Stoa Red
A red-teaming simulator for agentic AI. It takes a static risk report, builds a runnable deployment twin with every tool mocked, derives an attack plan from the agent registry, runs pluggable engines against the twin, and exports what was observed — never a new risk score.
- Local-first
- Pluggable engines
- OWASP-mapped
- Zero side effects
$ stoa-red run --report ./sample-risk-report.json ingest stoa-risk-report/1.2 · rpt_9f2a1c7e · XYZ Financial Technologies twin scaffolded langgraph twin · 2 agents · 6 tools · all mocked derive 14 objectives from 2 agents (5 static findings cited) route deepteam ← 13 · builtin ← 1 · coverage 100% · 0 gaps run 13 exploited · 1 blocked · 0 inconclusive guardrail 13 controls emitted · re-run: 13/13 held evidence .stoa-red/runs/run_9f2a1c7e_det/evidence.json
Where it sits
This demo run
issue_refund fired, $4,800, intercepted
An attacker-influenced path reaches a tool that carries real-world authority, and nothing outside the model gates it. Observed on XYZ Financial Technologies’s RefundAgent. The twin recorded the call and its arguments; nothing moved, because issue_refund is a mock. Read the transcript →
How it works
A runnable LangGraph reconstruction of the deployment, scaffolded from the agent registry. Every tool is mocked and shadowed, so a privileged call is a recording, never a side effect.
14 objectives derived from capability combinations crossed with taint reachability. Every one carries its rationale and the report findings it came from.
DeepTeam and promptfoo live; Garak and PyRIT registered as interface-only stubs. Linking or delinking one is a config edit, and the coverage map shows the difference.
One normalized Finding per objective, merging every engine that tested it, with outcome, severity, crosswalk tags and the observed impact.
A concrete control per confirmed exploit — a LangGraph patch or a policy config — then the same attack re-run against the hardened twin to prove it holds.
The firewalled packet: summary, coverage, controls, verification, and underwriting questionnaire answers with their basis.
The rules it will not break
Every attack runs against the synthesized twin. Tool invocations are intercepted and recorded with their arguments. Live-target mode is designed but disabled: it requires an explicit authorization record, and enabled is typed as literal(false) in this release.
The evidence exporter has no parameter capable of carrying a risk score, and a runtime firewall walks the finished packet for canonical-risk keys before it is written. Observed exploitability is exported alongside the static risk model, never into it.
Install
$ git clone <repo> stoa-red && cd stoa-red $ pnpm install && pnpm build $ stoa-red run --report ./stoa-report.json --deterministic
Heavy engines execute in the CLI or the Python worker sidecar. This site is a renderer — it has no route that runs an attack. Read the docs →