garak

license

Apache-2.0(OSI)

source

public

self-host

yes

service

none

core features withheld

no

garak's complete source is public under Apache-2.0, and it installs from PyPI or from source and runs locally. Nothing in it depends on a paid tier or a hosted service.

• https://api.deps.dev/v3/projects/github.com%2Fnvidia%2Fgarak recorded 2026-09-29

  The deps.dev project record for the GitHub repository github.com/nvidia/garak, described as "the LLM vulnerability scanner", lists the repository license as "Apache-2.0" and records the repository key "github.com/nvidia/garak", so the source is public on GitHub under Apache-2.0.

• https://garak.ai/ recorded 2026-09-29

  The garak homepage states "garak is open-source software and actively updated, by both NVIDIA and the community" and links to the "garak code on github".

• https://github.com/NVIDIA/garak recorded 2026-08-13

  Repo metadata records license spdxId - Apache-2.0. The README is a command-line Get Started for running the scanner locally against your own model endpoints; there is no hosted tier, no enterprise directory and no license key on the page, so nothing is withheld from the published source.

• https://pypi.org/pypi/garak/json recorded 2026-09-29

  The PyPI project description for garak 0.17.0 calls it a free tool ("s a free tool. We love developing it and are always interested in adding functionality") and documents installing it locally with "python -m pip install -U garak" or by cloning the source and running "python -m pip install -e .", then pointing it at a local Hugging Face model, as in "python3 -m garak --target_type huggingface --target_name gpt2". Searched the description for enterprise, license key, paid and hosted: none.

GitHub stars are the only adoption signal published for garak: no download, install or customer figure exists for the scanner. A star is not a use, so this measures interest rather than how much the tool is actually run.

• https://api.github.com/repos/NVIDIA/garak recorded 2026-08-12

  stargazers_count = 8,783 for NVIDIA/garak

garak ships probes for hallucination, data leakage, prompt injection, misinformation, toxicity and jailbreaks, combining static, dynamic and adaptive attacks. It runs them against Hugging Face models, the OpenAI API, AWS Bedrock, litellm and generic REST endpoints.

• https://github.com/NVIDIA/garak recorded 2026-08-13

  README states 'garak probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other weaknesses' and positions it as nmap for LLMs, with named probe modules including promptinject and realtoxicityprompts.

• https://pypi.org/pypi/garak/json recorded 2026-09-29

  The PyPI project description says garak "probes for hallucination, data leakage, prompt injection, misinformation, toxicity generation, jailbreaks, and many other weaknesses" and that "It combines static, dynamic, and adaptive probes to explore this." Its LLM support list covers "hugging face hub" generative models, "chat & continuation models" via the OpenAI API, "foundation models" on AWS Bedrock, litellm and "pretty much anything accessible via REST".