garak vs Promptfoo

garak is a command-line scanner for probing language models and systems that use them for security weaknesses. Its checks cover issues such as hallucination, data leakage, prompt injection, misinformation, toxicity generation, and jailbreaks. Probes try to elicit failures, while detectors inspect responses for patterns such as unsafe content or a failure to refuse. A standard scan can run without supervision and produce a report, with scan settings available for customization. Integrations include OpenAI, Hugging Face, Cohere, Replicate, AWS Bedrock, LiteLLM, REST-accessible models, and custom Python integrations. Hugging Face models can run locally or be accessed through an inference API or private endpoint. Output includes screen results, a detailed report log, a hit log, and a debug log. garak assesses text output only. It is developed in Linux and OSX and can be installed with pip or from source; listed platforms include Linux, macOS, Windows, and self-hosted use. It is free, with a free plan and no free trial. Listed capabilities include custom metrics, LLM-as-a-judge, and safety evaluations.

Promptfoo helps developers and enterprises evaluate prompts and test AI applications for security risks. It compares prompt outputs across multiple models in a web view. Red-team testing simulates users to look for prompt injections, jailbreaks, data leaks, business rule violations and insecure agent tool use. Its getting-started guide lists more than 60 providers, including OpenAI, Anthropic, Google and local models such as Ollama. Integrations include CI systems such as GitHub Actions, GitLab CI, Jenkins, Azure Pipelines, CircleCI and Bitbucket Pipelines, plus Splunk, Burp Suite, Google Sheets and MCP. Installation is available through npm, npx or Homebrew. Promptfoo requires Node.js 22.22.0 or newer and recommends Node.js 24 LTS. The free Community plan includes all LLM evaluation features and 10k red-team probes per month, and can run locally or be self-hosted. Enterprise includes managed cloud deployment; On-Premise runs on customer infrastructure. Promptfoo says it is based in San Francisco, is now part of OpenAI and remains open source.