feat: Add generic red-team adversarial testing stage (Promptfoo)

[ikrispin]

Summary

Adds a generic red-team adversarial testing stage to the ABEvalFlow Konflux pipeline. Any submission with a live endpoint (A2A agent, MCP server, or HTTP API) can be adversarially tested using Promptfoo as part of the CI/CD evaluation — without any application-specific code.

The red-team task generates domain-aware attacks at runtime based on the submission's metadata.yaml (purpose, policy, auth context), sends them to the target, and grades responses with an LLM-as-judge. Results feed into the unified scorecard as a security gate.

Builds on top of #60 (generic Konflux integration). Adds the 8th core Tekton task to the framework.

Architecture

The red-team stage sits between test and evaluate, gated on ENABLE_RED_TEAM=true:

Konflux Pipeline
├── parse-snapshot
├── prepare
├── test (security + quality)
├── red-team (NEW — adversarial testing via Promptfoo)     ← opt-in
│   ├── generate-config (from metadata.yaml + eval-engine)
│   └── run-redteam (Promptfoo generate + eval against target)
├── evaluate (Harbor/ASE/MCPChecker/A2A)
├── analyze-scorecard (now includes red-team gate)
├── store
└── emit-result → TEST_OUTPUT

The task is skipped when:

• ENABLE_RED_TEAM=false (default — opt-in)
• EVAL_ENGINE=ase (no live endpoint to attack)
• No agent-endpoint provided

What's included

New Tekton task

File	Purpose
pipeline/tasks/konflux/red-team.yaml	Generic adversarial testing task. 3 steps: setup, generate-config, run-redteam.

Updated files

File	Change
scripts/generate_redteam_config.py	Engine-agnostic config generator. Uses --target-url to produce correct Promptfoo provider (A2A JSON-RPC, MCP native, or HTTP).
pipeline/integration/konflux-eval-pipelinerun.yaml	Inserts red-team stage with when gating. Adds ENABLE_RED_TEAM, RED_TEAM_MODE, RED_TEAM_CONCURRENCY params.
scripts/aggregate_scorecard.py	Consumes redteam-results.json as a security gate in the unified scorecard. Excludes infrastructure errors from findings count.
pipeline/integration/Makefile	Adds red-team to the Tekton Bundles list (make bundles publishes 8 tasks).

New OCI bundle

Bundle	Task
abevalflow-task-red-team:0.1	red-team

Container image (reused)

Image	Purpose
quay.io/rh-ee-ikrispin/abevalflow-redteam:latest	Promptfoo runtime + A2A response parser. Already published from the POC work.

Engine support

Engine	Red-team support	Provider type
a2a	Yes	HTTP provider with JSON-RPC body + custom responseParser.js
mcpchecker	Yes	Promptfoo native MCP provider (id: mcp)
harbor / HTTP	Yes	HTTP provider with standard chat messages body
ase	No (skipped)	No live endpoint to attack

Two modes

Mode	Behavior	Tests	Use case
smoke	Quick coverage, basic strategy only	~25	Fast CI gate (~2 min)
full (default)	All strategies, comprehensive	~1750	Thorough evaluation (~3-4 hours)

Both modes generate attacks on the fly from the submission's metadata.yaml using Promptfoo Cloud. Only tests plugins relevant to agent behavior (policy, hijacking, prompt-extraction, cybercrime, non-violent-crime). Content safety categories (weapons, sexual content, self-harm, etc.) are the underlying LLM's responsibility and are excluded.

New parameters

Parameter	Description	Default
ENABLE_RED_TEAM	Opt-in to adversarial testing	"false"
RED_TEAM_MODE	smoke (quick) or full (comprehensive)	"full"
RED_TEAM_CONCURRENCY	Parallel Promptfoo evaluations	"12"

How a submission enables red-teaming

Add to metadata.yaml:

red_team:
  enabled: true
  purpose: "What this agent/server does and its scope..."
  auth_context: "Users are authenticated X with permissions to Y..."
  policy: "Must refuse Z, must not reveal W..."

The purpose and auth_context fields drive Promptfoo's domain-aware attack generation. If omitted, the task falls back to the submission's description field and a generic security policy.

Scorecard integration

When red-team results exist, the scorecard aggregator adds a red_team security gate:

• passed: 0 genuine findings (infrastructure errors excluded)
• score: 1.0 - (findings / total_tests)
• findings: individual vulnerability descriptions (capped at 20)

This gate participates in the overall pass/warn/fail recommendation alongside engine, security, quality, and behavioral gates.

Key design decisions

Runtime config generation — No baked-in test suites. Config is generated fresh from submission metadata every run. This ensures every target gets tests tailored to its declared scope and purpose.

Opt-in by default — ENABLE_RED_TEAM=false keeps the pipeline unchanged for existing consumers. Teams enable it when ready.

Infrastructure error filtering — The scorecard excludes "fetch failed" errors (LLM judge timeouts) from the findings count to avoid false positives from infrastructure issues.

Focused plugin categories — Only tests plugins relevant to agent behavior (policy, hijacking, prompt-extraction, cybercrime, non-violent-crime). Content safety categories (weapons, sexual content, self-harm, etc.) are the underlying LLM's responsibility, not the agent's.

Backwards-compatible CLI — generate_redteam_config.py accepts both --target-url (new) and --agent-endpoint (deprecated alias) for compatibility with the existing ab-eval-flow pipeline.

POC validation

The red-team approach was validated in a POC against the Google Lightspeed Agent (A2A):

• 1750-test focused suite (5 plugin categories, all strategies): 0 genuine security vulnerabilities found (97.2% pass rate; 49 failures are availability issues due to missing MCP tools in the test deployment)
• Full details in red-team-eval/docs/poc-report.md

Known limitations

Item	Details
Promptfoo Cloud auth	Requires a promptfoo-cloud-credentials Secret with an API key. Attack generation uses the Promptfoo Cloud service in both modes.
Rate limiting	The target agent's rate limiter (if any) constrains effective concurrency. Recommended j=4 for targets with 1000 req/hr limits.
Response parser	The A2A responseParser.js handles safety-blocked responses. MCP and HTTP engines use Promptfoo's built-in parsing.
Bundle SHA pinning	Uses :0.1 tag (mutable). Should pin by digest for production.

Related

• feat: Generic Konflux integration for ABEvalFlow evaluation pipeline #60 (Generic Konflux integration — prerequisite)
• POC report
• Promptfoo documentation

[GuyZivRH]

Consolidated PR Review: #65 — Konflux + Promptfoo red-team

PR: #65
Author: ikrispin
Branch: ikrispin:konflux-redteam → main
HEAD: 7aa828a9
Size: +3,403 / −0 · 15 files · 3 commits
Prerequisite: #60 (Konflux generic integration) — still open
Consolidated from: kxqbz_, qmwxf_, qmxnk_, zplhk_, xrdmw_ (2026-08-04)

---

Verdict

Request changes. Direction is strong and worth landing, but the PR is not merge-ready.

Consensus across reviews (4/5 explicit request-changes; 1 approve was high-level and missed the scorecard schema bug): opt-in red-team via Promptfoo is the right product shape, but correctness, CI, and ops gaps must be fixed first. The most serious finding is that the scorecard gate is constructed with invalid GateResult fields and is silently dropped at runtime.

---

What this PR is

Two stacked capabilities under one PR (title understates scope):

1. Full Konflux IntegrationTestScenario stack (same lineage as open #60): parse-snapshot → prepare → test → evaluate → analyze-scorecard → store → emit-result, plus Makefile / GHA bundle push / secrets template / integration guide.
2. Opt-in red-team stage between test and evaluate: runtime Promptfoo config from metadata.yaml, attack live A2A / MCP / HTTP targets, feed redteam-results.json into the unified scorecard.

parse-snapshot → prepare → test → red-team (opt-in) → evaluate → analyze-scorecard → store → emit-result

Key new pieces: pipeline/tasks/konflux/red-team.yaml, scripts/generate_redteam_config.py, scorecard hook in scripts/aggregate_scorecard.py, params ENABLE_RED_TEAM / RED_TEAM_MODE / RED_TEAM_CONCURRENCY.

---

What looks good (consensus)

• Opt-in default (ENABLE_RED_TEAM=false) avoids surprising cost/time for existing consumers.
• Runtime config from metadata.yaml (purpose / policy / auth_context) is the right generic model; no per-app baked suites.
• Engine-aware providers (A2A JSON-RPC, native MCP, generic HTTP) are a solid first cut.
• Focused plugins (policy, hijacking, prompt-extraction, cybercrime, non-violent-crime) correctly separate agent behavior from base-model content safety.
• Infra noise filtering (fetch failed) in task + aggregator reduces judge-timeout false positives.
• Artifact path wiring is correct: task writes reports/<submission>/redteam-results.json; analyze passes that directory as --reports-dir.
• Smoke vs full modes match CI vs deep-assessment needs (once defaults are fixed).
• POC narrative (Lightspeed) supports the approach.

---

Must fix (blocking)

1. CI: ruff format failing

Fails on scripts/aggregate_scorecard.py and scripts/generate_redteam_config.py. Pytest never runs.

ruff format scripts/aggregate_scorecard.py scripts/generate_redteam_config.py

2. Scorecard red-team gate is broken (silent drop)

GateResult is constructed with invalid kwargs (name= instead of gate_name, details as str, findings as list[str]). Real schema requires:

• gate_name (+ optional policy_key)
• details: dict
• findings: list[Finding] (severity, message, optional rule_id)

The broad except Exception logs a warning and skips the gate, so scorecard integration looks wired but does not work.

Fix: construct a valid GateResult / Finding list; add a unit test with a fixture redteam-results.json. Prefer gate_name="security" + policy_key="red_team" to match other security gates, and respect gate_policy enablement like peer gates.

3. Promptfoo Cloud credentials claimed but not wired

PR body requires promptfoo-cloud-credentials, but:

• red-team.yaml mounts no Promptfoo secret / env
• secrets-template.yaml has no such Secret
• only PROMPTFOO_DISABLE_TELEMETRY / CI=true are set

Fix: add secret to template; mount into run-redteam as the env Promptfoo expects; if ENABLE_RED_TEAM=true and creds missing, fail or emit explicit skipped/error status (not a green pass).

4. MCPChecker target not wired

PipelineRun passes only agent-endpoint: $(params.AGENT_ENDPOINT). MCPChecker users use MCP_URL. Empty endpoint → early skip with redteam-passed=true / findings=0. Claimed MCP support does not run.

Fix: resolve target from AGENT_ENDPOINT or MCP_URL by engine (or pass both and choose in the task). Do not treat misconfiguration as a clean security pass when red-team is enabled.

5. Fail-open on generate / eval / missing results

When red-team is enabled and supposed to run:

• missing promptfooconfig.yaml → ERROR then exit 0
• set +e around Promptfoo; EVAL_EXIT unused
• missing/unparseable JSON → findings 0, passed=true

Fix: fail the step, or write redteam-status.json / set failed-or-skipped results, and omit or fail the scorecard gate when results are absent after a non-skip path.

6. Merge / scope with #60

Branch carries the full Konflux stack plus red-team under a red-team-only title. #60 is still open.

Fix: either merge #60 first and rebase a thin #65, or retitle #65 as “Konflux integration + red-team” and review it as one deliberate unit.

---

Should fix

#	Issue	Ask
7	Personal Quay / fork defaults (quay.io/rh-ee-ikrispin/..., some pipeline-repo-url → ikrispin/ABEvalFlow)	Org registry + RHEcosystemAppEng defaults; pin digests in reference PipelineRun
8	Docs say 7 core tasks; Makefile has 8 including red-team; guide omits red-team params/secrets	Update architecture, params, secrets
9	Default RED_TEAM_MODE=full (~90 min–hours) for CI reference	Default smoke; reserve full for nightly/explicit
10	CLI --mode defaults to smoke while PipelineRun defaults to full	Align
11	--agent-endpoint alias broken (--target-url is required=True)	Mutual exclusive required group / validate one of two
12	apiBaseUrl = llm_base_url.rstrip("/v1") is character-based rstrip	Explicit suffix strip of /v1 then trailing /
13	No unit tests for generator or scorecard red-team path	Provider shapes, metadata fallbacks, enabled: false, gate construction
14	responseParser.js copied with || true	Fail early for eval-engine=a2a if missing
15	Harbor engine uses OpenAI-style HTTP provider	Document “needs live HTTP endpoint” or skip Harbor like ASE
16	Mutable :0.1 / :latest tags	Digest pin for production examples (author acknowledges)
17	Skip path writes redteam-passed=true	Prefer skipped/empty results so dashboards are not misleading
18	Red-team ignores gate_policy	Wire policy_key="red_team" through standard policy enablement

---

Design questions (non-blocking)

1. Red-team before evaluate: intentional (probe then functional), or should it run after / in parallel with a budget?
2. Konflux-only today — should main OpenShift ci-pipeline get an optional parity stage later?
3. Promptfoo Cloud acceptable for Red Hat / air-gapped tenants? Offline fallback?
4. When metadata.red_team.enabled: false but pipeline enable is true, should Promptfoo steps be skipped entirely (today generator emits a stub and run may still invoke Promptfoo)?
5. Confirm Tekton evaluate.runAfter: [red-team, test] when red-team is when:-skipped (expected OK; document it).

---

Merge bar

• ruff format green; pytest green
• Valid GateResult / Finding construction + unit test (gate actually appears on scorecard)
• Promptfoo credentials in secrets template and mounted in task; no silent green on missing creds
• MCP URL wired for mcpchecker
• Fail closed (or explicit skip/error) when enable=true and generate/eval/results fail
• Resolve #60 merge order / retitle scope
• Org Quay + org git defaults; digest pinning plan for reference PipelineRun
• Konflux guide: 8 tasks, red-team params, secrets, harbor limitation
• Default CI mode smoke; fix --agent-endpoint alias; fix rstrip("/v1")
• Unit tests for generate_redteam_config.py
• (Recommended) One Konflux smoke run with ENABLE_RED_TEAM=true

---

Sources

File	Stance	Notable unique findings
kxqbz_pr_65_review.md	Approve	High-level pros; noted secret + tag pinning
qmwxf_pr65_review.md	Request changes	CI ruff; secret template; repo URL defaults; doc count; parser/`
qmxnk_pr65_konflux_redteam.md	Request changes	GateResult schema bug; gate_policy; full-mode default; #60; harbor skip
zplhk_pr65_review.md	Request changes	MCP wiring; creds not mounted; rstrip bug; fail-open results
xrdmw_pr_65_review.md	Request changes	Scope vs #60; personal Quay; MCP; fail-open; broken alias; mode mismatch

Consensus blockers to treat as authoritative: CI format, GateResult schema, Promptfoo auth wiring, MCP target wiring, fail-open run semantics, #60/scope clarity.

[ikrispin]

Thanks for the thorough review @GuyZivRH. Pushed fixes for both PRs:

PR #60 — Konflux generic integration (eec559e)

Blocking items fixed:

• Remote eval Pod now clones SUBMISSION_REPO_URL separately when it differs from PIPELINE_REPO_URL — fixes the generic case where submissions live in a different repo
• Failed remote Pod now exits 1 instead of silently passing (was breaking out of the wait loop and falling through to log scrape with exit 0)
• All 4 task defaults corrected from ikrispin/ABEvalFlow to RHEcosystemAppEng/ABEvalFlow (test, store, prepare, analyze-scorecard)
• Fail closed: exit 1 when report.json is missing after eval, when engine commands fail with no results produced, and when remote log extraction fails

Should-fix items addressed:

• llm-credentials Secret wired via optional SecretKeyRef in evaluate task; LLM_API_KEY param added to reference PipelineRun
• Hardcoded LiteLLM URL default removed from test + prepare tasks (now empty — consumer must provide)
• Hardcoded OpenShift console URL default removed from analyze-scorecard
• MCPChecker model defaults cleared (uses mcpchecker's own defaults)
• .components[0] footgun documented in parse-snapshot description with multi-component guidance
• Engine x mode validation matrix added to integration guide
• Comment added about disabled security/quality gates in reference PipelineRun

PR #65 — Red-team (ef71b43)

Blocking items fixed:

• ruff format applied — CI green
• GateResult construction fixed: gate_name="security" + policy_key="red_team" (was name=), details as dict (was str), findings as list[Finding] with Severity + rule_id (was list[str]). Gate was being silently dropped by the except Exception — now actually appears on the scorecard.
• mcp-url param added to red-team task; target resolved from agent-endpoint or mcp-url by engine. PipelineRun passes MCP_URL through.
• Fail closed across the board: config missing → exit 1, generate fails → exit 1, eval produces no results → exit 1. Was exit 0 / silent green on all three.
• RED_TEAM_MODE default changed from full (~90+ min) to smoke (~2 min) in both task and PipelineRun — aligns with CI defaults.

Should-fix items addressed:

• rstrip("/v1") → removesuffix("/v1") (character-level vs substring strip bug)
• Docs updated: "8 core tasks" (was 7), red-team bundle added to Tekton Bundles table
• promptfoo-cloud-credentials added to secrets template (optional)

Deferred:

• Promptfoo Cloud credential mounting: Not needed currently — red-team runs locally with PROMPTFOO_DISABLE_TELEMETRY=1 and CI=true. No Promptfoo Cloud integration is configured or required. Will add when/if cloud sharing becomes a requirement.
• Unit tests for generate_redteam_config.py and scorecard red-team path: These are shell-invoked scripts tightly coupled to Promptfoo CLI output and Tekton workspace layout. Meaningful tests require fixture data (Promptfoo JSON output, metadata.yaml variants). Planning to add in a dedicated testing PR with proper fixtures rather than blocking this feature PR.
• gate_policy enablement wiring for red_team key: Currently uses the default warn mode like peer security gates. Wiring policy_key="red_team" through gate_policy.gates requires a schema change to SubmissionMetadata to recognize red_team as a gate key. Deferring to avoid scope creep — the gate still runs, reports findings, and contributes to the scorecard; it just can't be individually set to block mode via metadata.yaml yet.
• Digest-pinned bundle references: Acknowledged as important for production. make digests target is available and documented. Will pin in a follow-up once we settle on the final Quay org (currently on personal account, pending ecosystem-appeng robot account access).

[GuyZivRH]

PR #65 Consolidated Review — Konflux red-team (Promptfoo + PyRIT Crescendo)

PR: #65
Author: ikrispin
Branch: ikrispin:konflux-redteam → main (cross-fork)
HEAD: ef71b43
Size: +4,834 / −1 · 24 files · 6 commits
CI: FAILURE (ruff on scripts/pyrit_crescendo/run_crescendo.py)
Merge state: BEHIND (~24 commits on main)
Prerequisite: #60 still open (branch embeds full Konflux stack)
Prior GitHub review: CHANGES_REQUESTED @ 7aa828a
Consolidated: 2026-08-06 · prefix bkxqm_
Sources folded in: wqfjn_, qzxwn_, nqjfu_, vhtrn_, mzpxw_

---

Final verdict

Request changes.

Direction is strong (opt-in Promptfoo breadth + PyRIT Crescendo depth, scorecard gate, smoke default). ef71b43 / f17b362 fixed several prior blockers. One review said Approve; consensus is not merge-ready while CI is red and remaining correctness/security gaps stand.

---

What shipped (scope > title)

Title says Promptfoo; actual delta:

1. Full Konflux ITS stack (same lineage as #60)
2. Opt-in Konflux red-team (Promptfoo smoke/full)
3. PyRIT Crescendo (scripts/pyrit_crescendo/*, Containerfile) in full mode
4. Main OpenShift phases/red-team.yaml + ci-pipeline.yaml wiring
5. RedTeamConfig on metadata.yaml
6. Scorecard gate merging Promptfoo + Crescendo

parse → prepare → test → red-team (opt-in) → evaluate → analyze-scorecard → store → emit-result

Commits

SHA	Summary
e8284c7 / fd2f807	#60 Konflux stack
7aa828a	Promptfoo red-team Konflux task + scorecard
822ebda	PyRIT Crescendo
f17b362	#60 hardening (remote submission, fail-closed, org git)
ef71b43	Red-team review fixes (GateResult, MCP, smoke, docs)

---

Prior blockers — status at ef71b43

#	Ask	Status
1	CI ruff on scorecard/generator	Partial — those fixed; CI still fails on PyRIT (I001, UP017)
2	Invalid GateResult / silent drop	Fixed — gate_name="security", policy_key="red_team", Finding list, dict details
3	Promptfoo Cloud creds	Still open — template optional secret exists; task mounts no Promptfoo secret; PR body still says Cloud required for generation
4	MCP target wiring	Fixed on Konflux; phases/ci path drifts (mode full, weak/missing MCP parity, hardcoded namespace noted)
5	Fail-open Promptfoo	Mostly fixed (config/generate/no results → exit 1); Crescendo CRESCENDO_EXIT ignored
6	Scope vs #60	Still open — ~4.8k line stack

---

Consensus strengths

1. Opt-in ENABLE_RED_TEAM=false; Konflux RED_TEAM_MODE=smoke.
2. Runtime config from metadata.yaml + typed RedTeamConfig.
3. Engine-aware providers; focused agent-behavior plugins; “fetch failed” filter.
4. Promptfoo breadth + Crescendo multi-turn depth (lean httpx/LiteLLM image).
5. Scorecard can attach a real red-team security gate after schema fix.
6. Guide updated to 8 tasks; removesuffix("/v1") fix.

---

Must fix before merge

1. CI green

ruff check --fix scripts/pyrit_crescendo/

Confirm full test workflow.

2. Promptfoo auth story consistent

Mount promptfoo-cloud-credentials into run-redteam or update PR body/guide if Cloud is optional/offline. Do not leave “required” docs with an unused template.

3. Stop embedding LLM API keys in generated YAML

generate_redteam_config.py writes apiKey: <llm_api_key> into promptfooconfig.yaml (log/artifact footgun). Prefer env-only (OPENAI_API_KEY) or Promptfoo env interpolation.

4. Fix --agent-endpoint alias

--target-url is still required=True, so alias-only invocation never reaches compat logic. Use mutually exclusive required group / post-parse validation.

5. Crescendo fail-closed in full mode

CRESCENDO_EXIT is logged but not used; non-zero / missing results must not leave the step green.

6. Resolve #60 / retitle

Merge #60 first and rebase a thin #65, or retitle as “Konflux + red-team (Promptfoo/PyRIT)” and review as one stack. Prefer not to land a second Konflux copy while #60 is open.

7. Minimal unit tests (security path)

At least: generator provider shapes; scorecard gate fixtures (redteam-results.json / crescendo); one mocked judge/objective path.

---

Should fix

#	Issue	Ask
8	phases/ vs Konflux drift	Align mode default to smoke; MCP endpoint parity; drop hardcoded ab-eval-flow namespace
9	Skip path → redteam-passed=true	Prefer skipped/empty (not false security pass)
10	gate_policy.is_enabled("red_team")	Peer gates check policy; red-team always appends if files exist
11	Personal Quay + mutable tags	Org registry + digests (same as #60)
12	Air-gapped / Cloud dependency	Document offline path or hard blocker
13	Brittle "fetch failed" filter	Prefer structured infra-error signal if available
14	PipelineRun header “7 stages”	Align to 8 if still stale
15	PR body understates PyRIT + main CI	Refresh summary

---

Suggested GitHub action

Request changes until CI green + auth/secret handling + alias + Crescendo fail-closed + #60 plan + minimal tests. Then re-review; product shape is close.

---

Merge bar (updated)

• CI green (incl. pyrit_crescendo)
• Valid GateResult / Finding construction
• Promptfoo creds mounted or docs stop saying required
• No plaintext LLM key in generated promptfooconfig.yaml
• MCP URL on Konflux red-team
• Phases/ci parity (smoke default, MCP, no hardcoded ns)
• Promptfoo fail-closed on generate / missing results
• Crescendo fail-closed when full mode runs it
• Working --agent-endpoint alias
• Unit tests (generator + scorecard gate minimum)
• #60 merge order / retitle
• (Follow-up) Org Quay + digest pins

[ikrispin]

addressed comments in 7c92f18 @GuyZivRH