GOVERNATLAS / PRODUCT DOSSIER

Promptfoo

Promptfoo documents a CLI and library for evaluating and red-teaming LLM applications with configurable metrics.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Separate ordinary regression evaluation from adversarial testing. Both can use repeatable inputs, but a red-team finding needs an explicit threat model, a safe test environment and an explanation of the boundary the attack was meant to cross.

What this record does not establish

The documented CLI and library support evaluation and red-teaming workflows. A clean run does not establish immunity to prompt injection, complete threat coverage or safe deployment of the tested application.

1 current source · 1 published assertion
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗

A test worth running

Run a small regression configuration and an authorized sandbox attack set against the same application version. Review the individual requests, observed outputs and pass conditions. Change one defense and rerun both attack cases and benign tasks to inspect security and usability together.

GovernAtlas editorial proposal. We have not performed this test.

Evidence to bring back

Preserve configuration, provider and application versions so another engineer can reproduce a reported failure.
Track benign-task failures alongside attack outcomes, with a named owner for each accepted exception.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

vendor asserted

Promptfoo documents a CLI and library for evaluating and red-teaming LLM applications with configurable metrics. Scope: vendor documentation only; edition and availability boundaries require confirmation.

Source, dates & preserved provenance

Promptfoo — official product or documentation page ↗

Authority: vendor owned
Observed 2026-10-14 · Reviewed 2026-10-15 · current until 2026-11-13

Artifact SHA-256: 13047613004cf6749a59ce966e123840e20a5ec9216cba1406085ff6dbd675e7

The hash identifies the preserved capture. The live source may have changed.

Source register

Promptfoo — official product or documentation page ↗vendor owned · captured 2026-10-14

Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

Which tests are local, and which integrations transmit prompts or findings to external services?

What deployment, retention and access-control evidence supports the intended use?

What underlying assurance documents are available, and which claims remain unverified?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗