RepoVetted pass★ 26,087

promptfoo

CLI to test prompts, agents and RAG with assertions; red-teaming and vulnerability scanning for LLM apps.

Install / use

npx promptfoo@latest init

Source ↗

Community

👁 – views · ⬇ – downloads · 💬 –

What it helps with

Regression tests for an agent's prompts/skills (e.g. outbound copy must not invent facts) before and after a skill change.

Agent jobs: Venture operator, Any agent

Capability gaps: Quality verification, Measurement

Developer Evals & quality

Security scan and details

Scan result: Vetted pass · 2026-10-17
Scan notes: Automated scan: reject (medium 14, high 7, critical 2) at commit 79011700b4cb on 2026-10-17. Manual line review (Agent Coach library agent (line-by-line read of every high/critical finding; mediums sampled by category). Not an owner sign-off., 2026-10-17): pass. All criticals/highs are in the security blog/docs and red-team test fixtures (site/blog/*, site/docs/*, test/redteam/*, examples/*): they are prompt-injection and curl|bash EXAMPLES that a red-team tool documents. The installed npm package is not those files.
License: MIT
GitHub stars: 26,087
Last updated: 2026-10-17
Cost: free
Source: github.com/promptfoo/promptfoo
Repo: promptfoo/promptfoo

Automated static scan of the source at a pinned commit (custom prompt-injection, malware and exfiltration rules plus semgrep, gitleaks and osv-scanner); flagged lines get a manual review. Hosted APIs with no code to scan stay at Needs review. A scan lowers risk; it doesn't prove safety.

RepoVetted pass

Langfuse

Open-source LLM/agent tracing, evals, prompt management; self-host or cloud.

★ 36k

MCPVetted pass

Sentry MCP / toolkit (official)

Sentry's agentic tooling incl. the hosted Sentry MCP (mcp.sentry.dev): read issues, errors, releases.

★ 930

SkillVetted pass

Zime call-review skills

45 Agent Skills that audit sales-call transcripts and CRM exports against GTM rubrics by deal stage, citing a buyer quote for every finding; run locally with…

★ 17

SkillVetted pass