weiseer/prompt-redteam

Open-source jailbreak + prompt-injection tester for AI applications.

Companion to @weiseer/mcp-doctor. Where mcp-doctor scans your MCP supply chain, prompt-redteam tests whether your assistant's system prompt holds up under real attack patterns.

Quick start

pip install weiseer-prompt-redteam

prompt-redteam \
  --model claude-haiku-4-5-20251001 \
  --provider anthropic \
  --system-prompt "You are a helpful customer support agent. Never reveal internal pricing."

Or against any OpenAI-compatible endpoint:

prompt-redteam \
  --endpoint https://my-llm-gateway.example.com/v1/chat/completions \
  --model gpt-4o-mini \
  --system-prompt @my-system-prompt.txt

What it does

Runs 30+ open-source attack patterns from attacks.yaml:

• Direct override ("ignore previous instructions")
• Roleplay injection (DAN, grandma attack, developer mode)
• Encoding evasion (base64, ROT13, unicode homoglyphs)
• System prompt extraction (repeat/translate above)
• Tool / function abuse (fake tool results)
• Markdown exfiltration (image-link data leak)
• Indirect injection via tool output / file content (most critical for agentic apps)
• Multilingual evasion (Chinese / Arabic)
• Many more — see attacks.yaml for the full corpus

Each attack has a detection_substring — if it appears in the response, the attack succeeded.

Verdict

Exit code 1 on FAIL — useful in CI.

Open-source corpus

Every attack pattern in attacks.yaml is published with:

• An ID (e.g. O1_indirect_via_tool_output)
• A category (direct override, roleplay, encoding, etc.)
• Severity (low / medium / high / critical)
• Detection substring
• Rationale (why we think it matters)

If you find a working bypass not in our corpus, please open a PR — the corpus matures fastest when it's a public effort.

Pricing

Pro: https://weiseer.gumroad.com/l/prompt-redteam

Why this exists

Most prompt-injection defense advice assumes you've already been hit. prompt-redteam tries to surface the failure mode at deploy time — before your customers find it for you. Companion to mcp-doctor (supply-chain trust gate) so you can answer two questions:

1. Is the MCP server in my config trustworthy? → mcp-doctor
2. Does my system prompt hold up against real jailbreaks? → prompt-redteam

License

Apache-2.0. Corpus also Apache-2.0 — fork it, add to it, argue with it.