Practical overview
When it fits
Use Ragdrag when you have an authorized RAG endpoint to assess and want to structure checks by phase, with a JSON report for review.
Who it is for
- RAG application developers assessing their pipeline's security boundaries.
- Security practitioners conducting authorized tests of RAG endpoints.
Documented uses
- Assess retrieval and generation behavior with the default R1, R2 and R3 scan phases.
- Include R6 when the authorized assessment scope covers evasion.
- Plan ingestion-write assessments with explicit authorization and cleanup controls.
- Produce JSON reports containing findings, evidence states, capabilities and run status.
Requirements & limits
The project is an open-source repository under the MIT license. The CLI requires Python 3.10 or later.
- The executable engine registry exposes 20 technique IDs, while the 27-entry taxonomy also includes ideas without executable phase claims.
- The default scan selects R1, R2 and R3; R6 is opt-in.
- R4 and R5 can write data and require explicit authorization and cleanup controls.
- A heuristic finding is classified as inferred and does not by itself prove a vulnerability.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Install Ragdrag from its repository
Set up the CLI and check its reported version.
Before you start
- Python 3.10 or later
- A local environment for cloning and installing the repository
Steps
Clone the RAGdrag repository.
Change into the repository directory.
Install the project in editable mode with python -m pip install -e .
Run ragdrag --version.
Expected outcome
The repository's documented setup ends with a CLI version check.
Guide limitations
- This setup procedure does not assess a RAG endpoint.
Run a default scan against an authorized endpoint
Generate a JSON report from the default R1, R2 and R3 scan.
Before you start
- Ragdrag installed with Python 3.10 or later
- An endpoint you own or are explicitly authorized to assess
Steps
Choose the authorized target endpoint.
Run ragdrag scan --target --output report.json.
Expected outcome
The documented command writes a JSON report and uses the default R1, R2 and R3 phases at an active-non-mutating impact ceiling.
Guide limitations
- The scan sends requests and can expose sensitive responses.
- This default scan does not include opt-in R6 or ingestion-write phases R4 and R5.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 13 October 2026
- Original website title
- itsbroken-ai/RAGdrag · Official homepage title · retained in its source language