Garak sends prompts from a catalogue of about 190 probes, scores the answers with detectors, and writes every attempt to a report. Point it at a Python function and it scans your whole application rather than the model underneath it.
Reach for it when
- You want a catalogue of known attacks rather than ones you invent
- You need evidence of what was tested, kept in a file
- You want a scan in CI with a limit you choose
Look elsewhere when
- You want to build one attack and control the conversation. That is PyRIT
- You want to stop bad answers rather than find them. That is a guardrail
What the lessons will cover
- 01Probing by hand, and where it stops
- 02Your app as a function generator
- 03Probes and --spec
- 04Reading what a probe sends
- 05Detectors, and swapping them
- 06Judging answers yourself
- 07The report and one attempt
- 08Attack success rate
- 09Buffs and tags
- 10Failing a build on a scan
Others in red teaming
Common questions
Is Garak free to use?
Garak is open source and free to run yourself. You still pay whichever model provider you point it at, and this tutorial is free with no signup.
Do I need to know Python to use Garak?
Basic Python is enough. Functions, dictionaries and imports cover most of what Garak asks of you.
When should I not use Garak?
You want to build one attack and control the conversation. That is PyRIT. You want to stop bad answers rather than find them. That is a guardrail.
Lessons for Garak are being written. Meanwhile the Agent Governance Toolkit tutorial covers the same ground: state, tools, loops, memory and human approval. Most of it carries straight over.
Start the Agent Governance Toolkit tutorial →