LLM Armor

LLM Armor is a static analysis scanner for Python AI applications that checks for OWASP LLM Top 10 vulnerabilities. It is aimed at finding issues before attackers do, and it is presented as a fast, free tool that runs in seconds.

The scanner is described as having no agents, no API calls, and no runtime overhead. Its OWASP coverage includes 7 of the 10 categories: LLM01, LLM02, LLM05, LLM06, LLM07, LLM08, and LLM10, with 2 marked strong and 5 partial. The page says LLM01 and LLM08 have strong detection, while the other listed categories have partial coverage. An example shown on the site illustrates a prompt injection finding, and the coverage section also mentions detection of leaked API keys, eval/exec and other unsafe sinks, dangerous @tool functions, hardcoded prompts, dynamic dispatch, disabled approval gates, and missing max_tokens on LLM API calls.

LLM Armor is built for Python and is said to work with OpenAI, Anthropic, LangChain, CrewAI, Smolagents, Google ADK, Semantic Kernel, MCP, and more. It is delivered as a CLI, with installation instructions that use pip and a scan command. The site also says it can be run in GitHub Actions, GitLab CI, and other CI/CD systems, and that it outputs structured exit codes and SARIF for pipeline gating. Documentation, a CLI reference, coverage details, a compare section, and a blog are also listed.

It is fully open source under the MIT license. The site says there is no paid tier, no API key requirement, and no vendor lock-in, and it invites users to audit, fork, and extend the code. The product compares itself on-site with garak, Promptfoo, and Lakera, describing LLMArmor as purpose-built for OWASP LLM Top 10 static analysis.