LLMMap
LLMMap is a free, open-source Linux tool for authorized security testing of applications that use large language models.
What LLMMap is
LLMMap is a free, open-source Linux tool for authorized security testing of applications that use large language models. It looks for HTTP locations where prompt injection can enter, creates targeted prompts, and checks possible findings again for reliability. The project includes 227 techniques across 18 attack families in four prompt packs. A Generator LLM creates goal-aware prompts, while a Judge evaluates responses; heuristics and optional semantic similarity can also provide detection signals. You can provide a target URL or a Burp Suite request export, marking the injection point with an asterisk. Injection locations include query parameters, request bodies, headers, cookies, and paths, with listed obfuscation methods such as base64, homoglyphs, leet speak, and language switching. Ollama, OpenAI, Anthropic, and Google backends are documented, with Ollama local by default. Safe mode limits scans to low-risk families, and workspaces keep sensitive prompt text and response bodies in memory by default.
Good
- Free and open source under the MIT license
- 227 techniques across 18 prompt-injection families
- Native Burp Suite request-export support
- Safe mode enabled by default
- Dry-run planning avoids target connections
Watch out
- Linux platform only
- Requires Python 3.11 or later
- Requires an LLM backend
- Adaptive TAP and out-of-band modules inactive in v1.0.0
Who it suits
LLMMap suits authorized security teams assessing LLM-integrated applications on Linux. It is intended for systems owned by the user or covered by explicit written authorization.
Verdict
LLMMap combines broad prompt-injection coverage with configurable LLM-based judging and reliability checks. Its Linux-only, self-hosted setup and requirement for an LLM backend shape who can use it.
Plans and prices
From LLMMap's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| LLMMap | Free | Python >= 3.11 · Requires an LLM backend; Ollama is local, while cloud backends may require API keys · No charge stated; publicly available under the MIT license. |
The facts
Each one read from LLMMap's own pages, with the date it was checked.
What it does
- Burp Suite
- LLMMap reads Burp Suite request exports natively and lists proxy support for traffic inspection.checked 4 Oct 2026
- Data handling
- Scan workspaces store request metadata, configuration, and timing; sensitive prompt text and response bodies stay in memory and are not written to disk by default.checked 4 Oct 2026
- Detection
- A Generator LLM creates goal-aware prompts and a Judge evaluates target responses; detector signals can include heuristics and optional semantic similarity.checked 4 Oct 2026
- Dry run
- Dry-run mode plans a scan and selects prompts without making network connections to the target.checked 4 Oct 2026
- Injection locations
- It supports injection in query parameters, request bodies, headers, cookies, and paths.checked 4 Oct 2026
- Intended users
- The project describes LLMMap as a security testing tool for authorized use and says to test only systems owned by the user or covered by explicit written authorization.checked 4 Oct 2026
- Notable limits
- The architecture document says adaptive TAP and out-of-band detection modules are reserved for future versions and inactive in the v1.0.0 scan pipeline.checked 4 Oct 2026
- Obfuscation
- Its listed obfuscation methods include base64, homoglyphs, leet speak, and language switching.checked 4 Oct 2026
- Prompt coverage
- It includes 227 prompt injection techniques across 18 attack families in four prompt packs.checked 4 Oct 2026
- Purpose
- LLMMap tests LLM-integrated applications for prompt injection by discovering HTTP injection points, generating targeted prompts, and checking findings for reliability.checked 4 Oct 2026
- Reliability
- Candidate findings are re-tested using Wilson confidence intervals; the documented defaults are five retries and three confirmations.checked 4 Oct 2026
- Request input
- Targets can be supplied as a URL or a Burp Suite request export, with an asterisk marking an injection location.checked 4 Oct 2026
- Safety
- Safe mode is enabled by default and restricts scans to low-risk prompt families, while risky families such as tool abuse and system override are blocked.checked 4 Oct 2026
- Supported LLMs
- The documented backends are Ollama, OpenAI, Anthropic, and Google, with Ollama as the local default that needs no API key.checked 4 Oct 2026
Alternatives to LLMMap
- 1
OpenSecureAI Scanner
Free planOpen sourceWebAPILinuxmacOS8.1From $49 a month - 2
PromptGuard
Free planWebAPIExtensionLinux7.9From $19 a month - 3
Promptfoo
Free planOpen sourceWebAPILinuxmacOS7.8Free plan - 4
Giskard
Free planOpen sourceWebAPILinuxSelf-hosted7.6Free plan - 5
AIRTA Red Team
Free planOpen sourceWebAPILinuxmacOS7.5Free plan - 6
CyberSecEval
Free planOpen sourceWebAPILinuxmacOS7.5Free plan