Enoki Labs

Enoki Labs is a hosted AI security platform that red teams AI agents.

You point it at an agent’s endpoint, it attacks the agent the way an adversary would, and it shows the exact attack behind every finding.

After you fix a finding, Enoki re-runs the same attack to check the fix. If a later run gets through again, the finding reopens.

Enoki Labs was founded in Ghent, Belgium, in 2026 and is operated by EthicGate BV. It has no install, no SDK and no code access, and the first assessment of one agent is free.

What is Enoki Labs?

Enoki Labs is a hosted service that red teams AI agents through their endpoints. Those agents call tools, read documents and act for users.

Enoki’s pitch is that a conventional pentest stops at the API and model evals stop at the prompt. It tests what an attacker can make the agent do in between.

The target is a running endpoint. Enoki connects over HTTP, SSE or WebSocket, and if you only have a chat page, a headless browser finds the agent call behind it.

Enoki first learns what the agent can do, then writes attacks for that agent instead of firing a fixed list.

Findings come back with the request, the agent’s response, a severity and a replay script.

The company launched publicly in May 2026. Its team page lists four people, including Sander Noels and founding engineer Simon De Ridder.

I based this review on Enoki’s documentation, pricing page, trust page, customer stories and benchmark post, checked on November 6, 2026.

What are Enoki’s key features?

Security, safety and policy lenses

Each assessment runs one lens. A security assessment asks whether an attacker can make the agent leak, bypass or misuse what it can reach.

A safety assessment checks whether the agent produces harmful content or advice. A policy assessment tests the agent against rules you write yourself.

Safety and policy runs start in the Enoki app. Security and safety assessments of an agent can also run on a schedule there.

The safety lens covers misinformation, violent or criminal facilitation, self-harm, fraud, hate, harassment and bias, among other classes.

What counts as a leak

Agents rarely return one flat answer. A response streams as frames: reasoning blocks, tool calls, status events and debug fields.

Enoki treats a leak in any of those frames as a finding, even when the visible answer opens with a refusal.

The finding page labels each surrounding frame with the agent’s own name for it.

Fix verification and regressions

Once you fix a finding, you close it as fixed and run the fix validation. Enoki replays every attack under that finding against the live target.

Each finding then shows a status such as Open, Verified or Regressed. A verified attack keeps running on later releases, and the finding reopens if it gets through again.

The re-run is a replay, not a new assessment. It is capped per finding per day and is free within 30 days of the agent’s last assessment, then costs one credit.

MCP server assessments

Enoki also assesses MCP servers as targets. The checks cover access control, injection and disclosure:

An MCP server’s run always covers all of its categories. Its findings cannot be re-tested yet, so you confirm a fix with a new assessment.

How do you run Enoki from a coding agent or CI?

Enoki exposes the same workflow through three surfaces: the web app, an MCP server and a REST API.

The MCP server lives at https://mcp.enokilabs.ai/mcp over streamable HTTP. Claude Code, Codex, VS Code, Claude Desktop, claude.ai and ChatGPT connect by signing in, and Cursor connects with an API key.

MCP clients and issue trackers

Claude Code

Codex

VS Code

Cursor

GitHub

Jira

Linear

The REST API at https://api.enokilabs.ai takes a workspace key as a Bearer token. Keys start with egk_, are shown once, and carry read, write and test:run scopes.

Enoki’s docs show a release gate that starts a run, polls it once a minute and fails the build unless the run passes:

API=https://api.enokilabs.ai/api/v1
AUTH="Authorization: Bearer $ENOKI_API_KEY"

RUN_ID=$(curl -sf -X POST "$API/run" -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"model_id\": \"$ENOKI_MODEL_ID\"}" | jq -r .run_id)

while :; do
  RUN=$(curl -sf "$API/run/$RUN_ID?min_severity=high" -H "$AUTH")
  [ "$(jq -r .status <<<"$RUN")" != running ] && break
  sleep 60
done

jq -e '.status == "completed" and .verdict == "pass" and (.ingest_incomplete | not)' \
  <<<"$RUN" > /dev/null || { jq . <<<"$RUN"; exit 1; }

A canceled run’s verdict covers only the categories it finished, which is why the gate requires completed.

Findings above a severity threshold can be filed as GitHub, Jira Cloud or Linear issues, and the issue and finding stay in step.

Webhook deliveries are signed with HMAC-SHA256, while Slack notifications are not signed.

What did Enoki’s own benchmark show?

In September 2026, Enoki published a comparison against four open-source tools: garak, promptfoo, DeepTeam and hivetrace-red. It is the vendor’s own research, not an independent benchmark.

Enoki built two deliberately weak agents and wrote down their weaknesses before any tool ran. Every attacker got the same request budget and three runs, scored by the same scorer.

Enoki states the limits itself. Two agents are not a census. Enoki also set up the other tools itself within a fixed time budget, so their authors might get better results.

The post also notes that no single run reached what three reached together. Enoki uses that result to argue for testing on every release.

Enoki vs garak

garak is NVIDIA’s open-source LLM vulnerability scanner under Apache 2.0, with about 9.9k GitHub stars. You install it with pip, choose probe modules and point it at a model endpoint.

Enoki is a hosted service aimed at agents with tools. It generates attacks for the specific agent and ties each finding to a replay you can run after a fix.

garak costs nothing and runs anywhere you can install Python. Enoki needs an account and sends attack traffic from its own platform.

Pick garak if you want a free, self-run scanner you can extend with your own probes. Pick Enoki if you test an agent with real tools and want findings that re-verify on every release.

Enoki vs Promptfoo

Promptfoo is an MIT-licensed CLI for LLM evaluation and red teaming, acquired by OpenAI in March 2026. It uses YAML test configuration and covers prompts, models, MCP integrations and guardrails across providers.

Promptfoo combines evals and red teaming in one tool you run in your own pipeline. Enoki covers security, safety and policy testing only, delivered as a hosted service with fix verification.

Pick Promptfoo if you already run prompt evals and want red teaming in the same open-source tool. Pick Enoki if you want attacks generated for one agent without writing test configuration.

For more options in this space, see the Promptfoo alternatives roundup.

Enoki vs Mindgard

Mindgard is a commercial AI red teaming platform that spun out of Lancaster University research. It covers AI models, agents and applications.

Enoki is younger and narrower. It focuses on deployed agents and MCP servers reached through an endpoint, with a free first assessment and a replay-based fix workflow.

Pick Mindgard if you need red teaming that reaches the models themselves, not only deployed agents.

Pick Enoki if your exposure is a tool-using agent and you want to start with a free test of one endpoint.

How much does Enoki cost?

Enoki does not publish prices. The pricing page lists one free tier and two paid plans that you request through a short form.

Trial workspaces have limits. They cannot list the category catalog or focus a run on chosen categories, and a plan can withhold a finding’s proof, showing only its ID and severity.

How do you get started with Enoki?

1. Get a workspace. Request the free assessment on enokilabs.ai. Approving an app connection takes a workspace owner or admin.
2. Connect your coding agent. For Claude Code, add the MCP server and authenticate it from /mcp.
3. Register the target. Your agent calls get_setup_guide, then create_target, which fires one live probe and saves the target only if it succeeds.
4. Describe the agent. Fill in the target profile: what each user type may see, which user the test account is, and which data is public.
5. Run and fix. Call trigger_assessment, read findings, then close a fixed finding and run validate_fix.

claude mcp add --scope user --transport http enoki https://mcp.enokilabs.ai/mcp

The target profile matters for accuracy. Only an answer you wrote or confirmed can rule a finding out, so data your test user is allowed to see is not reported as a leak.

When should you use Enoki?

Enoki fits teams that ship an AI agent with real tools to their own users. Its two public customers show the pattern.

According to Enoki’s customer stories, Tally runs Enoki against Tally AI, its form-building agent, whenever a tool, the system prompt or the model changes.

Wally, which builds an agent for accountants, triggers a run through the API on every production release.

It is a weak fit if you need runtime blocking. Enoki does not sit in front of the agent, so pair it with a guardrail such as NeMo Guardrails or Lakera .

What are alternatives to Enoki?

• garak : NVIDIA’s open-source LLM vulnerability scanner with a plugin-based probe library.
• Promptfoo : an MIT-licensed eval and red teaming CLI, now owned by OpenAI.
• Mindgard : a commercial AI red teaming platform for models, agents and applications.
• PyRIT : Microsoft’s open-source framework for multi-turn AI red teaming.

For the full catalog, see the AI security tools hub .

What are Enoki’s limitations?

• No published pricing. Standard and Enterprise are quoted through a form.
• The attacker is destructive by design. It can modify or delete data and reach beyond the address you register.
• MCP findings cannot be re-tested yet. Confirming an MCP server fix needs a new assessment.
• Runs are capped. A run stops after a few hours, and each workspace has a daily limit on starting runs.
• Trial workspaces are restricted. No category focus, no framework grouping, and findings can be redacted.
• The company is young. Enoki launched in 2026 with a small team, and its ISO 27001 status is listed as implementing.
• The headline benchmark is vendor research. Treat its numbers as Enoki’s own results.

Frequently Asked Questions