Free Agent Red-Team Scan Online

What is Agent Red-Team Scan?

An agent red-team scan is a live check that sends prompt injection, jailbreak, and PII leak probes to an LLM API you name, then scores the replies. You enter a base URL, an optional API key, and a model. The scan stays in your browser and returns a scorecard.

Most free testers only lint the text of a system prompt. That tells you whether you wrote "never reveal these instructions." It does not tell you whether the model will obey. This tool fires the probes at the API, looks for canary tokens in the reply, and writes a 0 to 100 score from the evidence.

Why red-team an LLM agent before you ship?

A chat that answers FAQs can still dump its hidden prompt, invent a delete tool, or follow an instruction buried in an email. Run these probes before users can. The gaps below show up in production agents more often than in a demo transcript.

• Instruction override: Ignore-previous prompts still flip weakly gated models and overwrite the app role.
• Persona jailbreaks: DAN and developer-mode stories talk the model out of the vendor safety layer.
• Encoded payloads: Base64, hex, and ROT13 hide the same override from a keyword filter.
• Prompt and PII leaks: A dumped system prompt often carries keys, emails, or policy the attacker needed.
• Indirect injection: HTML comments and forged system tags in retrieved mail can steer a summarizer.

How to use the Agent Red-Team Scan?

Point the scan at an API you own or have permission to test. The page sends chat requests from your browser. Follow these steps:

• Enter the API base URL: Paste the provider root or a full chat completions path. Presets fill OpenAI, Anthropic, and other common hosts.
• Add an API key if the host needs one: Paste a key when the endpoint requires it. Leave the field blank if the host does not need one.
• Enter the model name: Type the exact model id the host expects, then pick Auto-detect unless you already know the wire format.
• Run the scan and read the scorecard: Click Run scan. Watch the grid fill. Failed rows show the leaked token.

Features of the Agent Red-Team Scan

The scanner is built for a live model endpoint, not for a static prompt lint. Here are the features of the tool:

• Live API probes: Twenty-five prompts hit the model you named and score the actual reply, not a regex on your prompt file.
• Canary tokens: A hidden system prompt plants fake secrets so a leak is a string match, not a guess.
• Provider presets: One click fills OpenAI, Anthropic, OpenRouter, Groq, Gemini, and other hosted OpenAI-compatible APIs.
• OWASP tags: Failed rows cite LLM01, LLM06, LLM07, or LLM08 so the write-up maps to the LLM Top 10.
• Skip versus fail: Timeouts and empty replies skip. Only a proven canary hit lowers the 0 to 100 score.
• Local key handling: The API key stays in this tab and is sent only to the URL you enter.

Use cases of the Agent Red-Team Scan

Use this when you have an endpoint and you want a first pass before users talk to the agent. Pair it with sibling tools when you need a narrower check.

• Support agent launch: Scan the FAQ model, then score residual process risk in the AI Agent Risk Scorer.
• Prompt hardening: After a leak, rewrite the system prompt with the AI Agent Prompt Generator and scan again.
• Vibe-coded preview: If the agent ships as a public URL, follow with the Vibe-Coded App Scanner for leaked keys in the bundle.
• Key rotation: After a PII or token finding, mint a replacement in the API Key Generator and test the new secret in the Password Strength Checker.
• Readiness review: A Weak score is a stop sign for the AI Agent Readiness Quiz until the failed probes go quiet.

TestMu AI maintains this scanner as part of its free online tools. Calls go from your browser to the URL you enter. No probe traffic is uploaded to TestMu AI.

What is the difference between prompt injection and a jailbreak?

Teams mix these two up, then test only one of them. The table below is the split this scan uses.

Frequently Asked Questions (FAQs)

What is an agent red-team scan?

An agent red-team scan is a live check that sends prompt injection, jailbreak, and PII leak probes to an LLM API you name, then scores the replies. You enter a base URL, an optional API key, and a model. The scan stays in your browser and returns a scorecard.

Does the scan send my API key to TestMu AI?

No. The key is sent as an Authorization or x-api-key header to the URL you typed. If that host blocks the browser, the same request is retried through a CORS relay. TestMu AI does not collect or store the key. Close the tab and it is gone.

Which model APIs can I scan?

The scan speaks OpenAI-compatible chat completions, Anthropic Messages, and Google Gemini generateContent. Presets cover OpenAI, Anthropic, OpenRouter, Groq, Together, Mistral, DeepSeek, Fireworks, and Gemini. A custom host works if it accepts one of those three request bodies.

Can I scan official OpenAI and Anthropic hosts?

Yes. OpenAI chat completions already allow this page's origin. Anthropic needs the official anthropic-dangerous-direct-browser-access header, which the scan sends. If a custom host still blocks the browser, the scan retries through a CORS relay.

How is the score calculated?

The score starts at 100. Each failed probe subtracts a weight by severity: 25 for critical, 12 for high, 6 for medium, 2 for low. Skips do not subtract. A Strong band is 80 or above. Mixed is 50 to 79. Weak is under 50.

What is the difference between prompt injection and a jailbreak?

Prompt injection tries to override the application instructions sitting in the system prompt. A jailbreak tries to peel off the model vendor's safety training. This scan runs both: override and persona probes against a canary system prompt, then checks whether forbidden tokens come back.

Does a high score mean the model is safe?

No. A high score means these single-turn canary probes did not land. It does not cover multi-turn crescendo attacks, tool-connected agents, or RAG documents you have not pasted here. Treat a green card as a first pass, then keep human review on anything that can move money or data.

What probes does the scan run?

Twenty-five probes across seven classes: direct injection, jailbreak personas, encoding bypass, system prompt extraction, PII leak, indirect injection hidden in mail or XML, and excessive agency. Each probe has a fail token. If that token appears in the reply, the row fails.