NVIDIA

garak

NVIDIA's LLM vulnerability scanner: nmap-style probing for jailbreaks, prompt injection, data leakage, toxicity and hallucination across dozens of model endpoints.

8,452 1,094 Python Apache-2.0updated 2 days ago

security

View on GitHub Dispute this mapping →

Curator's take

Run it before anything LLM-shaped ships: static, dynamic and adaptive probes for jailbreaks, injection, leakage and toxicity, with reports that name the failing probe and prompt — nmap for language models. Speaks to HF, OpenAI-compatible, Ollama and REST endpoints, so it tests what you actually deploy. NOT a guardrail — it finds holes, it doesn't plug them (pair with a runtime defense); a full probe run takes hours, and a clean scan tests the MODEL, not your product logic around it. Authorized targets only.

Mapped by ShipWithAI editors · links verified

README.md

garak, LLM vulnerability scanner

Generative AI Red-teaming & Assessment Kit

garak checks if an LLM can be made to fail in a way we don't want. garak probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other weaknesses. If you know nmap or msf / Metasploit Framework, garak does somewhat similar things to them, but for LLMs.

garak focuses on ways of making an LLM or dialog system fail. It combines static, dynamic, and adaptive probes to explore this.

garak's a free tool. We love developing it and are always interested in adding functionality to support applications.

Get started

> See our user guide! docs.garak.ai

> Join our Discord!

> Project links & home: garak.ai

> Twitter: @garak_llm

> DEF CON slides!

LLM support

currently supports:

hugging face hub generative models
replicate text models
openai api chat & continuation models
aws bedrock foundation models
litellm
pretty much anything accessible via REST
gguf models like llama.cpp version >= 1046
.. and many more LLMs!

Install:

garak is a command-line tool. It's developed in Linux and OSX.

Standard install with `pip`

Just grab it from PyPI and you should be good to go:

python -m pip install -U garak

Install development version with `pip`

The standard pip version of garak is updated periodically. To get a fresher version from GitHub, try:

python -m pip install -U git+https://github.com/NVIDIA/garak.git@main

Clone from source

garak has its own dependencies. You can to install garak in its own Conda environment:

conda create --name garak "python>=3.10,<=3.12"
conda activate garak
gh repo clone NVIDIA/garak
cd garak
python -m pip install -e .

OK, if that went fine, you're probably good to go!

Note: if you cloned before the move to the NVIDIA GitHub organisation, but you're reading this at the github.com/NVIDIA URI, please update your remotes as follows:

git remote set-url origin https://github.com/NVIDIA/garak.git

Getting started

The general syntax is:

garak <options>

garak needs to know what mode

Continue your stack

What teams reach for next — and why each earns a place beside garak. Ranked by curator confidence.

Pairs well with

Guardrails

NVIDIA's programmable guardrails for LLM apps: input, output, dialog and retrieval rails defined in Colang, wrapping any model or LangChain runnable.

Why it fitsAttack and defend: garak red-teams the model to find jailbreaks and injection holes, NeMo Guardrails is the runtime rail you deploy to police them — scan, patch rails, re-scan.

Ollama

Run Llama, Mistral and other open models locally with a single command and a clean API.

Why it fitsgarak ships an Ollama generator — point the scanner at your locally served model and red-team it before exposing it to users.

Alternative to See all + compare →

deepteam

Open-source red-teaming framework for LLM systems: 50+ vulnerabilities, jailbreak/injection/multi-turn attacks against agents, RAG pipelines and chatbots — plus guardrails. Runs locally.

Why it fitsSame job — adversarial testing of LLM systems. garak is the nmap-style scanner you point at a model endpoint; DeepTeam is the framework you embed in your eval suite, with attack simulation and guardrails in one loop.

giskard-oss

Giskard v3: modular Python evals and red-teaming for agentic systems — scenario-based checks with LLM-as-judge, plus an automatic vulnerability scanner across OWASP LLM Top-10 categories.

Why it fitsSame scanning job, different shapes: garak is NVIDIA's nmap-style standalone prober across dozens of model endpoints; giskard-scan is a library-first scanner designed to live inside your Python test suite next to your evals.