PyRIT Documentation — Python Risk Identification Tool for Generative AI
by Microsoft AI Red Team
Microsoft's own AI red team framework — run repeatable multi-turn jailbreak campaigns against your endpoint and score the results.
Overview
PyRIT is the open-source red-teaming framework Microsoft's AI Red Team built for probing generative AI systems, and its documentation is the most complete free curriculum available on adversarial testing of LLM applications. The docs walk a new user through three steps — pip install and verify, configure credentials in ~/.pyrit/.env and settings in ~/.pyrit/.pyrit_conf, then choose an operating mode — and the three modes are the real structure of the material. Scanner is the command-line path, using pyrit_scan and pyrit_shell to run standardized attack scenarios with minimal setup. The GUI, branded CoPyRIT, is a local web interface for human-led red teaming that tracks findings and supports collaboration across a team. Framework is the programmatic Python API, where five abstractions live: targets, meaning the system under test, which can be OpenAI, Azure, Anthropic, Google, Hugging Face or any custom HTTP endpoint; converters that transform seed prompts into attack payloads; scorers that classify responses using true/false, Likert-scale, classification or custom logic; memory backed by SQLite or Azure SQL so multi-turn conversations and results persist across runs; and attacks or orchestrators implementing published multi-turn strategies including Crescendo, TAP and Skeleton Key. Version 1.0.1 targets Python 3.13, and the project is MIT-licensed with 4.3k GitHub stars and 827 forks.
At a Glance
- Topic
- Frameworks
- Level
- Advanced
- Format
- Documentation
- Cost
- Free
- Duration
- ~4-6 hours to install, run the scanner and work through the framework walkthroughs; ongoing as a reference
- Provider
- Microsoft AI Red Team
- Hands-on
- Yes — code/exercises
- Certificate
- None
What You’ll Learn
- ✓Configure a target for OpenAI, Azure, Anthropic, Google, Hugging Face or a custom endpoint
- ✓Run published multi-turn adversarial strategies such as Crescendo, TAP and Skeleton Key
- ✓Write converters that transform seed prompts into attack payloads automatically
- ✓Score model responses with true/false, Likert-scale, classification or custom scorers
- ✓Persist conversations and findings in memory backed by SQLite or Azure SQL
- ✓Drive standardized attack scenarios from the command line using pyrit_scan
- ✓Integrate automated red-team runs into a CI/CD pipeline as regression tests
Highlights
- •Built and maintained by Microsoft's own AI Red Team rather than assembled as a vendor demo — MIT licensed, 4.3k GitHub stars
- •Three entry points for different skill levels: a CLI scanner, the CoPyRIT web GUI for human-led testing, and the full Python framework
- •Ships published multi-turn jailbreak strategies out of the box instead of leaving you to reimplement papers
- •A Cloud Security Alliance evaluation published June 2026 puts automation coverage of core red-teaming activity at roughly 95%
- •That same evaluation is candid about the ceiling: about 40% coverage of system-level agentic threats, no native agent-state tracking, and minimal built-in reporting
- •Steep learning curve — CSA notes beginners find the configuration surface overwhelming without a security background
Who It’s For
Best For
- ✓Security engineers responsible for signing off on an LLM-powered feature
- ✓AI engineers who need repeatable jailbreak and prompt-injection regression tests
- ✓Red teams standardizing adversarial testing across multiple model providers
- ✓Platform teams adding safety gates to a model deployment pipeline
Prerequisites
- •Comfortable Python and command-line work; Python 3.13 is the recommended runtime
- •API credentials for whichever model endpoint you intend to test
- •Some security testing background — the docs assume you know what you are hunting for
FAQ
What is PyRIT Documentation — Python Risk Identification Tool for Generative AI?
Official documentation for PyRIT, the open-source generative-AI red-teaming framework built by Microsoft's AI Red Team. It is written for security engineers and AI engineers who need to prove an LLM feature is safe before it ships rather than assert it. You finish able to run automated multi-turn jailbreak campaigns against your own endpoint, score every response, persist the transcripts, and wire the whole thing into CI.
Is PyRIT Documentation — Python Risk Identification Tool for Generative AI free?
PyRIT Documentation — Python Risk Identification Tool for Generative AI is free to access.
What level is PyRIT Documentation — Python Risk Identification Tool for Generative AI for?
PyRIT Documentation — Python Risk Identification Tool for Generative AI is aimed at a advanced audience. Recommended background: Comfortable Python and command-line work; Python 3.13 is the recommended runtime, API credentials for whichever model endpoint you intend to test, Some security testing background — the docs assume you know what you are hunting for.
How long does PyRIT Documentation — Python Risk Identification Tool for Generative AI take?
Expect roughly ~4-6 hours to install, run the scanner and work through the framework walkthroughs; ongoing as a reference. Most learners work through it at their own pace.
What will I learn from PyRIT Documentation — Python Risk Identification Tool for Generative AI?
You'll learn: Configure a target for OpenAI, Azure, Anthropic, Google, Hugging Face or a custom endpoint; Run published multi-turn adversarial strategies such as Crescendo, TAP and Skeleton Key; Write converters that transform seed prompts into attack payloads automatically; Score model responses with true/false, Likert-scale, classification or custom scorers; Persist conversations and findings in memory backed by SQLite or Azure SQL; Drive standardized attack scenarios from the command line using pyrit_scan; Integrate automated red-team runs into a CI/CD pipeline as regression tests.
Topics
Sources
This page was written from 3 sources, 2 on domains other than microsoft.github.io.