OPFOR CLI
Open-source adversary emulation for AI agents, LLM apps and MCP servers, checked against OWASP catalogs
- 585 ★ on the repository
- Last commit
Broad access
Why this level
- Generates and fires attacks at a target, use only on your own systems and with permission
- Needs a model provider key, keep it out of chats and repositories
- Consumes provider tokens and money on runs
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/opforDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Generates and fires attacks at a target, use only on your own systems and with permission
- Needs a model provider key, keep it out of chats and repositories
- Consumes provider tokens and money on runs
This is third-party code. Review the repository files before installing.
What it does
OPFOR tests an AI agent the way an attacker would: prompts, tools, MCP servers, memory and multi-turn reasoning. It generates targeted attacks against the OWASP LLM Top 10, Agentic AI Top 10, MCP Top 10 and API Security catalogs, fires them at your target and judges each response with a separate model. Every attack prompt, request, response and verdict is logged, so a run is reproducible and auditable. It runs from the CLI, as an MCP server, through IDE skills, a browser extension or an SDK. All modes share the same evaluators and judge logic.
Who it is for. For teams shipping AI agents who want to test their resilience to attacks on systems they own.
Good fit when
- You need to test your own agent or LLM app for attack resilience
- You need an MCP server checked against OWASP catalogs
- You need a reproducible report with attack logs and verdicts for an audit
Not a fit when
- You lack written permission from the target owner, testing others' systems is off limits
- You have no model provider key, which is needed to generate attacks and judge
Example request
Run a red-team check of my agent against the OWASP catalogs and produce a report with verdictsLimitations
The tool runs only against systems you own and with explicit permission, using it on others' resources is not acceptable. It needs a model provider key, by default OpenAI, Gemini or Anthropic, whose access from some regions is not guaranteed. Judging is done by a model and does not replace a manual security review.
How to disable. Remove the package: npm uninstall -g @keyvaluesystems/agent-opfor-cli, delete the .opfor folder and the MCP entry if you added one.
FAQ
What run modes are there?
CLI, an MCP server for running from Cursor or Claude Desktop, IDE skills, a browser extension and an SDK. Evaluators and judge logic are shared.
Do I need a model key?
Yes, a provider key such as OpenAI, Gemini or Anthropic. It is set through an environment variable.
Discussion
No questions or reviews yet.
Related
CLI toolsAn AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
The OpenWorkProof MCP server: an agent verifies signed work records of an AI agent and exports evidence for independent review.
An OSINT AI agent with an interactive mode, an MCP server and a CLI: about twenty tools to check domains, addresses, hashes and breaches
HackAgent tests your AI model or agent for jailbreaks, prompt injection and tool misuse and reports a measured attack success rate
Agentic Radar analyzes multi-agent code on LangGraph, CrewAI, n8n, OpenAI Agents and AutoGen and builds an HTML report on tools and vulnerabilities
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
README in short
The README describes OPFOR as an open adversary-emulation tool for AI agents, LLM apps and MCP servers. It covers the OWASP LLM, Agentic AI, MCP and API Security catalogs plus bias suites, generates attacks, fires them at a target and judges with a model. Five run modes: CLI, browser extension, MCP server, skills and SDK, all on shared evaluators. Every step is logged for reproducibility and audit, with trace integration through Langfuse and Netra. Apache 2.0 licensed.