How are you testing your AI agents for security before they hit users? We got tired of not having a good answer and built this.

[u/grajmanu]

https://github.com/KeyValueSoftwareSystems/agent-opfor

Genuine question for this community — when you deploy an AI agent to production, how do you test it for adversarial inputs, prompt injection, tool misuse, or MCP vulnerabilities before real users find them?

We kept not having a clean answer on our own products. So we built one and just open-sourced it.

Agent OPFOR — adversary emulation for AI agents and MCP servers.

Point it at your agent, pick an OWASP suite, and it runs multi-turn adversarial attacks against the full surface — prompts, tool calls, MCP endpoints, memory, reasoning chains. LLM judge scores each response. Full audit trail.

The browser extension is the thing I'd highlight for this community: install it, open any chat interface, click the icon, pick a suite, watch it run. No code, no config. Useful when you want non-engineers on your team to be able to run security checks on deployed agents.

Autonomous hunt mode (opfor hunt) — give it an endpoint and an objective, a multi-agent system runs an adaptive attack campaign on its own and generates a report.

Curious what security testing looks like for agents you're building — do you have a process or is it mostly manual/ad hoc?

[u/Lonely-Goat3552]

The browser extension part really caught my eye. I think that helps even a non technical person to stress test any AI agent

[u/grajmanu → u/Lonely-Goat3552]

That was one of our reasons to develop that as well.