Basilisk
Basilisk is an open-source framework for authorized security testing, vulnerability research, and academic study of AI and LLM systems.
What Basilisk is
Basilisk is an open-source framework for authorized security testing, vulnerability research, and academic study of AI and LLM systems. It provides 32 attack modules in eight categories mapped to the OWASP LLM Top 10, including multi-turn tests that examine prompt cultivation, authority escalation, and sycophancy alongside guardrail drift. Its prompt evolution engine combines mutation operators, crossover strategies, and fitness scoring. Basilisk connects to providers including OpenAI, Anthropic, Google, xAI Grok, Groq, Azure OpenAI, GitHub Models, and Ollama, as well as custom HTTP or WebSocket endpoints. Reports are available in HTML, SARIF 2.1.0, JSON, Markdown, and PDF formats. GitHub Actions and GitLab CI integrations can use SARIF output and fail pipelines on critical findings. The software is free under the AGPL-3.0 license, with desktop packages, pip, Docker, and source installation options. The CLI requires Python 3.11 or higher and a provider API key. Testing systems you do not own requires explicit written authorization.
Good
- Includes 32 modules across eight OWASP-mapped categories.
- Supports multiple LLM providers and custom endpoints.
- Exports reports in five formats.
- Prompt evolution and reports run locally.
- Offers Windows, macOS, and Linux desktop packages.
Watch out
- CLI requires Python 3.11 or higher.
- CLI requires an API key for the provider tested.
- Testing systems you do not own requires written authorization.
- Released under the AGPL-3.0 license.
Who it suits
Basilisk is for security researchers, academics, and teams authorized to assess AI or LLM systems. It may suit users who want local prompt mutation and report generation or CI/CD integration.
Verdict
Basilisk offers a free, locally run framework for authorized LLM security testing, with provider integrations and CI/CD support. Confirm the CLI prerequisites and authorization requirements before use.
Plans and prices
From Basilisk's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| AGPL-3.0 open-source software | Free | CLI, Desktop, Docker, or source distribution · authorized use only |
The facts
Each one read from Basilisk's own pages, with the date it was checked.
What it does
- Attack modules
- It includes 32 attack modules across 8 categories mapped to the OWASP LLM Top 10.checked 30 Sep 2026
- Authorized use
- Users must obtain explicit written authorization before testing AI or LLM systems they do not own.checked 30 Sep 2026
- CI/CD
- GitHub Actions and GitLab CI integration uses SARIF output and can fail pipelines on critical findings.checked 30 Sep 2026
- Install methods
- The project provides Windows, macOS, and Linux desktop packages, a pip CLI, Docker images, and source installation.checked 30 Sep 2026
- License
- Basilisk is released under the AGPL-3.0 license, permitting use, copying, modification, and distribution subject to the license and terms.checked 30 Sep 2026
- Local processing
- Prompt evolution, payload mutation, and report generation run entirely on the user's local machine.checked 30 Sep 2026
- Multi-turn testing
- Multi-turn modules perform prompt cultivation, authority escalation, and sycophancy exploitation with guardrail drift monitoring.checked 30 Sep 2026
- Prerequisites
- The CLI requires Python 3.11 or higher and an API key for the LLM provider being tested.checked 30 Sep 2026
- Privacy
- The CLI and Desktop app do not send telemetry, scan results, API keys, or personal data to Basilisk.checked 30 Sep 2026
- Prompt evolution
- Its Smart Prompt Evolution engine uses 15 mutation operators, 5 crossover strategies, and multi-signal fitness scoring.checked 30 Sep 2026
- Provider integrations
- It supports OpenAI, Anthropic, Google, xAI Grok, Groq, Azure OpenAI, GitHub Models, Ollama, and custom HTTP or WebSocket endpoints.checked 30 Sep 2026
- Purpose
- Basilisk is an open-source AI/LLM red teaming framework for authorized security testing, vulnerability research, and academic study.checked 30 Sep 2026
- Reports
- Basilisk exports HTML, SARIF 2.1.0, JSON, Markdown, and PDF reports.checked 30 Sep 2026
- Supply-chain security
- The project says it uses signed releases and verified checksums, while cautioning that it cannot guarantee absolute security.checked 30 Sep 2026
- Support
- Security issues and privacy questions can be reported to [email protected].checked 30 Sep 2026
Alternatives to Basilisk
- 1
OpenSecureAI Scanner
Free planOpen sourceWebAPILinuxmacOS8.1From $49 a month - 2
PromptGuard
Free planWebAPIExtensionLinux7.9From $19 a month - 3
Promptfoo
Free planOpen sourceWebAPILinuxmacOS7.8Free plan - 4
Giskard
Free planOpen sourceWebAPILinuxSelf-hosted7.6Free plan - 5
AIRTA Red Team
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6
CyberSecEval
Free planOpen sourceWebAPILinuxmacOS7.5Free plan