LLM features and MCP servers are a new attack surface. Darkmoon's llm agent tests OpenAI-compatible, Ollama, vLLM and TGI endpoints against the OWASP LLM Top 10 — and proves each issue end to end.
Not a generic scanner pointed at an API — an agent that understands the AI layer.
OWASP LLM Top 10
System-prompt leakage, prompt injection and jailbreak, insecure output handling, unbounded consumption, SSRF and unauthenticated access — with the exact request and raw response for each.
The model never sees your secrets
The Privacy Gateway tokenizes real IPs, hosts and credentials before anything reaches the model, so you can test even when the target is your own inference stack.
Proof, not probabilities
Every finding is graded by demonstrated impact, with a per-run canary and explicit detectors — bounded to avoid denial of service against the endpoint.
What you get
What an LLM engagement produces
Auto-detection and dispatch
The agent fingerprints OpenAI-compatible, Ollama, vLLM and TGI endpoints and dispatches like the GraphQL and Kubernetes agents, then profiles capabilities before attacking.
An optional bounded garak pass
A bounded garak run complements the adaptive OWASP-LLM attacks — thorough, but capped so it never turns into a stress test of your endpoint.
MCP tested as its own surface
Darkmoon exposes its own MCP tool layer and treats MCP servers as a first-class target, not an afterthought.