Introduction

Deploying AI agents into production often feels like a gamble because traditional unit tests cannot capture the non-deterministic nature of Large Language Models (LLMs). Developers struggle to detect subtle hallucinations, prompt injections, and performance biases before they reach the end user. Giskard is an open-source Python library designed to solve this by providing a systematic framework for testing and evaluating AI systems, from tabular models to complex agentic pipelines, with over 5,500 GitHub stars.

What Is Giskard?

Giskard is an open-source Python library that automatically detects vulnerabilities in AI models and agentic systems. It provides a comprehensive suite of tools for scanning models for performance biases, data leakage, hallucinations, and security risks like prompt injection. By wrapping AI systems into a standardized Model object, Giskard allows developers to apply a wide range of built-in checks and adversarial tests to ensure reliability and safety.

The project is maintained by Giskard AI and is licensed under the Apache License 2.0. It has evolved from a general ML testing tool (v2) into a modular architecture (v3) specifically optimized for the evaluation of LLM-based agents and RAG (Retrieval-Augmented Generation) systems.

Why Giskard Matters

The “it works in the demo” trap is a primary bottleneck in AI deployment. While a few manual prompts might look correct, AI agents often fail on edge cases, adversarial inputs, or when faced with ambiguous queries. Giskard fills this gap by moving AI evaluation from “vibes-based” testing to a repeatable, automated engineering discipline.

As enterprises move toward autonomous agents that can call tools and access sensitive data, the risk of prompt injection and data leakage increases. Giskard provides the necessary guardrails by aligning its testing suites with industry standards like the OWASP Top 10 for LLMs, NIST, and the EU AI Act, making it essential for teams requiring compliance-ready AI security.

With the release of v3, Giskard has shifted to a modular package system (giskard-checks, giskard-scan), reducing dependency hell and allowing developers to integrate only the components they need for their specific evaluation pipeline.

Key Features

• AI Vulnerability Scanning: Automatically detects performance biases, data leakage, and spurious correlations in models. The Giskard Scan feature uses an AI Red Teamer to interactively find edge cases and vulnerabilities.
• LLM-as-Judge Evaluation: Implements a flexible evaluation system where an LLM is used to assess the quality of another model’s output, allowing for the testing of non-deterministic responses.
• RAG Evaluation Toolkit (RAGET): Specifically designed to evaluate the three core components of RAG systems: the Retriever, the Generator, and the Router. It generates synthetic test sets to benchmark groundedness and faithfulness.
• Adversarial Testing: Provides built-in checks for prompt injection, toxicity, and harmful behavior, ensuring that agents remain safe even when targeted by malicious users.
• Golden Dataset Generation: Automates the creation of ground-truth datasets to prevent regressions over time, ensuring that improvements to the prompt or model do not break existing functionality.
• Modular Architecture (v3): Split into focused packages like giskard-checks for evaluation and giskard-scan for red teaming, allowing for lightweight integration into CI/CD pipelines.
• Compliance Mapping: Maps detected vulnerabilities directly to standards such as the OWASP Top 10 for LLMs, providing a clear path for security and compliance teams to remediate risks.

How Giskard Compares

Giskard distinguishes itself by being more opinionated and providing a complete ecosystem for continuous red teaming. While RAGAS is the industry standard for specific RAG metrics (like faithfulness and answer relevance), Giskard provides a broader security-first approach. It doesn’t just measure the quality of a response; it actively tries to break the system using an AI-orchestrated attack strategy.

DeepEval focuses heavily on unit-testing for LLMs, which is excellent for fast CI checks. However, Giskard’s ability to map findings to the OWASP Top 10 for LLMs makes it the superior choice for enterprise teams who must prove compliance to security auditors. The tradeoff is that Giskard can feel more restrictive if you want to define highly custom, low-level metrics from scratch compared to more modular frameworks like RAGAS.

Getting Started: Installation

Giskard offers different installation paths depending on whether you are using the legacy v2 system or the new modular v3 architecture. Giskard v3 requires Python 3.12 or higher.

Install Giskard v3 (Modular)

For the new agent-focused evaluation and testing library, install the core package:

pip install giskard

To specifically use the evaluation and checks library for testing agents:

pip install giskard-checks

Install Giskard v2 (Legacy)

For those working with tabular models or requiring the legacy scan features, you can still install v2:

pip install "giskard~=2.0"

Prerequisites

Since many Giskard checks require an LLM to act as a judge, you must configure an LLM provider. Giskard supports any LiteLLM-compatible provider. For OpenAI, set the following environment variable:

export OPENAI_API_KEY="your-api-key"

How to Use Giskard

The basic workflow in Giskard involves wrapping your AI system into a Giskard Model object and then applying a scan or a set of checks. This abstraction allows Giskard to interact with any LLM, black-box agent, or multi-step pipeline regardless of the underlying framework (LangChain, LlamaIndex, etc.).

For a simple evaluation, you start by defining your model wrapper and then running a scan. The scan will automatically generate adversarial prompts and test the model’s responses against built-in safety and performance checks. If a vulnerability is found, Giskard provides the exact prompt that caused the failure, allowing you to refine your system prompts or system instructions.

For RAG systems, you use the RAG Evaluation Toolkit (RAGET) to generate a synthetic dataset of questions and answers based on your documents. You then run these against your RAG pipeline to measure groundedness and faithfulness, identifying exactly where the pipeline is fails—whether in the retrieval step or the generation step.

Code Examples

The following examples demonstrate how to use Giskard’s core capabilities for LLM and RAG evaluation.

Basic LLM Scan

import giskard
from giskard import Model, scan

# Wrap your LLM as a Giskard Model
model = Model(
    model_type="text-generation",
    predict=lambda x: my_llm_function(x)
)

# Run the automatic vulnerability scan
results = giskard.scan(model)
# The results are then viewed in a dashboard or exported to a report

This example shows how Giskard wraps a simple function as a model and uses the scan function to automatically probe for vulnerabilities like toxicity and prompt injection.

RAG Evaluation with RAGET

from giskard.rag import RAGET

# Initialize the RAG Evaluation Toolkit
raget = RAGET(documents=my_docs)

# Generate a synthetic test set of questions and answers
test_set = raget.generate_test_set()

# Evaluate the RAG pipeline
results = raget.evaluate(model=my_rag_pipeline, dataset=test_set)

Here, Giskard’s RAGET tool is used to create a synthetic “golden dataset” and then evaluate the pipeline’s performance on that dataset, measuring the quality of the retrieval and the generation.

Real-World Use Cases

Giskard is particularly effective in scenarios where AI reliability is a non-negotiable requirement for production deployment.

• Financial Services Compliance: A bank using a customer-facing AI agent to handle loan applications. They use Giskard to ensure the agent does not exhibit performance bias against specific demographics and to prevent the agent from leaking sensitive internal loan-approval criteria.
• Healthcare QA Systems: A medical AI assistant that provides information based on internal clinical guidelines. The team uses Giskard’s RAGET to ensure that every answer is strictly grounded in the provided documents, preventing dangerous hallucinations in a high-stakes environment.
• Enterprise Knowledge Bases: A company implementing an internal HR bot. They use Giskard’s automated red teaming to ensure that an employee cannot use prompt injection to bypass security filters and access payroll information of other employees.
• CI/CD Integration for LLM Ops: An AI engineering team integrating giskard-checks into their GitHub Actions pipeline. Every time a prompt is changed, the pipeline runs a suite of checks to ensure that fixing one hallucination does not introduce a new vulnerability or regression.

Contributing to Giskard

Giskard is an open-source project and welcomes contributions from the AI community. You can contribute by submitting bug reports, proposing new test suites, or implementing new evaluation metrics. The project maintains a detailed CONTRIBUTING.md file in the repository to guide new contributors through the setup and submission process.

The team encourages developers to contribute new “checks” to the library, as the same vulnerabilities often appear across different AI systems. By contributing a check, you can help the community identify common failure modes of LLMs and agents.

Community and Support

Giskard has a built a strong community of AI engineers and security researchers. Official support channels include the GitHub Discussions tab for technical questions and GitHub Issues for bug reporting. For real-time collaboration and community support, the project maintains an active Discord server where developers can share their evaluation strategies and red teaming results.

The project also provides extensive documentation at docs.giskard.ai, which includes quickstart guides, notebook tutorials and a comprehensive API reference.

Conclusion

Giskard provides the essential bridge between a successful AI demo and a reliable production system. By transforming AI evaluation from a manual, anecdotal process into a systematic engineering discipline, it allows teams to deploy AI agents with confidence. Whether you are building a RAG pipeline or a complex autonomous agent, Giskard’s combination of automated red teaming and compliance-ready testing is a powerful asset for any LLM Ops pipeline.

For those who need a high degree of security and compliance, Giskard is the right choice. For teams that only need basic quality metrics, simpler tools like RAGAS may suffice. We recommend starting with the giskard-checks package to integrate basic evaluations into your CI/CD pipeline and then moving to the full scan for deeper vulnerability discovery.

Star the repo, try the quickstart, and join the community to start building more trustworthy AI.

Resources

• Giskard GitHub Repository
• Official Giskard Documentation
• Giskard AI Website