Living Attack Library
A curated, continuously expanded evaluator library — every attack mapped to OWASP (LLM, Agentic, MCP, API) and MITRE ATLAS technique IDs, validated against the official ATLAS taxonomy.
OPERATIONAL DEPTH
Purpose-built for AI agent security - not retrofitted from traditional pentest tools
Multi-Turn Adversarial Campaigns
Runs real multi-turn attack sequences - prompt injection, tool hijacking, memory poisoning, not single-shot probes.
Reusable Configs
Opfor setup writes your entire test plan — target, suite, judge, and turn settings — to a single JSON file. Commit it to version control, share it with your team, and re-run it anytime to track changes run over run.
Severity-Graded Findings
Each finding graded with critical/high/medium/low and mapped to the standard it violates, so you know what to fix first, not just what's broken.
Autonomous Hunt Mode
Give OPFOR an endpoint and an objective — it does the rest. A multi-agent system (commander, operators, scout) runs its own campaign: recon, strategy, adaptive multi-turn probing, report. Watch the attack tree unfold live.
CI/CD Ready
Save a config once and re-run the exact suite on every deploy via the CLI or SDK. JSON reports drop straight into your pipeline — your red-team keeps pace as your agent evolves.
Compliance-Ready Reports
Findings map directly to OWASP (LLM, Agentic AI, MCP, API) and EU AI Act bias suites. Every scan automatically generates HTML reports for visual audits and JSON artifacts for CI/CD pipelines, ready to hand directly to your compliance team.
Trace Aware Testing
Connect OPFOR to Netra for end to end observability, evaluation and simulation capabilities, helping you evaluate every tool call, retrieval, and span — catching hidden failures before they ever reach the user.
Agent OPFOR EXPLAINED
STATUS:
Every AI agent in production is being tested. By curious users, by competitors, and increasingly by automated attackers. The only question is whether you’re testing it first.
A one-shot pentest gives you a snapshot. By the time the report lands, your prompts have changed, your tools have changed, and the attack landscape has changed. Agent OPFOR is the alternative: a dedicated opposing force on permanent payroll, probing your agent 24/7 with a living library of adversarial techniques.
CORE_LOGIC_PATH
Agent OPFOR's attack agents run real multi-turn campaigns :- direct and indirect prompt injection, jailbreaks, system prompt extraction, tool-call hijacking, PII and secret leakage, policy circumvention, social-engineering pivots across turns. Not single-prompt fuzzing. Actual adversary behavior. Every attempt is traced, every successful exploit is graded by severity, and every finding maps to OWASP, MITRE ATLAS, and EU AI Act.
Then it plugs into your pipeline. Save any run as a config and wire it into CI — the same suite re-runs every time you deploy, so a fix you ship stays verified and a regression shows up on the very next run. Every result is reproducible and fully logged. Your security team gets evidence, not anxiety.
Frequently Asked Questions
AI Red Teaming & Agent OPFOR, Explained
Agent OPFOR is an open-source adversary emulation tool that red-teams AI agents, LLM apps, and MCP servers — generating real attacks (prompt injection, jailbreaks, tool misuse) and scoring the target's responses with an LLM judge. It's built by KeyValue Software Systems and licensed Apache 2.0.
AI agents are non-deterministic — the same input can produce different outputs, so assert response === expected doesn't work. Vulnerabilities can also surface only after several turns (e.g., turn 7 of 12) or live in tool calls and memory rather than the visible reply, which standard functional testing misses entirely.
Traditional pentests are point-in-time: a team attacks for a week, delivers a report, and leaves — by which point the model or tools have already changed. OPFOR runs continuously (every deploy, every night) and auto-converts confirmed exploits into regression tests so fixes don't silently regress.
Prompts, tool calls, MCP server endpoints, agent memory, and multi-turn reasoning chains — not just single-shot model outputs. It covers the full agent surface, from LLM-level jailbreaks to MCP-level scope escalation.
OWASP LLM Top 10 (2025), OWASP Agentic AI Top 10, OWASP MCP Top 10 (2025), OWASP API Security Top 10, and EU AI Act bias suites (age, gender, race, disability).
No. The CLI and SDK are for engineers, but the browser extension lets anyone — PMs, QA, designers — red-team a deployed chatbot by clicking an icon on the chat UI. No code, no environment variables, no YAML.
It means OPFOR's LLM judge can see an agent's internal tool calls and retrieval steps (via Langfuse or Netra integration), not just its final reply. This catches issues that never reach the visible output — like PII leaking into a tool call or an MCP scope escalation that doesn't change the response text.
Most tools cover one layer well — Promptfoo for LLM-level probes, DeepTeam for Python-native agents — but require stitching multiple tools together for full coverage. OPFOR combines LLM, Agentic AI, MCP, and API Top 10 coverage in one tool with one report format.
Yes. It's Apache 2.0 licensed — free to fork, modify, and embed in commercial products, with no paywalls or usage tiers in the open-source version. The only requirement is preserving the license notice.
Yes. OPFOR attacks the external interface — the same surface a real attacker would use — so it doesn't need source code or internal access. The browser extension specifically targets the visible chat UI layer.
Yes, two ways: the CLI in two-step mode (opfor setup then opfor run --config) for pipeline steps, or the SDK directly inside your test suite. It outputs a JSON report you can parse for pass/fail gating.
An autonomous red-teaming mode: give it an endpoint and an objective (e.g., "find jailbreaks and system-prompt leakage") and a three-role agent system — commander, operators, scout — runs an adaptive, multi-round attack campaign without a config file, surfacing unknown vulnerability classes that fixed test suites miss.
OpenAI, Anthropic, Google Gemini, Groq, and any OpenAI-compatible endpoint (LiteLLM, OpenRouter, Azure, Ollama) — set the relevant API key as an environment variable and OPFOR auto-detects it.