Feed a tool result back to a model with an injected instruction inside it and the outcome is predictable. Across nine production models tested against the same payload, nine execute the injected instruction when the tool result reaches the model unsanitized. Sanitize that same tool result before it goes back in, and the number drops to zero. Same models, same attack string, different result decided entirely by what the application does with the tool output before the model ever sees it. That split is the premise Brace tests.
Brace is a vulnerability scanner, not a red-teaming tool. It doesn’t try to fool the model into ignoring its training. It sends known-exploitable prompts at an AI endpoint and checks whether the application around the model catches, blocks, or mitigates the attack. Model adversarial robustness, jailbreaks, prompt leakage, alignment behavior, network and TLS issues, database exposure — none of that is in scope. The question Brace asks is narrower and more mechanical: does your application sanitize tool results, validate AI-generated output, and isolate sessions correctly.
It covers 32 attack vectors across nine categories: MCP (tool result injection, tool scope expansion, persistent config injection, process escalation), RAG poisoning, schema manipulation, prompt pipeline injection, out-of-bounds tool arguments and cascading tool chains, AI-generated infrastructure-as-code (Terraform, Nginx, Dockerfile, crontab, GitHub Actions, Kubernetes), content injection, output validation failures (SSRF, path traversal, command injection, webhook passthrough), and exfiltration via system prompt exposure or markdown URLs. Each vector maps to a specific application-layer failure mode, ships with a detection mechanism, and includes remediation code. The original core vector set was validated against production models directly; the newer content, output, and exfil categories are pending re-verification, so a scan against your own target is what confirms current exploitability rather than the vector’s original validation.
Running a scan looks like:
brace scan --url http://localhost:8080/chat --model gpt-4o --output report.json
Results export to console, JSON, HTML, or SARIF, so a scan can sit in CI and fail a build on SARIF findings through GitHub Advanced Security. Vectors and categories can be suppressed inline or via a .brace.yaml file with a reason and optional expiry, which matters once you’ve accepted a finding as mitigated by something outside the application, like a WAF rule.
Vectors map to OWASP Top 10 for LLM Applications and NIST AI RMF controls, which is the detail that makes a Brace report usable in a compliance conversation rather than just an engineering one.
Brace is AGPL-3.0-or-later, with a commercial license available for embedding it in closed-source products without the AGPL’s source-disclosure obligations.