Skip to main content
Opfor maintains two catalogs — agent and MCP. Standard suites are auto-derived from standards: tags; curated suites are hand-authored.

Agent red-team

Suites

Suite IDStandard / versionCountFocus
owasp-llm-top10OWASP LLM Top 10 (2025)10Prompt injection, sensitive disclosure, supply chain, poisoning, agency, hallucination, limits
owasp-agentic-aiOWASP Agentic AI Top 10 (2024)10Goal hijack, tool misuse, identity abuse, memory poisoning, inter-agent comms, rogue agents
owasp-mcp-top10OWASP MCP Top 10 (2025) — agent-side10How an agent handles MCP tool calls, server trust, scope, and resource boundaries
owasp-apiOWASP API Security Top 10 (2023)10BOLA, BFLA, RBAC, PII via API/DB tools, SQL/shell injection, debug exposure, goal hijack
eu-ai-act-biasEU AI Act — Bias & Fairness (2024)4Demographic bias: age, disability, gender, race
output-trust-and-safetyOutput Trust & Safety (v1)8Hallucination, sycophancy, imitation, contractual overreach, drift, reasoning DoS, smuggling
harmful-contentMLCommons + Harmbench taxonomy12CBRN, IEDs, malicious code, CSAM, sex/violent crime, drug synthesis, self-harm, radicalization

owasp-llm-top10

IDNameSeverityOWASP
prompt-injectionPrompt InjectioncriticalLLM01
sensitive-disclosureSensitive Information DisclosurecriticalLLM02
supply-chainSupply Chain VulnerabilitieshighLLM03
data-poisoningData and Model PoisoninghighLLM04
improper-output-handlingImproper Output HandlinghighLLM05
excessive-agencyExcessive AgencyhighLLM06 / ASI02
system-prompt-leakageSystem Prompt LeakagecriticalLLM07
vector-embedding-weaknessesVector and Embedding WeaknesseshighLLM08
misinformationMisinformationhighLLM09
unbounded-consumptionUnbounded ConsumptionhighLLM10

owasp-agentic-ai

IDNameSeverityOWASP
agent-goal-hijackAgent Goal HijackingcriticalASI01
tool-misuseTool Misuse and ExploitationcriticalASI02
identity-privilege-abuseIdentity and Privilege AbusecriticalASI03
supply-chainSupply Chain VulnerabilitieshighASI04
unexpected-code-executionUnexpected Code ExecutioncriticalASI05
memory-poisoningMemory and Context PoisoninghighASI06
inter-agent-communicationInsecure Inter-Agent CommunicationhighASI07
cascading-failuresCascading FailureshighASI08
human-agent-trustHuman-Agent Trust ExploitationhighASI09
rogue-agentsRogue AgentscriticalASI10

owasp-mcp-top10 (agent-side)

Probes how an agent target behaves around MCP. To probe an MCP server directly, see the MCP catalog.
IDNameSeverityOWASP
mcp-credential-exposureMCP Credential ExposurecriticalMCP01
mcp-scope-escalationMCP Scope EscalationhighMCP02
mcp-tool-description-injectionMCP Tool Description InjectioncriticalMCP03
mcp-supply-chain-trustMCP Supply Chain TrusthighMCP04
mcp-tool-injection-payloadMCP Tool-Injection Payload ForwardingcriticalMCP05
mcp-intent-subversionMCP Intent SubversionhighMCP06
mcp-missing-authenticationMCP Missing AuthenticationhighMCP07
mcp-audit-bypassMCP Audit and Telemetry BypassmediumMCP08
mcp-shadow-serverMCP Shadow Server DetectionhighMCP09
mcp-cross-resource-leakageMCP Cross-Resource LeakagehighMCP10

owasp-api

IDNameSeverityOWASP
bolaBroken Object Level Authorization (BOLA)highAPI1
bflaBroken Function Level Authorization (BFLA)highAPI5
rbacBroken Role-Based Access ControlhighAPI5
pii-directPII Direct DisclosurecriticalAPI4
pii-api-dbPII Disclosure via API/DB Tool CallscriticalAPI4
pii-sessionPII Cross-Session LeakagehighAPI4
shell-injectionShell InjectioncriticalAPI7
sql-injectionSQL InjectioncriticalAPI7
debug-accessDebug and Admin Interface ExposurehighAPI7
hijackingGoal HijackinghighAPI8

eu-ai-act-bias

IDNameSeverityStandard
bias-ageAge BiasmediumEU AI Act Art. 10 / 15
bias-disabilityDisability BiasmediumEU AI Act Art. 10 / 15
bias-genderGender BiasmediumEU AI Act Art. 10 / 15
bias-raceRacial BiasmediumEU AI Act Art. 10 / 15

output-trust-and-safety

IDNameSeverityTag
hallucinationHallucinationhighLLM09
overrelianceOverreliance and SycophancymediumLLM09
imitationUnauthorized ImitationhighLLM09
contractsUnauthorized Contractual CommitmentshighLLM05
competitorsCompetitor Endorsementmedium
off-topicOff-Topic Driftlow
reasoning-dosReasoning Denial of ServicehighLLM10
ascii-smugglingASCII / Unicode SmugglinghighLLM01

harmful-content

Content-harm coverage from the MLCommons hazard taxonomy and Harmbench. Best paired with raw LLM endpoints; compose with owasp-llm-top10, owasp-api, and eu-ai-act-bias for full coverage.
IDNameSeverityTag
harmful-bioweaponsChemical & Biological WeaponscriticalLLM10 / AML.T0054
harmful-indiscriminate-weaponsIndiscriminate Weapons (CBRN)criticalLLM10 / AML.T0054
harmful-weapons-iedImprovised Explosive DevicescriticalLLM10 / AML.T0054
harmful-cybercrime-malicious-codeCybercrime & Malicious CodecriticalLLM10 / AML.T0054
harmful-child-exploitationChild Exploitation (CSAM)criticalLLM10 / AML.T0054
harmful-sex-crimeSex CrimecriticalLLM10 / AML.T0054
harmful-violent-crimeViolent CrimehighLLM10 / AML.T0054
harmful-illegal-drugsIllegal Drug Synthesis & TraffickinghighLLM10 / AML.T0054
harmful-self-harmSelf-Harm & SuicidehighLLM10 / AML.T0054
harmful-radicalizationRadicalization & ExtremismhighLLM10 / AML.T0054
harmful-specialized-adviceUnqualified Specialized AdvicehighLLM09 / AML.T0048
harmful-unsafe-practicesPromotion of Unsafe PracticeshighLLM09 / AML.T0048

Standalone (not in any suite)

IDNameSeverityOWASP
jailbreakingJailbreakinghighLLM10
Select it explicitly via selection.evaluators: ["jailbreaking"].

MCP red-team

Suite

Suite IDStandard / versionCountFocus
owasp-mcp-top10OWASP MCP Top 10 (2025)14Server-side: secret exposure, OAuth passthrough, scope escalation, supply chain, tool poisoning, command injection, SSRF, and more

Evaluators

IDNameSeverityOWASP
secret-exposureSecret and Token ExposurecriticalMCP01
oauth-token-passthroughOAuth Confused Deputy and Token PassthroughcriticalMCP01
scope-escalationScope Escalation and Privilege BypasshighMCP02
tool-description-injectionTool Poisoning (Description Injection, Rug Pull, Schema Poisoning)criticalMCP03
tool-description-scanTool Description Poisoning ScancriticalMCP03
content-injectionSecond-Order Content InjectionhighMCP03
supply-chainSoftware Supply Chain Attacks & Dependency TamperinghighMCP04
command-injectionCommand Injection and STDIO RCEcriticalMCP05
ssrfServer-Side Request Forgery (SSRF)criticalMCP05
intent-subversionIntent Flow SubversionhighMCP06
missing-authenticationMissing AuthenticationcriticalMCP07
audit-telemetryLack of Audit and TelemetrymediumMCP08
shadow-mcp-serverShadow MCP Server DetectionhighMCP09
cross-resource-leakageContext Injection, Over-Sharing & Cross-Resource LeakagecriticalMCP10

Auto-fired

IDNameSeverityOWASP
resource-exposureMCP Resource ExposurecriticalMCP01
resource-exposure runs automatically before attacks — opfor calls resources/list + resources/read on every resource and judges for secret/PII exposure. Disable with mcp.scanResources: false in the config.