Respan security

Adaptive security testing for AI agents.

Respan profiles your agent, chooses attack strategies, adapts after refusals, and produces an evidence-backed, OWASP-aligned report.

Only scan systems you own or are authorized to test.

Quickstart

The fastest path: paste this into your coding agent (Cursor, Claude Code, Codex, etc.):

Fetch https://www.respan.ai/redteam-setup.txt
and follow it to create adapter.py for my agent, then tell me how to run the scan.

That setup guide walks the agent through installing the CLI, writing a small adapter.py that talks to your system, and running your first scan. Prefer that over hand-writing the protocol.

To set up manually instead (requires Python 3.11+ and a Respan API key):

1. Install

pip install respan-redteam

2. Sign in

Get an API key at platform.respan.ai/platform/api-keys, then:

respan-redteam auth login

Paste your API key when prompted (characters echo as *). The key is stored in your OS credential manager, or in ~/.config/respan-redteam/.credentials.json if that store is unavailable.

For CI / headless use:

export RESPAN_API_KEY="..."

3. Connect your agent

Write an adapter.py for your agent (see Examples & API below, or use the setup prompt above).

4. Scan

respan-redteam scan adapter.py

respan-redteam scan adapter.py --output report.json

Progress goes to stderr; the report goes to stdout or --output.

Commands

respan-redteam auth login|status|logout
respan-redteam config show|edit|path|set|use
respan-redteam scan ADAPTER [--local] [-o PATH] [--fail-under B]

Run respan-redteam <command> --help for options.

Hosted vs local

By default the attack engine runs on Respan (https://api.respan.ai). Your adapter stays on your machine and only exchanges user messages / replies. If the connection drops mid-scan, the CLI reconnects and resumes the same campaign. If the CLI itself stops (crash, Ctrl-C, closed terminal), running the same scan again within 30 minutes picks the campaign up from its last finished goal; pass --new to start over instead.

export OPENAI_API_KEY="..."
respan-redteam scan adapter.py --local --output report.json

Local mode runs the open-source engine on your machine. Non-secret settings live in ~/.config/respan-redteam/config.toml (respan-redteam config edit).

CI

RESPAN_API_KEY="$RESPAN_API_KEY" \
  respan-redteam scan adapter.py \
  --output redteam-report.json \
  --fail-under B \
  --quiet

Exit code 4 means the grade fell below --fail-under.

Examples & API

• examples/adapter_local.py — client-owned history
• examples/adapter_session.py — server-owned sessions
• SETUP — full adapter brief for coding agents

from respan_redteam import EngineConfig, LLMConfig, run_campaign
from adapter import TARGET

result = run_campaign(
    TARGET,
    config=EngineConfig(llm=LLMConfig(api_key="...", model_attacker="gpt-4.1")),
)
print(result.grade(), result.to_report())

Development

git clone https://github.com/respanai/respan-redteam.git
cd respan-redteam
uv sync
just test

Licensed under Apache 2.0.