Compliant LLM

Compliant LLM is a security toolkit designed to secure AI systems such as chatbots, AI agents, and MCP servers. It provides tools to identify and mitigate vulnerabilities through several core capabilities:

• Security Testing: Testing against 8+ attack strategies (e.g., prompt injection, jailbreaking, and context manipulation).
• Compliance Analysis: Verifying systems against industry standards.
• Provider Support: Integration with multiple LLM providers via LiteLLM.
• Visual Dashboard: An interactive UI for analyzing test results.
• Parallel Testing: Capability to run security assessments in parallel for speed.
• Detailed Reporting: Generation of comprehensive reports with actionable insights.

Compliant LLM is a toolkit designed for Infosec, compliance, and GenAI teams to ensure AI systems (agents, prompts, MCP servers, and models) are secure and compliant with internal policies and industry frameworks such as NIST, ISO, HIPAA, and GDPR.

Key Capabilities:

• Security Testing: Validates systems against 8+ attack strategies, including prompt injection, jailbreaking, and context manipulation.
• Compliance Analysis: Checks systems against industry standards and best practices.
• Provider Support: Integrates with multiple LLM providers via LiteLLM.
• Visual Dashboard: Provides an interactive UI for analyzing test results.
• End-to-End Testing: Enables testing of entire AI workflows.
• Detailed Reporting: Generates comprehensive reports with actionable insights.

The CLI uses a specific directory structure to manage its artifacts:

• reports/: Stores all generated test reports (this directory is excluded from git by default).
• configs/: Contains configuration files used for testing.
• templates/: Contains template files used for generating configurations and prompts.

You can supply the system prompt to the test command using one of two methods:

1. Direct Input: Use the --prompt (or -p) flag to pass the string directly.
2. Configuration File: Use the --config (or -c) flag to point to a YAML configuration file containing your settings.

To optimize your testing workflow, follow these recommendations:

1. Use Configuration Files: For complex testing scenarios, use YAML config files instead of passing numerous command-line arguments.
2. Organize Reports: Use descriptive filenames for reports to keep test results organized within the reports/ directory.
3. Parallel Testing: Use the --parallel flag when running large test suites to increase execution speed.
4. Provider Selection: Test against multiple providers to evaluate how prompt performance varies across different models.
5. Regular Testing: Integrate prompt testing into your development lifecycle to identify vulnerabilities early.

After installation, you can launch the interactive dashboard using the compliant-llm CLI. The dashboard allows you to connect to your LLM provider and perform robustness testing on your system prompts.

compliant-llm dashboard

Compliant LLM retrieves API keys from environment variables. Ensure these are set in your shell before running tests.

# For OpenAI models
export OPENAI_API_KEY=your-api-key-here

# For Anthropic models
export ANTHROPIC_API_KEY=your-anthropic-key

# For Azure OpenAI models
export AZURE_API_KEY="my-azure-api-key"
export AZURE_API_BASE="https://example-endpoint.openai.azure.com"
export AZURE_API_VERSION="2023-05-15"

Compliant LLM uses YAML configuration files (stored in the configs/ directory by default) to define test scenarios. A valid configuration must include a prompt and either strategy or strategies.

Example of a minimal configuration:

# Basic required settings
prompt: "You are a helpful assistant for a banking organization. Always be professional and courteous."
strategy: prompt_injection,jailbreak

# Provider settings
provider: openai/gpt-4o
temperature: 0.7

# Output settings
output: "report_name"

Replace pip install with uv pip install for faster package installation and resolution. This includes editable installs and installing specific development dependencies.

# Install current project in editable mode
uv pip install -e .

# Install specific dev dependencies
uv pip install pytest flake8 black mypy

To develop on compliant-llm, clone the repository and install it in editable mode using uv to ensure changes are reflected immediately.

# Clone the repository
git clone https://github.com/fiddlecube/compliant-llm.git
cd compliant-llm

# Install in development mode
uv pip install -e .

To confirm that the installation was successful and check the installed version, run the --version flag.

compliant-llm --version

When migrating from pyenv to uv, replace pyenv virtualenv and pyenv activate with uv venv and standard shell activation. uv creates a local .venv directory by default.

# Create a virtual environment
uv venv .venv

# Activate the environment
source .venv/bin/activate