{"slug": "reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool", "title": "Reddie – Autonomous AI Red-Teaming and GitHub PR Patching DevTool", "summary": "Reddie, an autonomous DevSecOps tool from reddie-ai, automatically discovers LLM application vulnerabilities, converts them into isolated pytest reproduction test suites, synthesizes hardened prompt/guardrail patches, verifies them in a sandbox, and opens a GitHub Pull Request with the fix in a single command. The tool supports three modes: offline deterministic heuristics, AI-powered red-teaming via Groq, and a full pipeline that creates live GitHub PRs, with auto-remediation for OWASP LLM01, LLM02, LLM06, and LLM07 categories.", "body_md": "**Reddie** is an autonomous DevSecOps tool that automatically discovers LLM application vulnerabilities, converts them into isolated `pytest`\n\nreproduction test suites, synthesizes hardened prompt/guardrail patches, verifies them in a test sandbox, and opens a GitHub Pull Request with the fix — all in a single command.\n\n📖\n\nNot in Computer Science?Read our[Plain-English Non-Technical Explainer]for a simple, analogy-based breakdown.\n\n```\n# Install (local)\npip install -e .\n\n# Mode 1: Offline — Fast deterministic heuristics, zero API cost\nreddie --repo-path ./path/to/repo --export-html report.html --dry-run\n\n# Mode 2: AI-Powered — Real LLM red-teaming via Groq\nexport GROQ_API_KEY=\"gsk_...\"\nreddie --repo-path ./path/to/repo --export-html report.html --dry-run\n\n# Mode 3: Full pipeline — AI audit + live GitHub Pull Request\nexport GROQ_API_KEY=\"gsk_...\"\nexport GITHUB_TOKEN=\"ghp_...\"\nreddie --repo-path ./path/to/repo --github-repo owner/repo --export-html report.html\n```\n\nAdd to `.github/workflows/reddie-security.yml`\n\n:\n\n```\nname: 🛡️ Reddie Security Audit\n\non:\n  pull_request:\n    branches: [ main ]\n  schedule:\n    - cron: '0 2 * * *'  # Daily 2:00 AM UTC\n\njobs:\n  security-audit:\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      pull-requests: write\n    steps:\n      - uses: actions/checkout@v4\n      - name: Run Reddie\n        uses: reddie-ai/reddie@v1\n        with:\n          repo-path: '.'\n          github-token: ${{ secrets.GITHUB_TOKEN }}\n          groq-key: ${{ secrets.GROQ_API_KEY }}\n          export-html: 'report.html'\nphp\n[RECON] ---> [REDTEAM] ---> [REPRODUCE] ---> [PATCH] ---> [VERIFY] ---> [PR]\n```\n\n| Stage | What it does |\n|---|---|\nRecon |\nStatic AST + regex analysis. Extracts system prompts and tool definitions from Python, JS, TS files. |\nRed Team |\nGenerates and executes adversarial attacks using real LLM simulation (Groq) or deterministic heuristics. |\nReproduce |\nAuto-generates an isolated `pytest` suite that proves the vulnerability is real and repeatable. |\nPatch |\nLLM-synthesized fix: injects confidentiality boundaries, input guardrails, and privilege checks into the source. |\nVerify |\nRuns both reproduction tests and full regression suite in a sandboxed subprocess. Retries up to 3 times. |\nPR |\nPushes a `security/fix-*` branch and opens a GitHub Pull Request with the full audit report in the description. |\n\n| OWASP ID | Category | Auto-Remediation |\n|---|---|---|\nLLM01 |\nPrompt Injection | Instruction locks & input guardrails |\nLLM02 |\nSensitive Information Disclosure | Confidentiality directives & token redaction |\nLLM06 |\nExcessive Agency | Privilege boundary enforcement |\nLLM07 |\nSystem Prompt Leakage | System instruction confidentiality boundaries |\n\n```\nreddie [OPTIONS]\n\n  --repo-path PATH        Target repository to scan (default: .)\n  --endpoint-url URL      Live LLM API endpoint to fuzz (default: mock://local)\n  --github-repo REPO      GitHub repo for PR creation (e.g. owner/repo)\n  --github-token TOKEN    GitHub PAT (or GITHUB_TOKEN env var)\n  --groq-key KEY          Groq API key (or GROQ_API_KEY env var)\n  --provider PROVIDER     LLM provider: groq | openrouter | openai (default: groq)\n  --export-html PATH      Save executive HTML audit report\n  --export-json PATH      Save structured JSON audit report\n  --max-retries N         Max auto-patch retry attempts (default: 3)\n  --dry-run               Audit locally, skip GitHub PR creation\n  -v, --verbose           Enable debug logging\npytest -v\n# 13 passed in 3.5s\nreddie/\n├── main.py                  # CLI entry point\n├── workflow.py              # LangGraph StateGraph orchestration\n├── state.py                 # AgentSecurityState TypedDict\n├── agents/\n│   ├── recon.py             # Static analysis node\n│   ├── red_team.py          # Adversarial fuzzing node\n│   ├── reproduce.py         # PyTest generator node\n│   ├── patcher.py           # LLM patch synthesis node\n│   ├── verifier.py          # Sandbox test runner node\n│   └── github_pr.py         # Git branch + PR creator node\n├── tools/\n│   ├── static_analyzer.py   # AST + regex prompt/tool extractor\n│   ├── fuzzer_client.py     # HTTP fuzzer + heuristic evaluator\n│   ├── llm_client.py        # Groq client: simulate, judge, patch\n│   ├── reporter.py          # HTML + JSON OWASP report generator\n│   ├── git_tools.py         # Git branch/commit/push + PyGithub PR\n│   └── test_runner.py       # Subprocess pytest harness\n├── tests/                   # Full test suite (13 tests)\n├── assets/\n│   └── banner.jpg\n├── Dockerfile\n├── docker-compose.yml\n├── action.yml               # GitHub Action definition\n└── NON_CS_EXPLAINER.md      # Plain-English guide\n```\n\nBuilt with [LangGraph](https://github.com/langchain-ai/langgraph) · Powered by [Groq](https://groq.com) · Mapped to [OWASP LLM Top 10 (2025)](https://owasp.org/www-project-top-10-for-large-language-model-applications/)", "url": "https://wpnews.pro/news/reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool", "canonical_source": "https://github.com/irfadox/reddie", "published_at": "2026-08-31 05:46:47+00:00", "updated_at": "2026-08-31 06:23:10.075131+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "developer-tools", "artificial-intelligence"], "entities": ["Reddie", "reddie-ai", "Groq", "GitHub", "OWASP"], "alternates": {"html": "https://wpnews.pro/news/reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool", "markdown": "https://wpnews.pro/news/reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool.md", "text": "https://wpnews.pro/news/reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool.txt", "jsonld": "https://wpnews.pro/news/reddie-autonomous-ai-red-teaming-and-github-pr-patching-devtool.jsonld"}}