Arcjet vs Promptfoo

Arcjet vs Promptfoo

These products solve different halves of the same problem, so most teams don't choose between them. Promptfoo answers "how does this agent behave when someone attacks it?" before you release it. Arcjet answers "should this specific action run right now?" every time the agent acts in production. A finding from Promptfoo often becomes a rule in Arcjet.

Arcjet publishes this comparison. Competitor details come from Promptfoo's public documentation, GitHub repository and announcements, reviewed on October 15, 2026.

What is Promptfoo?

Promptfoo's documentation describes it as "an open-source CLI and library for evaluating and red-teaming LLM apps," and its homepage headline is "Ship agents, not vulnerabilities." The project is published on GitHub under the MIT license.

Promptfoo has several parts:

• Evaluations test prompts, models and agents, and compare providers side by side.
• Red teaming uses about 100 plugins to probe for harmful content, privacy leaks, prompt injection, broken authorization and more, with OWASP presets and custom policies written in natural language.
• Code scanning reviews pull requests for LLM-specific risks such as prompt injection, PII exposure and excessive agency, and posts findings as comments through a GitHub Action, the CLI or a VS Code extension.
• ModelAudit scans model files in formats such as PyTorch, TensorFlow, ONNX, SafeTensors and GGUF.
• MCP Proxy, an enterprise feature, allowlists approved MCP servers with per-app and per-user access and audit logs.

Evaluations run locally or in CI, configured in a promptfooconfig.yaml file. For coding agents, Promptfoo can evaluate and red-team agents built on the OpenAI Codex SDK, the Claude Agent SDK and others before deployment. Promptfoo reports more than 300,000 developers and use at 156 of the Fortune 500. In March 2026, Promptfoo announced that it had agreed to be acquired by OpenAI, and its GitHub README states that Promptfoo is now part of OpenAI and remains open source.

What is Arcjet?

Arcjet is an AI agent runtime security platform that discovers the agents running in your organization, enforces policy across every action, prompt and tool call, and keeps the evidence to prove what happened. Arcjet enforces in the path of the action, in code or in the agent's hook, not on the network.

For agents and applications you build, the Arcjet JavaScript, TypeScript, Python and Go SDKs provide guard() for tool calls, queue workers and MCP handlers, and protect() for HTTP routes. Arcjet integrates with 15 agent frameworks, including the Claude Agent SDK, LangChain, LangGraph, Mastra, OpenAI Agents, the Vercel AI SDK, CrewAI and Google ADK. You write Guard policies in Rego or a builder, run them in dry run, and publish them from the Arcjet Console or MCP server.

For coding agents, Claude Code, GitHub Copilot, Cursor, OpenAI Codex and Muse Code call Arcjet from the hooks they already fire, with no SDK and no code change.

Arcjet detectors cover prompt injection, sensitive information, destination threat analysis and token budgets. The same SDK covers bots, rate limiting, Shield WAF and email validation on HTTP routes. The Arcjet Console records every decision, and on the Enterprise plan decisions export to Datadog, Splunk, SentinelOne, Panther and Amazon S3.

How do Promptfoo and Arcjet differ?

Testing and enforcement are different jobs

A red team run sends a large set of adversarial inputs to your agent and shows you where it breaks. That tells you what to fix, and it gives you a regression suite so the same weakness doesn't come back. It does not stop a new attack in production that wasn't in the test set, or a legitimate user whose request leads the agent somewhere it shouldn't go.

Runtime enforcement covers that gap. Arcjet checks each action as it happens, using the arguments and the context your code supplies, and denies the ones that policy doesn't allow. It does not tell you in advance how your agent will behave under attack. The two jobs reinforce each other: testing tells you which actions need rules, and enforcement keeps those rules in place after release.

Which fits: Promptfoo, Arcjet, or both?

When to choose Promptfoo

Promptfoo fits when any of the following apply:

• You want to red-team an LLM app or agent before release, with OWASP presets and custom attack policies.
• You want LLM-specific checks in CI and on pull requests.
• You want to compare prompts, models or providers side by side.
• You need to scan model files before you load them.

When to choose Arcjet

Arcjet fits when any of the following apply:

• You need to stop unsafe actions in production, not only find them in testing.
• Rules need application context, such as tenant, plan, amount or recipient.
• You need one runtime policy across Claude Code, GitHub Copilot, Cursor, OpenAI Codex and Muse Code.
• You want a record of every production decision for security review and audit.

Using both

A common setup is to run Promptfoo in CI and Arcjet in production. Promptfoo's red team results show which tool calls an attacker can trigger, and you write Arcjet policies on those tool calls. You can then run Promptfoo against the agent with Arcjet guards in place to confirm that the attacks it found are now denied.

What are the alternatives to Promptfoo?

• Rein Security observes agents at runtime from a sidecar and informs application security.
• Prisma AIRS from Palo Alto Networks includes AI red teaming alongside model scanning and runtime.
• AI security posture management versus runtime security explains how pre-runtime and runtime controls fit together.