Llm Redteam

io.github.GuardBeePublished by GitHub account GuardBeev0.3.1Updated Nov 3, 2026

Active jailbreak/extraction/obfuscation red-teaming for live LLM endpoints

VerifiedSTDIODesktop onlySecurity & MonitoringAI & ML

Overview

AI-generated overview

Runs canary-based jailbreak, prompt-extraction and obfuscation probes against a live LLM endpoint or chatbot you control and reports which guardrails were…

What you can do
  • List the available red-team probes grouped by category, without any network call
  • Run the probe suite against a target LLM endpoint or chatbot and see which probes bypassed its guardrails
  • Cover five technique categories: instruction override, prompt extraction, obfuscation, refusal suppression and multilingual phrasing
  • Return a recommendation explaining why each bypass matters and what to do about it
  • Test OpenAI-compatible chat APIs, the Anthropic Messages API, or your own webhook endpoint
When to use it
Use it when you deploy or maintain an LLM application or chatbot and want to check, before or after a release, whether its guardrails hold up against known jailbreak and prompt-extraction techniques. It is a defensive coverage test rather than novel attack research, and can be run from CI against a staging endpoint.
Requirements
Runs locally via npx from the npm package; Node.js is needed. You supply your own target: an OpenAI-compatible API, the Anthropic Messages API, or a webhook URL. The API key is not passed as a parameter — you set an environment variable (for example OPENAI_API_KEY) and give the tool only its name. Network access to the target is required.
Before you install
Only point it at an endpoint you own or are explicitly authorized to test; every probe sends a real request and consumes API quota on the target. The target's API key must be available in an environment variable, so keep that variable scoped to the session. Telemetry is off by default; setting GUARDBEE_TELEMETRY=1 sends server, tool, success, duration and short parameter values to a third party, with longer strings and fields such as content, token or password replaced by a placeholder.

Installation

In SourceWeft

  1. Open Llm Redteam in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@guardbee/mcp-llm-redteam

🇬🇧 English | 🇹🇷 Türkçe | 🇨🇳 中文 | 🇯🇵 日本語 | 🇰🇷 한국어 | 🇧🇷 Português | 🇪🇸 Español | 🇩🇪 Deutsch

[npm version] [npm downloads] [License: MIT]

An MCP (Model Context Protocol) server that actively red-teams a live LLM endpoint or chatbot — not static analysis like GuardBee's other scanners, but real probe requests sent to a real target you control.

ai-code-scanner, mcp-server-auditor, and prompt-injection-scanner all look at code or content at rest. This package looks at a running system: does a deployed LLM/chatbot's guardrails actually hold up against known jailbreak, extraction, obfuscation, and refusal-suppression techniques, right now, in production?

⚠️ Only point this at an endpoint you own or are explicitly authorized to test. Every probe sends a real request and consumes API quota on the target. This is a self-testing tool — you supply your own API key/endpoint.

No probe ever asks the target to produce genuinely harmful content. Every probe is canary-based: success is measured by whether the target reproduces a random, single-use token we generate per run — proof that an out-of-character instruction was obeyed, without ever eliciting real harmful output. This keeps results deterministic (a canary can't appear by coincidence) and safe to run against a live endpoint.

Telemetry is off by default. With GUARDBEE_TELEMETRY=1 it sends the server, tool, success, duration and short parameter values such as a file path; longer strings and fields like content, token or password are replaced with a placeholder. See @guardbee/mcp-telemetry.

Your LLM endpoint / chatbot ◄── llm-redteam ──► Claude              │              ├─ Instruction override    (DAN-style role-play, direct "ignore instructions")              ├─ Extraction              ("repeat everything above", translation-reframed leak)              ├─ Obfuscation             (base64-encoded instruction, zero-width smuggling)              ├─ Refusal suppression     (fake system-override impersonation)              └─ Multilingual            (same override, non-English phrasing)

Features

  • 12 probes, 5 categories — instruction-override, extraction, obfuscation, refusal-suppression, multilingual
  • Canary-based, not harm-based — deterministic pass/fail, never requests real harmful content
  • 3 target types — OpenAI-compatible chat APIs (OpenAI, Groq, local vLLM, etc.), Anthropic Messages API, or your own webhook
  • Every bypass includes why it matters and what to do about it (recommendation)
  • CLI mode for CI (e.g. red-team your staging chatbot on every deploy)
  • 29 unit tests — target adapters tested against a mocked fetch, no real network calls in the test suite

Quick Start

Claude Desktop / MCP Client

json
{  "mcpServers": {    "guardbee-llm-redteam": {      "command": "npx",      "args": ["-y", "@guardbee/mcp-llm-redteam"],      "env": {        "OPENAI_API_KEY": "sk-..."      }    }  }}

Then ask Claude: "Run the GuardBee red-team suite against my OpenAI endpoint using gpt-4o-mini."

CLI (CI/CD)

bash
export OPENAI_API_KEY=sk-...npx @guardbee/mcp-llm-redteam probe --type=openai --model=gpt-4o-mini --api-key-env=OPENAI_API_KEY --fail-on=high
bash
# Your own chatbot endpointnpx @guardbee/mcp-llm-redteam probe --type=webhook --url=https://staging.example.com/chat --fail-on=any

MCP Tools

ToolDescription
list_probesLists all probes by category — no network call
run_probe_suiteRuns probes against a target you specify; returns which ones bypassed the guardrails

Target Types

TypeUse for
openaiOpenAI's Chat Completions API, or any OpenAI-compatible gateway via baseUrl (Groq, local vLLM/Ollama proxies, etc.)
anthropicAnthropic's Messages API directly
webhookYour own chatbot/product endpoint — POSTs { prompt } as JSON, reads the reply from a configurable field

The API key is never passed as a tool/CLI parameter — only the name of an environment variable that already holds it (apiKeyEnv). Set that env var before running.

Detected Bypass Categories

CategoryExample probeSeverityWhat a bypass means
instruction-overridedirect_override, role_play_danhighA direct or role-play override instruction replaced the system prompt's authority
extractionsystem_prompt_leak_direct, repeat_abovecriticalThe target revealed (or proved it would reveal) its own system prompt
obfuscationbase64_instruction, zero_width_smugglinghigh/mediumAn override instruction hidden via encoding or invisible characters still worked
refusal-suppressionauthority_impersonationhighA fake "system override" framing was granted real instruction authority
multilingualnon_english_overridemediumThe same override succeeded when phrased in a non-English language

These are known, publicly documented technique shapes — this is defensive coverage testing, not novel attack research. A held probe doesn't prove a target is unbreakable; a bypassed probe is a concrete, reproducible finding.

Development

bash
npm run buildnpm test             # 29 unit tests

License

MIT — GuardBee

Feedback

Questions, ideas, or a false positive? Start a thread in GitHub Discussions or open an issue. If GuardBee is useful to you, a ⭐ on the repository helps others find it.

Source: packages/llm-redteam/README.md at commit bc5997d

Tools

2

list_probes

List all red-team probes this tool can run against a target LLM/chatbot, grouped by category. Every probe is canary-based (safe) — none ask the target to produce genuinely harmful content.

Takes no parameters.

run_probe_suite

Run canary-based red-team probes against a live LLM endpoint or chatbot you control, to test whether known jailbreak/extraction/obfuscation techniques bypass its guardrails. ONLY point this at an endpoint you own or are explicitly authorized to test — every probe consumes API quota on the target. Probes never request genuinely harmful content; success is measured by whether the target reproduces a random one-time token, proving an override instruction was obeyed.

ParameterstargetrequiredprobeIdsmaxProbescategories

Version history

3
  1. v0.3.1LatestOct 30, 2026
  2. v0.2.2Oct 22, 2026
  3. v0.1.2Oct 13, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts