No. 12 of 29 ·AI Security Testing Tools

LLMMap

Linux

Visit site Alternatives

Freedom report

Two barsScore 6.3

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

LLMMap is ranked #12 of 29 in AI security testing tools on Freedom251. It runs on Linux. There is a free plan.

LLMMap plans and pricing

All plans

LLMMap Free No charge stated; publicly available under the MIT license. Python >= 3.11 · Requires an LLM backend; Ollama is local, while cloud backends may require API keys github.com · 4 Oct 2026

Compared on AI security testing tools

Prompt injection tests: Yes
Jailbreak tests: Yes
Data leakage tests: Yes
Deployment mode: self_hosted

Best LLMMap alternatives

See all 20

Two bars AIRTA Red Team Free tier No. 1Free6.6 Two bars OpenSecureAI Scanner Free tier No. 2$49/mo6.6 Two bars Project Moonshot Free tier No. 3Free6.6 Two bars Promptfoo Free tier No. 4Free6.6 Two bars PromptGuard Free tier No. 5$19/mo6.6 Two bars PyRIT Free tier No. 6Free6.6

The record

Purpose: LLMMap tests LLM-integrated applications for prompt injection by discovering HTTP injection points, generating targeted prompts, and checking findings for reliability.
Prompt coverage: It includes 227 prompt injection techniques across 18 attack families in four prompt packs.
Detection: A Generator LLM creates goal-aware prompts and a Judge evaluates target responses; detector signals can include heuristics and optional semantic similarity.
Supported LLMs: The documented backends are Ollama, OpenAI, Anthropic, and Google, with Ollama as the local default that needs no API key.
Request input: Targets can be supplied as a URL or a Burp Suite request export, with an asterisk marking an injection location.
Burp Suite: LLMMap reads Burp Suite request exports natively and lists proxy support for traffic inspection.
Injection locations: It supports injection in query parameters, request bodies, headers, cookies, and paths.
Obfuscation: Its listed obfuscation methods include base64, homoglyphs, leet speak, and language switching.
Reliability: Candidate findings are re-tested using Wilson confidence intervals; the documented defaults are five retries and three confirmations.
Safety: Safe mode is enabled by default and restricts scans to low-risk prompt families, while risky families such as tool abuse and system override are blocked.
Data handling: Scan workspaces store request metadata, configuration, and timing; sensitive prompt text and response bodies stay in memory and are not written to disk by default.
Dry run: Dry-run mode plans a scan and selects prompts without making network connections to the target.
Notable limits: The architecture document says adaptive TAP and out-of-band detection modules are reserved for future versions and inactive in the v1.0.0 scan pipeline.
Intended users: The project describes LLMMap as a security testing tool for authorized use and says to test only systems owned by the user or covered by explicit written authorization.
Price from: Free

Where it ranks on Freedom251

Best AI Security Testing Tools in 2026#12 of 29

Is LLMMap yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote LLMMap

Sources

github.com/Hellsender01/LLMMap· checked 4 Oct 2026
github.com/Hellsender01/LLMMap/blob/main/docs/ARCH· checked 4 Oct 2026
github.com/Hellsender01/LLMMap/blob/main/docs/AUTH· checked 4 Oct 2026