KavachRT is the open-source AI red-team framework. An autonomous operator attacks your LLM or AI system, adapts as it finds weaknesses, and returns a reproducible security score and go/no-go — before you ship.
Open source · AGPL-3.0 Free forever. · pip install kavachrt
Install the Framework, point it at a target you own, and get a reproducible score and go/no-go. Free and AGPL-3.0 — no signup, no key.
Anyone can run a probe once. KavachRT reasons over the results and escalates — the way a human red-teamer would, at machine speed.
An LLM orchestrator plans attacks, detects weaknesses, mutates its strategy, and re-attacks in a governed feedback loop — not a fixed pipeline.
A genuinely powerful free Framework — console, modules, and the full agentic loop. Pro adds scale, collaboration, and compliance.
A LiteLLM-backed target layer attacks hosted APIs and self-hosted models (Ollama, vLLM) alike. Bring your own model.
The 0–100 security score and go/no-go are computed deterministically — defensible enough to gate a CI pipeline.
Every finding maps to the OWASP LLM Top 10, MITRE ATLAS, and Google SAIF — comparable, auditable, and ready for review.
Authorization gating, budget caps, redaction, and sandboxing are built in. For authorized testing only.
The differentiator a static pipeline structurally can't match: it learns from each result and decides what to try next — energizing one stage after the next, then feeding back.
Baseline sweep across OWASP-LLM categories on your target.
The orchestrator reads findings and spots what's exploitable.
It picks targeted, adaptive attacks and adjacent categories to probe.
Multi-turn attacks escalate against the weak spots.
Deterministic re-scoring, then loop or decide go/no-go.
max iterations · cost cap · convergence, so it always terminates.The whole kavachrt CLI and the
krtconsole REPL as an interactive
mind-map — click a node to branch out its options and read what each one does. Toggle
CLI ↔ Console and Map ↔ List inside the explorer.
Every scan returns a self-contained, standards-mapped report: a deterministic score and go/no-go, findings mapped to OWASP-LLM / MITRE ATLAS / Google SAIF, redacted evidence, and the operator's full reasoning trail. Defensible enough to gate a release — or hand to an auditor.
Real output from kavachrt scan against the built-in demo target — no login required.
Push scan results from the CLI to a shareable dashboard — score-over-time, findings, and team access. Self-host it (Docker / Kubernetes) or use the hosted version. Opt-in, and the sealed evidence never leaves your machine.
kavachrt push sends a redacted report to your workspace — the raw payloads and planted-secret evidence stay local.
Score-over-time per target, new vs resolved findings, and a decision timeline — the picture a single self-contained report can't show.
Organizations, projects, roles, and in-app notifications. Self-hostable and open — a bonus for the community.
Start with the open-source Framework. Upgrade to Pro when you need scale, teams, and compliance.
Straight answers about what KavachRT is, how it works, and how to use it responsibly.
KavachRT is an open-source, agentic AI red-teaming framework that autonomously attacks an AI system such as an LLM app or API, adapts its strategy as it finds weaknesses, and returns a reproducible security score and a go/no-go decision. It is often described as “Metasploit for AI.”
Unlike a static scanner that runs a fixed checklist, KavachRT is an autonomous operator: an LLM-driven orchestrator runs a governed feedback loop — scan, detect a weakness, mutate its strategy, re-attack, and re-score — bounded by a maximum iteration count, a budget cap, and convergence, so it adapts to the target instead of replaying the same probes.
KavachRT tests hosted LLM apps and API endpoints, including OpenAI-compatible and self-hosted models, and can also scan a codebase for AI-related risk. Targets are specified as api:, mock:, or code:.
Yes. KavachRT is open-core: the KavachRT Framework is free and open source under the AGPL-3.0 license, installable with pip install kavachrt, and a commercial KavachRT Pro adds managed and team features.
Findings are mapped per-probe to the OWASP LLM Top 10, MITRE ATLAS, and Google SAIF, and each report is stamped with the taxonomy version it scored against. Coverage is reported honestly: categories that were not tested are shown as “not covered” rather than as a pass.
The score is deterministic and reproducible and is never graded by an LLM, so the same scan yields the same score. Each scan returns a CI-gating exit code: 0 means GO, 1 means NO-GO, and 3 means INCONCLUSIVE when nothing was actually tested.
KavachRT is a dual-use security tool built for authorized testing only. Active attack modules require you to attest that you own the target, and any leaked-secret evidence is sealed and never leaves your machine.
Get the open-source framework today, or talk to us about Pro for your team.