← Safety

核验标记表示资料完整度，不是产品评分。下列未确认项可能影响选型；请按对应来源逐项确认。The confidence mark describes evidence completeness, not a product score. Unconfirmed items below may affect your choice; check them against the relevant sources.

English summaries and interface labels are available. Detailed source notes below are currently in Chinese.

模型与开放条件Model & openness

有两面都要模型：被红队的 target，和驱动攻击的那一面。仓库首页点名 target 覆盖「OpenAI, Anthropic, Azure OpenAI, Microsoft Foundry, Azure Machine Learning, Google Gemini, Google Vertex AI, AWS Bedrock, Hugging Face, Ollama, Groq, OpenRouter, Cohere, and GitHub Copilot」，接入协议写「HTTP, WebSockets, browser automation with Playwright, or custom targets」；文档 latest 把这一点概括为 Any Target。凭据侧官方原文：「PyRIT loads API credentials from environment variables or .env files」，示例变量是 OPENAI_CHAT_ENDPOINT / OPENAI_CHAT_KEY / OPENAI_CHAT_MODEL。

Two sides both need models: the target under red-team, and the side driving the attacks. The repository front page names targets covering "OpenAI, Anthropic, Azure OpenAI, Microsoft Foundry, Azure Machine Learning, Google Gemini, Google Vertex AI, AWS Bedrock, Hugging Face, Ollama, Groq, OpenRouter, Cohere, and GitHub Copilot", with protocols written as "HTTP, WebSockets, browser automation with Playwright, or custom targets"; the docs 'latest' page compresses this into Any Target. On credentials the official wording is "PyRIT loads API credentials from environment variables or .env files", with OPENAI_CHAT_ENDPOINT / OPENAI_CHAT_KEY / OPENAI_CHAT_MODEL as the sample variables.

运行位置Where it runs

装在自己的 Python 环境里跑：pip install pyrit（PyPI 记 requires-python =3.10,3.15，当日版本 1.1.0）。 仓库首页给三种入口——「command-line scanner」、「graphical interface」（CoPyRIT）、以及「extensible Python framework」； 文档 latest 把命令行写作 pyrit_scan 与 pyrit_shell，GUI 写作在浏览器里交互并复核结果。执行发生在你自己的机器； 是否存在官方托管执行面：未取到官方声明。

Installed into your own Python environment: pip install pyrit (PyPI records requires-python =3.10,3.15, current version 1.1.0). The repository front page offers three entry points — a "command-line scanner", a "graphical interface" (CoPyRIT), and an "extensible Python framework"; the docs spell the CLI as pyrit_scan and pyrit_shell, and the GUI as interactive exploration with results reviewed in the browser. Execution happens on your own machine; whether any hosted execution surface exists: no official statement captured.

本地文件Local files

读本机配置与 .env 凭据，写的是扫描产物与状态。文档 latest 明确「Built-in Memory」有两个后端：SQLite 与 Azure SQL—— 前者落在你机器上的库文件，后者落在你自己的数据库。默认 SQLite 文件名与路径、清理与导出方式：本批次未逐字核验。

It reads local configuration and .env credentials, and writes scan artefacts and state. The docs page states "Built-in Memory" has two backends, SQLite and Azure SQL — the first lands in a database file on your machine, the second in your own database. Default SQLite filename and path, plus cleanup and export methods: not verified word for word in this pass.

关机后的任务Tasks after shutdown

长任务的本机语义齐全：自适应多轮攻击与 scenario 都在本地进程里推进，结果可在 CoPyRIT 界面复核（仓库首页 「Explore AI systems interactively and review results in your browser」）。「关机后在别处续跑」这类托管队列语义： 官方未说明——它不是托管服务。

Local semantics for long tasks are all present: adaptive multi-turn attacks and scenarios advance inside local processes, and results can be reviewed in the CoPyRIT interface (repository front page: "Explore AI systems interactively and review results in your browser"). A hosted queue that "keeps running after shutdown": not stated by the vendor — it is not a managed service.

工具与扩展Tools & extensions

组件面按文档 latest 在册的有：Automated Red Teaming（点名的策略含 Crescendo、TAP）、Scenario Framework、 Any Target、Built-in Memory、Flexible Scoring，另有 targets/converters/scorers/memory/orchestrators 这一层模块划分。 与同大类另一份档案的直接接口：文档专页写明 Garak scenario family「implements probes inspired by the Garak framework」， 运行形式是 pyrit_scan run garak.prompt_inject --target openai_chat。MCP 接入：官方文档未说明，记未知。

Component surface on record in the docs: Automated Red Teaming (Crescendo and TAP named), Scenario Framework, Any Target, Built-in Memory, Flexible Scoring, plus the targets/converters/scorers/memory/orchestrators module split. The direct interface with another archive in this category: a dedicated docs page says the Garak scenario family "implements probes inspired by the Garak framework", run as pyrit_scan run garak.prompt_inject --target openai_chat. MCP support: not described in the official docs, recorded as unknown.

上下文与记忆Context & memory

自适应多轮攻击靠的就是可回溯的会话状态，状态存在上述 memory 后端里；文档 latest 把「adaptive multi-turn attacks」 与 scenario 目录并列在册。跨会话记忆的边界、上下文压缩或截断策略：本批次未取到逐条官方正文，记未知。

Adaptive multi-turn attacks depend on revisitable conversation state, and that state lives in the memory backends above; the docs list "adaptive multi-turn attacks" alongside the scenario catalogue. The boundary of cross-session memory, and any compaction or truncation strategy: no itemised official text captured in this pass, recorded as unknown.

权限与限制Permissions & limits

许可面：MIT，版权方 Microsoft（LICENSE 正文直读）。归属面要记一条事实：原 Azure/PyRIT 仓库页写着 「PyRIT has moved! Please see https://github.com/microsoft/PyRIT!」，本档案按迁移后仓库建档。 数据流向：探针与攻击 prompt 发往你配置的 target 端点与攻击模型端点，凭据从环境变量或 .env 载入（官方原文见 model_access 维），扫描记录落在你自己的 SQLite/Azure SQL。是否有默认遥测、留存期条款：未取到官方声明，进 unknowns。 它是评测与取证工具，不做阻断，因此本站不写任何「拦下多少」的比例，也不引用 scenario 报告的数值。

Licence: MIT, copyright holder Microsoft (LICENSE read directly). Ownership needs one recorded fact: the original Azure/PyRIT repository page states "PyRIT has moved! Please see https://github.com/microsoft/PyRIT!", and this archive files the post-migration repository. Data flow: probe and attack prompts go to the target endpoint and the attack-model endpoint you configured, credentials are loaded from environment variables or .env (see the model_access axis), and run records land in your own SQLite/Azure SQL. Whether telemetry is on by default, and retention clauses: no official statement captured, moved to unknowns. It is an evaluation and forensics tool that does not block, so this site writes no "what share it stops" ratio and cites no scenario-report numbers.

适合什么任务Best for

适合：要把多轮自适应攻击编排成可重复的 assessment、需要 Python 侧自己组合 targets/converters/scorers、 要让非工程同学也在本地 GUI 里复核结果、团队已经把 garak 风格探针纳入同一套扫描流程。不适合：只想一条命令扫一个 端点就走（那是 garak 的默认形态）、要托管报告与合规交付物、指望它替人做红队判断。

Fits: orchestrating multi-turn adaptive attacks (Crescendo, TAP) into a repeatable assessment; needing to compose targets/converters/scorers yourself in Python; letting non-engineering reviewers go through results in a local GUI; teams already folding garak-style probes into one scan pipeline. Not a fit: wanting a single command that scans one endpoint and ends there (that is garak's default shape); needing hosted reports and compliance deliverables; expecting it to replace human red-team judgement.

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.