promptfoo: eval and red-team your prompts from a YAML file

promptfoo turns "the new prompt feels better" into a table you can read in two minutes. You list prompts, models and test cases in one YAML file; it runs every combination, checks each output with code or an LLM judge, and shows a pass or fail grid. The same file runs in CI and fails the build when quality drops, and a second mode attacks your app with generated jailbreaks and injections.

promptfoo is a command-line tool and Node.js library for evaluating and red-teaming LLM applications. It runs locally: your prompts, keys and results stay on your machine unless you choose to share them. The core idea is a matrix. Two prompts, three models and twenty test cases give 120 runs, each scored by the assertions you attach.

• Prompts are templates with {{variables}}, inline or loaded from files.
• Providers are the models or apps under test: OpenAI, Anthropic, Google, Bedrock, Ollama and dozens more, or your own HTTP endpoint, Python function or script.
• Tests supply variables and assertions. Deterministic checks (contains, regex, JSON schema, JavaScript or Python functions) run first; model-graded checks (llm-rubric, factuality, g-eval, RAG metrics) use a judge model for what code cannot check.
• Outputs go to a local web viewer, JSON, CSV, HTML or JUnit XML, and the CLI exits with code 100 when tests fail, which is what makes it a CI gate.

On March 9, 2026, Promptfoo announced it had agreed to be acquired by OpenAI. The README now says promptfoo "is now part of OpenAI" and "remains open source and MIT licensed", and the announcement commits to keep supporting a wide range of providers and models. The CLI is free; Enterprise and on-premises plans add team dashboards, continuous monitoring, SSO and support at custom prices.

In the stack, promptfoo is an offline evals tool. It sits in your repository and your CI pipeline, before deployment. It does not trace production traffic; that is the job of Langfuse, Braintrust or an OpenTelemetry pipeline.

Pick promptfoo when:

• You change prompts or models and want proof nothing broke. A pull request that edits a prompt runs the suite and fails if the pass rate drops below your bar.
• You are choosing a model. Run the same tests on three providers and compare pass rate, cost and latency side by side.
• You need a pre-launch security check. The red team mode generates hundreds of adversarial inputs mapped to the OWASP LLM Top 10, NIST AI RMF and MITRE ATLAS presets and reports what got through.
• Your team prefers config to code. A YAML file is reviewable by people who would never open a Python eval harness.

Pick something else, or pair it, when:

• You need production observability or human review queues. promptfoo keeps local eval history, not live traces with annotation workflows. Braintrust and Langfuse cover that.
• You run agent benchmarks in sandboxes. Inspect AI has Docker and Kubernetes sandboxes and agent scaffolds built for that.
• You want the prompt itself optimized. DSPy searches for better instructions and examples against a metric; promptfoo measures the prompts you give it.

One governance point: promptfoo is now owned by a model vendor. The MIT licence means you can fork it if its direction ever stops suiting you, and it still treats every provider as a first-class target.

A run expands the matrix, calls each provider, scores each output and stores the result:

1. Expand. Each test's vars fill every prompt template. defaultTest holds variables and assertions shared by all tests.
2. Call. Each rendered prompt goes to each provider, with responses cached on disk for 14 days by default, so re-running an unchanged suite costs nothing.
3. Score. Each assertion returns pass or fail and a score from 0 to 1. Any assertion can be negated with a not- prefix (not-icontains), weighted with weight, grouped into an assert-set with its own threshold, and tagged with a metric name that becomes a column in the viewer.
4. Judge. Model-graded assertions call a grading model. promptfoo picks a default judge from the credentials it finds; set your own with defaultTest.options.provider, a per-assertion provider, or --grader on the command line.
5. Report. promptfoo view opens the grid. The exit code is 0 when everything passes, 100 when a test fails or the pass rate is under PROMPTFOO_PASS_RATE_THRESHOLD, and 1 for other errors.

Order your checks from cheapest to most expensive. A regex or JSON schema check is free, instant and never flaky; reach for an LLM judge only for qualities code cannot see, such as tone or faithfulness to a source.