Promptfoo

What it is

Promptfoo is a testing and evaluation framework for LLM applications — prompts, agents, and RAG pipelines. It runs structured test cases against your prompts/models and scores outputs against assertions (exact match, semantic similarity, LLM-graded rubrics, custom functions). Beyond eval, it does red teaming: automated adversarial probing for jailbreaks, prompt injection, PII leakage, and other vulnerability classes specific to LLM apps. Config is declarative YAML, runs from the CLI or CI/CD, and it supports side-by-side comparison across GPT, Claude, Gemini, Llama, and other model backends. Think of it as the pytest-plus-security-scanner combo for the LLM layer of your stack.

Who builds it and why

Founding date isn't publicly available, but the project has real traction: 22.8k GitHub stars, 307 contributors, active commits through mid-2026. It's used internally by OpenAI and Anthropic, which is a strong practitioner signal — teams building foundation models are using it to test their own prompt layers and downstream integrations. This isn't a weekend side project; it's building toward being the default eval/red-team layer for LLM app development, similar to how Postman became default for API testing. TypeScript codebase, MIT licensed.

Production readiness signal

Strong. 307 contributors and continuous commits (latest activity July 2026) indicate an active, non-abandoned project. MIT license removes adoption friction — no copyleft concerns for commercial use. The code-scan-action-0.1.8 release suggests they're building out GitHub Action integrations for CI/CD-native scanning, which is the right move for a tool meant to sit in a pipeline rather than run ad hoc. No CNCF maturity data (not publicly available) — this isn't a CNCF project, so don't expect that governance model. Adoption by OpenAI and Anthropic is the strongest available proxy for production-grade reliability, since those teams have low tolerance for flaky tooling.

Who should use this

• Teams shipping LLM-based products (chatbots, agents, RAG systems) who need regression testing before every prompt/model change ships to prod.
• Security/AppSec teams that need automated red-teaming for prompt injection, jailbreaks, and data leakage as part of a pre-release gate.
• Platform teams standardizing prompt evaluation across multiple models (GPT vs Claude vs Gemini vs Llama) to make vendor/model-switching decisions based on data, not vibes.
• Anyone who wants LLM testing to live in CI/CD like unit tests, not as a manual "looks good to me" review.

Who should NOT use this

• Teams with no existing CI/CD discipline — Promptfoo's value compounds when it's gating merges/deploys; used manually and sporadically, it's just overhead.
• Organizations needing a fully managed, compliance-certified red-teaming service with audit trails and SLAs — this is a self-hosted OSS tool, you own the operational and compliance burden.
• Teams evaluating classical ML models (not LLMs) — this tool is scoped specifically to prompt/LLM-based systems, not general model evaluation.
• If you need deep, novel adversarial ML research (data poisoning, model extraction, gradient-based attacks) — Promptfoo's red-teaming is scoped to LLM-application-layer vulnerabilities, not attacks on model weights or training infrastructure.

Alternatives

• LangSmith (LangChain) — tightly integrated eval/observability for LangChain-based apps, more opinionated toward that ecosystem.
• Giskard — open-source ML/LLM testing focused heavily on bias, fairness, and vulnerability detection with a strong scanning UI.
• Ragas — narrower scope, focused specifically on RAG pipeline evaluation metrics rather than general prompt testing or red-teaming.

Pricing

Fully open source under MIT. Core CLI and red-teaming features are free with no paid tier gating functionality in the OSS repo. Promptfoo also offers a hosted/enterprise product (team collaboration, hosted dashboards) — check their site for current pricing, as that's commercial and not part of the OSS release cadence tracked here.