Overview

garak approaches model security through adversarial probing: probes try to trigger failures, and detectors assess responses for problems such as unsafe content or failure to refuse. That makes it a focused choice for security checks rather than a broad model-evaluation dashboard.

It can run a standard scan and produce a report without supervision, while letting teams adjust scan configuration. Its stated threat coverage includes hallucination, data leakage, prompt injection, misinformation, toxicity generation, and jailbreaks. That range makes it useful for a structured first pass, though findings are limited to text output.

Key features

Integrations include OpenAI, Hugging Face, Cohere, Replicate, AWS Bedrock, LiteLLM, REST-accessible models, and custom Python integrations. Teams can apply the scanner across hosted services and locally run Hugging Face models, including models reached through an inference API or private endpoint.

Results include screen output, a detailed report log, a hit log, and a debug log. The separate outputs help teams review findings and investigate scan behavior. Support channels include a user guide, reference documentation, Discord, GitHub issues, and an NVIDIA email address. Security vulnerabilities should instead be reported through NVIDIA’s security submission form or psirt@nvidia.com, not GitHub.

garak is backed by NVIDIA and updated by NVIDIA and the community. It supports custom metrics and LLM-as-a-judge alongside safety evaluations, adding flexibility for teams shaping their assessment approach.

Pricing

garak is free open-source software. The Free plan costs 0.00 USD per free, with no free trial. That makes it a straightforward option for teams able to install and operate a command-line tool themselves; it does not present a paid tier for buyers seeking a different support or deployment arrangement.

Platforms

garak is available for Linux, macOS, and Windows, with self-hosted deployment. Developed in Linux and OSX, it can be installed with pip or from source. This suits teams that can manage a local or self-hosted workflow, but it is not a hosted web application.

Who it's for

Choose garak when you need configurable security probes across several model providers and want to run scans against local or hosted models. Its automated standard scan and multiple report outputs suit teams that need repeatable checks and follow-up detail. Look elsewhere if your assessment must include non-text outputs or you need a managed web-based service.

Pros and cons

Broad integration range: support for major hosted providers, REST-accessible models, and custom Python integrations helps teams use one scanner across varied environments.
Configurable automated scans: unattended standard scans provide a useful starting point, while configuration allows teams to tailor probing.
Useful report separation: detailed, hit, and debug logs give teams distinct ways to review results and troubleshoot.
Text-only scope: evaluations do not cover other output types, which rules it out for teams assessing multimodal behavior.
Command-line, self-hosted operation: installation via pip or source gives teams control, but requires them to manage the tool rather than use a hosted interface.

Alternatives

Promptfoo is worth considering if a monthly allowance of 10k red-team probes and a broader set of LLM evaluation features better fits your workflow; its Community plan is free and supports local or self-hosted runs across model providers and integrations.

Giskard is another free, open-source option for local deployment, with a basic LLM vulnerability scan using adversarial techniques and a basic RAG evaluation report.

DeepEval may suit teams seeking an open-source evaluation framework with a local and CI/CD test runner rather than garak’s security-focused scanning approach.

Arena (formerly Chatbot Arena) offers free public leaderboard comparisons and head-to-head battles, with a daily usage limit that resets after 24 hours.

Braintrust has a free Starter tier with 1 GB processed data, 10,000 scores, 14-day retention, unlimited users, projects, and datasets; it is a different fit for teams that need those evaluation and data limits.

Confident AI has a free tier capped at 2 user seats, 1 project, 5 test runs per week, and 1 GB-month of trace spans, for teams whose evaluation work fits within those limits.

Whisper is an alternative free, locally installable open-source code and model package, rather than a model-security scanner.

CloudSploit offers a self-hosted open-source version for readers looking for a different kind of security tool.

For broader discovery, see AI Red Teaming Tools, AI Security Testing Tools, and LLM Evaluation Tools.

Verdict

garak is a strong fit for teams that want free, configurable security probing across hosted and local language models, with automated scans and detailed logs. Choose it for text-focused model security checks; look elsewhere if you need non-text assessment or a hosted, graphical service.

	garak	HELM
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	Linux, macOS, self-hosted, Windows	api, self-hosted, Web
Free plan	Yes	—
Deployment options	self-hosted	self-hosted
Custom metrics	Yes	Yes
LLM-as-a-judge	Yes	Yes
Safety evaluations	Yes	Yes
Human review workflows	—	Yes

garak vs HELM

garak

HELM