| title | Introduction |
|---|---|
| description | Open-source adversary emulation for AI agents, LLM apps, and MCP servers. |
Opfor is an open-source red-teaming toolkit for AI agents and MCP servers. It generates OWASP-mapped attack prompts, fires them at your target, and judges each response with an LLM. You get an HTML report for browsing and a JSON report for CI.
Test your AI the way a real attacker would — from your terminal, your IDE, a browser extension anyone on your team can use, or your own code.
Run your first scan and get a report in a few minutes. Targets, evaluators, suites, judging, and reports.Different people on your team need different entry points. Opfor ships five, all sharing the same evaluators, attack templates, and judge logic.
`opfor setup` → `opfor run`. For engineers, CI, and terminal-first workflows. Click the icon on any chat UI. No code — for QA, PMs, and security analysts. Run opfor as an MCP server so Cursor or Claude Desktop can drive it. `/opfor-setup` and `/opfor-run` slash commands inside your AI coding agent. `@keyvaluesystems/agent-opfor-sdk` — run scans programmatically from your own Node code.Opfor picks its pipeline from your target type.
| Target | What it is | How it's attacked |
|---|---|---|
agent |
An HTTP endpoint or local script that speaks LLM chat | The attacker LLM writes adversarial prompts; opfor sends them and judges the reply |
mcp |
An MCP server (stdio process or remote URL) | Opfor enumerates tools, crafts adversarial tools/call payloads, and judges them |
Use agent mode for chatbots, RAG apps, and tool-calling agents behind an HTTP API. Use mcp mode to attack an MCP server directly.
Opfor ships curated suites mapped to industry standards — OWASP LLM Top 10, OWASP Agentic AI Top 10, OWASP MCP Top 10, OWASP API Security Top 10, and EU AI Act bias. Pick a suite for broad coverage or run individual evaluators for a focused scan.
Full list of evaluators and suites with their OWASP mappings.