Crucible vs OpenSecureAI Scanner

Crucible is a self-hosted security scanner for testing AI agents before production. It checks attack behavior such as prompt injection, goal hijacking, jailbreaks, unsafe output, and tool misuse. Instead of reviewing generated text alone, it evaluates tool calls, side effects, and outcomes. The site lists 11 modules and 153 attack vectors, covering eight of ten OWASP Agentic risks, with two in development. Crucible runs 90 attack payloads in under 60 seconds and produces an A–F report with severity, OWASP mapping, and reproduction steps. It supports LangChain, CrewAI, AutoGen, raw MCP endpoints, and agents with HTTP or MCP interfaces. The pip-installed CLI supports Python 3.10+. Local scanning needs no signup and has no telemetry by default. Community is free; Team and Enterprise add monitoring, dashboards, support, SSO, audit logs, deployment options, and custom modules.

OpenSecureAI Scanner checks untrusted text for patterns that may indicate prompt injection, jailbreaks, system-prompt leaks, or data exfiltration. Its scanPrompt library API returns a 0–100 score, a risk level, and findings for individual rules. Developers can access it as an npm package, CLI, GitHub Action, or REST API; the package targets Node 18+ and has zero runtime dependencies. Authenticated hosted API calls add detections for obfuscation and encoding evasions, indirect injection, tool abuse, multilingual overrides, and de-obfuscation. The LLM Gateway can route prompts to a selected OpenAI, Anthropic, xAI, or Groq provider and scan the response. Documentation says authenticated scans save a summary to the dashboard but do not store raw prompt text; gateway provider keys are not stored or logged. Free access includes in-browser tools and npm packages, while the anonymous API uses the basic engine with IP rate limiting. The Free plan lists 2,000 API requests per month. Pro costs $49 a month, but paid checkout is not self-serve and requires contacting sales.