The no-code red-team path. Install the extension, open any chat interface, click the icon, pick a suite, watch it run. Aimed at PMs, QA, designers, and security analysts — anyone who can't or won't open a terminal.
Everything runs client-side in your browser. The extension uses your own LLM API keys; nothing is sent to an opfor backend.
Currently covers agent / chatbot red-teaming. For MCP server red-teaming, use the CLI or MCP server tool.
- Auto-detects the chat widget on any web page (custom UIs, Intercom, Zendesk, Drift, Salesforce, etc.)
- Types attack prompts into the chat as if you were typing them; watches responses
- Judges each response with an LLM and scores it pass / fail
- Generates a self-contained HTML report you can download and share
Same evaluator catalog as the CLI — see evaluators reference.
- Open the OPFOR listing on the Chrome Web Store.
- Click Add to Chrome.
- Pin the OPFOR icon to your toolbar.
Works in any Chromium browser (Chrome, Edge, Brave, Arc). Firefox listing pending.
For contributors or testing unreleased changes:
git clone https://github.com/KeyValueSoftwareSystems/agent-opfor.git
cd opfor
npm install
npm run build:catalog --workspace=@keyvaluesystems/agent-opfor-extensionThen chrome://extensions → enable Developer mode → Load unpacked → select the runners/extension/ folder.
The extension uses a single LLM configuration for all operations (attack generation, judgment, and HTML parsing), configured in the popup and stored in chrome.storage.local on your machine.
| Setting | Description |
|---|---|
| Provider | OpenAI, Anthropic, Google, Groq, DeepSeek, Azure, or Custom (OpenAI-compatible) |
| Model | Model name (dropdown shows common options, or type your own) |
| API Key | Your API key for the selected provider |
| Setting | Description |
|---|---|
| Turns per attack | Number of adversarial messages before judging (1-20, default 10) |
| Wait after send | Seconds to wait for bot response (3-30s) |
| Message length limit | Max characters per attack message |
| Agent description | Manual description of the chat agent (fallback when auto-detect fails) |
| Attack objective | Custom objective to guide the attacker LLM |
| Business use case | Additional context about the target agent |
| Custom evaluator hint | Extra guidance for the judge LLM |
For best results, use a capable model like GPT-4o or Claude Sonnet. Verdict quality depends on the model's reasoning ability.
- Open the chat interface you want to test in a browser tab.
- Click the OPFOR icon.
- Pick a Security Suite (e.g. OWASP LLM Top 10) or select "Custom Evaluators" to pick individual tests.
- Configure your Provider, Model, and API Key.
- Click Execute.
- Watch the run — the attacker types into the chat, the target replies, real-time bubbles show the conversation.
- When complete, view the verdict and Download report.
The extension runs up to 20 turns per evaluator (default 10). It stops a given evaluator early when the judge returns a definitive verdict.
Stopping a run. Both controls take effect within the current turn rather than at the end of the evaluator, so you never wait out the remaining turn budget. A stop can land after a message has been sent but before the reply is read; that turn is then dropped rather than recorded half-finished.
| Control | What you get |
|---|---|
| Pause | A resumable snapshot. Evaluators completed so far keep their verdicts; the one in progress has none yet and is not scored. |
| Stop | A final report. The evaluator in progress is marked CANCELLED rather than judged — scoring a conversation the target never finished would invent a verdict. |
Either way you still get the run's token usage and cost for the work that did happen, and the report downloads the same as a completed one.
Token usage and testing cost are tracked per evaluator and shown on the Done screen and in the downloadable HTML report. Cost covers the attacker and judge LLMs you configured in Options. Whatever the target chat spends on its own inference is excluded — opfor drives it through the browser and cannot observe or meter that spend. See Token usage and testing cost for how the figure is derived and its caveats.
Same agent-redteam catalog as the CLI. Pick by suite or select "Custom Evaluators" to choose individual tests. Full reference: evaluators.md.
| Suite | Best for |
|---|---|
owasp-llm-top10 |
Prompt injection, jailbreaks, sensitive disclosure |
owasp-agentic-ai |
Goal hijack, tool misuse, identity / memory poisoning |
owasp-mcp-top10 |
MCP-specific vulnerabilities |
eu-ai-act-bias |
Demographic bias (age, gender, race, disability) |
output-trust-and-safety |
Hallucination, sycophancy, off-topic drift, ASCII smuggling |
harmful-content |
CBRN, malicious code, violence, self-harm, radicalization |
mitre-atlas |
MITRE ATLAS adversarial ML techniques |
pre-deploy-critical |
Highest-severity failure modes for pre-deployment gates |
quick-smoke |
Fast sanity check with key evaluators |
- Chat-widget targets only. The extension needs a detectable chat input + response area in the DOM. Standalone API endpoints and non-chat agents → use the CLI.
- No MCP / live tool-call evaluators. The judge sees the transcript, not real tool side-effects. For MCP server red-teaming use the CLI's
mode: "mcp"or the MCP server tool. - One agent per run. No cross-agent or inter-agent communication tests.
- Vendor closed shadow-DOM widgets (Salesforce, some Intercom builds) may need a vendor-specific fallback — open an issue with a sample URL if auto-detect fails.
- A paused run does not survive uninstall. Pause/resume works within the browser profile, but the snapshot lives in
chrome.storage.local— uninstalling the extension wipes it.
- LLM API keys are stored in
chrome.storage.localand never leave your browser. No opfor-hosted backend. - Attack prompts and target responses are sent to the LLM providers you configure (OpenAI / Groq / etc.) — same data path as if you'd used the CLI on your own machine.
- The extension does not phone home.