AI Defense Stack

Independent directory · 111 tools · reviewed

AI security tools, compared on verified facts.

OWASP lists prompt injection as the first risk for LLM applications, and an agent with tools can turn one injected instruction into an action nobody approved. Compare 111 tools that provide the controls, with a source link and a check date on every fact.

Compare all 111 tools Plan by security layer Read the guides

Browse by what you need to secure

All 111 tools

LLM firewalls & guardrails

Checks that screen what goes into and comes out of a model: libraries, safety models, cloud APIs and gateways.

26 tools (1 cross-listed)

AI red teaming & LLM evaluation

Scanners, attack frameworks, evaluation harnesses and managed services that test models and LLM apps on purpose.

24 tools

Agent & MCP security

Scanners, gateways and runtime controls for AI agents that call tools through the Model Context Protocol.

29 tools (1 cross-listed)

Courses & certifications

Free labs, games, courses and professional certifications for AI security, with cost and format as each provider states them.

12 options

Plan by security layer

How the eight layers work

Each layer is a budget line with its own controls, mapped to OWASP, MITRE ATLAS and the NIST AI Risk Management Framework (AI RMF). The model is our own, not a standard, and each tool's placement is our analysis of a capability its sources document.

  1. Know what you run

    1. Layer 1: Governance and risk Which AI systems do we run, who approved them, what risk does each carry, and can we prove it? 7 tools
    2. Layer 2: Discovery and posture What AI is running in our clouds, SaaS apps and endpoints, and which of it is exposed or misconfigured? 8 tools + 20 also cover it

  2. Secure what you build and buy

    1. Layer 3: Model and supply chain Can a model, dataset or AI component we pull in run code or hide a backdoor, and can we prove where it came from? 9 tools + 8 also cover it
    2. Layer 4: Testing and red teaming Have we attacked this model, app or agent the way an adversary would, and do we repeat it after each change? 24 tools + 9 also cover it

  3. Protect what runs

    1. Layer 5: Data protection What sensitive data reaches AI tools and models, and can we block, mask or tokenize it first? 10 tools + 17 also cover it
    2. Layer 6: Runtime guardrails When a prompt attack or unsafe output hits a live AI app, what catches it and what happens next? 25 tools + 11 also cover it
    3. Layer 7: Agent and tool access What can our AI agents do with the tools, data and credentials we gave them, and who approves risky actions? 26 tools + 12 also cover it

  4. Detect and respond

    1. Layer 8: Monitoring and response If an AI system or agent is attacked or misbehaves, will we see it, and can we respond and prove what happened? 2 tools + 24 also cover it

How we verify

We compile every fact from vendors' own public pages, documentation and repositories. We do not run the products, so we make no claims about detection accuracy or speed.

  • Sourced facts

    Every fact links to the page that states it and shows the date we checked it.

    See the sourcing standard

  • A published score

    The Coverage Score is computed from sourced facts with a public rubric. Nobody types a score.

    How the score works

  • Mapped to frameworks

    Each tool maps to the OWASP Top 10 for LLM Applications risks its documented capabilities address, labeled as our analysis.

    Open the OWASP map

  • Status and money labels

    Archived and renamed products carry a badge, and sponsorship never changes a score.

    Read the disclosure

Recently reviewed

Browse all tools

The tool pages we checked most recently, each with its sources and check dates.

Adversa AI

Adversa AI

Commercial
  • SaaS
  • On-prem
  • Managed service

Continuous red teaming of models, apps, agents and MCP servers, offered as a platform or managed service.

Best for: Teams that want a vendor to run continuous red teaming across models, applications, agents and MCP servers, with on-prem or managed-service options

Coverage Score 50 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Adversarial Robustness Toolbox

LF AI & Data Foundation

Open sourceMIT
  • Library
  • Self-hosted

A Python library of evasion, poisoning, extraction and inference attacks on ML models, plus defenses.

Best for: ML engineers and researchers who need a free library to attack and defend image, audio or tabular models with evasion, poisoning, extraction and inference methods

Coverage Score 55 out of 100
  • LLM04 Data and Model Poisoning
  • LLM02 Sensitive Information Disclosure
  • LLM10 Unbounded Consumption

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Agentic Radar

Zscaler (SPLX)

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans agent workflow code for tools, MCP servers and known weaknesses, and can run simulated attacks.

Best for: Developers who build agents with LangGraph, CrewAI, n8n, OpenAI Agents or AutoGen and want a free scan of the workflow code with an HTML report

Coverage Score 71 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM09 Misinformation

Reviewed

Agentic Security

msoedov (open-source maintainer)

Open sourceApache-2.0
  • CLI
  • Self-hosted

Open-source scanner that fires jailbreak datasets and prompt mutations at LLM APIs and agent endpoints.

Best for: Developers who want a free scanner they can run locally or in CI to replay public jailbreak datasets against an LLM API or agent endpoint

Coverage Score 60 out of 100
  • LLM01 Prompt Injection

Reviewed

AI Red Teaming Agent (Microsoft Foundry)

Microsoft

Commercial
  • Cloud-native
  • Library

Scans model and agent endpoints with PyRIT attack strategies and reports success rates by risk category.

Best for: Teams already building on Microsoft Foundry that want automated safety and agent red teaming scans before release

Coverage Score 53 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Start here

All guides

The OWASP Top 10 for LLM Applications, mapped

See the full map

The ten risks are OWASP's. The tool counts come from our mapping, which is our analysis.

Open-source spotlight

All open-source tools

One open-source tool from each of three categories, chosen by Coverage Score within its category.

NVIDIA NeMo Guardrails

NVIDIA

Open sourceApache-2.0
  • Library
  • Self-hosted
  • API

Adds programmable input, dialog, retrieval, execution and output rails to LLM applications.

Best for: Teams that want to script rules for one LLM application in Python and run them in their own infrastructure

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM05 Improper Output Handling
  • LLM06 Excessive Agency

Reviewed

garak

NVIDIA

Open sourceApache-2.0
  • CLI
  • Library
  • Self-hosted

Probes language models and LLM apps for prompt injection, jailbreaks, data leakage and more.

Best for: Teams that want a free command-line scanner they can point at any model or LLM endpoint before release

Coverage Score 82 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM09 Misinformation

Reviewed

ModelAudit (Promptfoo)

OpenAI (Promptfoo)

Open sourceMIT
  • CLI
  • Library
  • Self-hosted

Scans model files for malicious code, backdoor indicators and unsafe operations without loading them.

Best for: Teams that want a free scanner covering many model and archive formats, with SARIF output for code scanning in CI

Coverage Score 86 out of 100
  • LLM03 Supply Chain
  • LLM04 Data and Model Poisoning

Reviewed

Questions about this directory

What is AI Defense Stack?

It compares 111 AI security tools in seven categories, from LLM guardrails and red teaming to model scanning, AI security posture management (AI-SPM), agent security, data protection and governance, and places each tool in our AI security layers. Every fact on a tool page links to the page that states it, with the date we checked it.

How do you verify the facts?

We compile from each vendor's own public pages, documentation and repositories. Every fact stores its source link and the day we opened it, and the site build fails when either is missing. We do not run the products, so we make no claims about detection accuracy or speed.

How is the Coverage Score calculated?

Code computes it from the sourced facts with a published rubric (version 1.0): nine criteria that add up to 100 points. It measures how much a vendor documents publicly within one category, not detection quality. It is not an endorsement, and sponsorship cannot change it.

Do vendors pay to be listed or ranked?

Money does not change our scores or the order of tools. Affiliate links, sponsored listings and ads are not live today. Our disclosure page explains how we may earn money and the rules that apply.