Promptfoo + Humanbound

Promptfoo, used by over 300,000 developers and 156 Fortune 500 companies for red teaming AI agents, can now integrate with Humanbound's firewall training pipeline. The integration allows teams to import Promptfoo's scan results into Humanbound's continuous monitoring and compliance mapping, extending security coverage from development to production.

If you're building AI agents, there's a good chance Promptfoo is already in your stack. It's used by over 300,000 developers and 156 of the Fortune 500 to red team agents and RAG pipelines, catching prompt injection, jailbreaks, data leaks, and business rule violations before they ship. It's a genuinely good tool, and a lot of teams reasonably ask: if we already have Promptfoo, why would we add Humanbound too? The honest answer is that you don't have to choose. The two were built to plug into each other, not compete for the same slot. Promptfoo's strength is breadth and community. Its red teaming engine draws on real-time threat intelligence from a huge open-source user base, and its evaluations product covers prompts, models, and RAG pipelines beyond just security. It's the tool a lot of teams reach for first, often inside CI/CD, to catch obvious issues early. To be fair, continuous monitoring like this is something you could build with Promptfoo or other tools too, it's not exclusive to us. Where I'd point to a real difference is time-to-value: Humanbound's monitoring runs out of the box, you turn it on with one command and it's live on our infrastructure, while getting the same result with Promptfoo or similar tools means setting up and maintaining that scheduling and CI/CD wiring yourself first. Findings are also mapped directly to compliance frameworks, EU AI Act, NIST AI RMF, OWASP LLM and Agentic AI Top 10, with severity calibrated by domain. Run side by side, you get Promptfoo's community-driven breadth on one axis and Humanbound's continuous, compliance-aware depth on the other. This isn't just a "they can coexist" argument. Humanbound's firewall training pipeline has explicit, built-in support for importing Promptfoo's scan results: python Auto-detected from Promptfoo's JSON eval export hb firewall train --import results.json:promptfoo That command pulls Promptfoo's evalId and results data, merges it with Humanbound's own adversarial and QA test logs, and uses the combined set to train the Tier 2 agent-specific classifier inside the Humanbound Firewall. In practice, that means every prompt injection Promptfoo already caught in your CI pipeline becomes training data for the runtime defense that protects your agent in production, without re-running those attacks from scratch. A team already running Promptfoo in CI might add Humanbound in three steps: The result is a security posture that starts with Promptfoo's fast, broad coverage in development and extends into Humanbound's continuous, evidence-backed defense in production, with the compliance mapping EU AI Act, HIPAA, FCA, and more to back it up when someone asks for proof. If you're already running Promptfoo, the fastest way to see this in action is to export your last red team scan and run it through hb firewall train --import . It won't replace what Promptfoo already does well. It extends it into the part of the lifecycle testing alone can't cover: what happens after the agent is live.