Read 30 Sep 2026 · microsoft.github.io
Scoring
Scorers can return true/false or normalized 0.0–1.0 scores and can use LLMs, Azure AI Content Safety, or custom logic.Read 30 Sep 2026 · microsoft.github.io
Targets
Documented targets include OpenAI, Azure, Anthropic, Google, Hugging Face, custom HTTP endpoints and WebSockets, and web apps tested with Playwright.Read 30 Sep 2026 · microsoft.github.io

Plans and prices

PyRIT Free Open-source framework · requires a Python environment and configured AI endpoints Read 30 Sep 2026 · microsoft.github.io

Every PyRIT plan and price →

Strong points and limits

Strong points

  • Supports automated and human-led assessments.
  • Includes single-turn and multi-turn attack strategies.
  • Targets include web apps tested with Playwright.
  • Scorers support LLMs, Azure AI Content Safety, or custom logic.
  • Built-in memory can use SQLite or Azure SQL.

Limits

  • Requires a Python environment and configured AI endpoints.
  • Local installation lists Python 3.10 through 3.14.
  • Frontend contributor setup requires Node.js 22 or higher.

Who it suits

PyRIT suits people assessing generative AI security and safety who can configure AI endpoints and run a self-hosted framework. It offers both interactive interfaces and components for building workflows.

Verdict

PyRIT provides a broad set of red-teaming components and interfaces for assessing generative AI systems. It is self-hosted and depends on configured endpoints and a compatible Python environment.

Where Specifiction places it

Alternatives to PyRITAll alternatives →