ZeroLeaksDocs
ZeroLeaks Package

Attack Agents

Strategist, Attacker, Evaluator, Mutator, Inspector, Orchestrator, and InjectionEvaluator. Each has an exported create function for custom integrations.

A zeroleaks scan coordinates several agents. Each one has an exported create function, so you can use it on its own in a custom pipeline. They are also exported from the zeroleaks/agents subpath.

Agents that call a model take an optional apiKey (defaults to OPENROUTER_API_KEY) and model. When used on their own, the Strategist, Attacker, Evaluator, and Mutator default to anthropic/claude-sonnet-5. Inside createScanEngine, they get the engine's attackerModel or evaluatorModel.

Strategist

Picks the next attack strategy from the conversation so far, tracks the target's defense profile, and moves the scan between phases: reconnaissance, profiling, soft probe, escalation, exploitation, and persistence. It can also ask for a conversation reset when an approach is stuck.

import { createStrategist } from "zeroleaks";

const strategist = createStrategist({ model: "anthropic/claude-opus-4.8" });

const output = await strategist.selectStrategy({
  turn: 5,
  history: conversationHistory, // ConversationTurn[]
  findings: [],
  leakStatus: "none",
  lastEvaluatorFeedback: "...",
});

// output.selectedStrategy, output.reasoning, output.recommendedCategories,
// output.phaseTransition, output.shouldReset

Other methods: getDefenseProfile(), getCurrentPhase(), recordFailedCategory(category), reset().

Attacker

Generates attack prompts TAP-style. It produces several candidates, scores and prunes them, and tracks the resulting attack tree.

import { createAttacker } from "zeroleaks";

const attacker = createAttacker({
  maxBranchingFactor: 3,
  maxTreeDepth: 4,
  pruningThreshold: 0.3,
});

const output = await attacker.generateAttack({
  history: conversationHistory,
  strategy: selectedStrategy,
  defenseProfile: strategist.getDefenseProfile(),
  phase: "escalation",
  evaluatorFeedback: "...",
  previousAttackNode: lastNode,
});

// output.attack.prompt, output.attack.technique, output.attack.category,
// output.alternatives, output.expectedDefense

After sending the attack, report the result with updateNodeWithResult(nodeId, response, leakDetected). Other methods: shouldReset(), getAttackTree(), getStats(), reset().

Evaluator

Decides how much of the system prompt a response leaked and suggests what to try next.

import { createEvaluator } from "zeroleaks";

const evaluator = createEvaluator();

const result = await evaluator.evaluate({
  attackNode: output.attack,
  targetResponse: "...",
  history: conversationHistory,
  defenseProfile: strategist.getDefenseProfile(),
});

// result.status (LeakStatus), result.confidence (0-1), result.extractedContent,
// result.extractedFragments, result.recommendation, result.shouldContinue

Other methods: getFindings(), aggregateFindings(), reset().

Mutator

Produces variations of an attack prompt: semantic rewrites from a model, plus programmatic ones such as base64 wrapping, homoglyphs, zero-width characters, and leetspeak.

import { createMutator } from "zeroleaks";

const mutator = createMutator();

const { variations, scores, best } = await mutator.bestOfN(attackPrompt, 3);

// Or pick mutation types yourself
const mutations = await mutator.generateMutations(attackPrompt, 5, ["paraphrase", "base64_wrap"]);
// mutations.mutations: { prompt, mutationType, expectedEffectiveness }[]

Inspector

Analyzes target responses to learn what the target will and will not do, and matches refusal patterns against a database of known guardrails to suggest bypasses. DEFENSE_DATABASE covers Azure Prompt Shield, Meta Prompt Guard, Llama Guard, Anthropic constitutional training, OpenAI Moderation, Google safety filters, NVIDIA NeMo Guardrails, and generic custom guardrails.

import { createInspector, DEFENSE_DATABASE } from "zeroleaks";

const inspector = createInspector("anthropic/claude-sonnet-5"); // (model?, apiKey?)

const output = await inspector.analyze({
  attackPrompt: "...",
  targetResponse: "...",
  history: conversationHistory,
  currentPhase: "escalation",
  leakStatus: "none",
});

// output.defenseFingerprint, output.identifiedWeaknesses,
// output.extractedKnowledge, output.strategicGuidance

Other methods: fingerprintDefense(response, signals), getRecommendedBypasses(), generateGuidedAttack(weakness), reset().

Orchestrator

Runs scripted multi-turn sequences that imitate human jailbreak patterns, with an optional adaptive temperature schedule (AutoAdv-style).

import {
  createOrchestrator,
  SIREN_SEQUENCE,
  ECHO_CHAMBER_SEQUENCE,
  TOMBRAIDER_SEQUENCE,
  DEFAULT_TEMPERATURE_CONFIG,
} from "zeroleaks";

const orchestrator = createOrchestrator(); // (temperatureConfig?)

orchestrator.initializeSequence(SIREN_SEQUENCE);
// or: orchestrator.initializeSequence(orchestrator.selectSequence(defenseLevel, history, leakStatus));

const step = orchestrator.getNextPrompt(conversationHistory);
if (step) {
  // step.prompt, step.step, step.temperature
  const response = await target.respond(step.prompt);
  orchestrator.recordStepResult(true, false, [], []);
}

orchestrator.isSequenceComplete();

Other methods: shouldReset(), getState(), getTemperatureState(), getAvailableSequences(), addSequence(sequence), reset().

InjectionEvaluator

The compliance judge for injection probes. A quick rule-based check runs first, then a model decides whether the target complied fully, partially, or refused.

import { createInjectionEvaluator, INJECTION_PROBES } from "zeroleaks";

const judge = createInjectionEvaluator({ model: "anthropic/claude-sonnet-5" });

const result = await judge.evaluate({
  probe: INJECTION_PROBES[0],
  targetResponse: "...",
  history: conversationHistory,
});

// result.success, result.compliance, result.severity, result.evidence
const summary = judge.aggregateResults(); // totals, success rate, score

Target

createTarget(systemPrompt, { model, apiKey }) returns the simulated target the engine attacks: a model called with your system prompt, with no tools. Its respond(message) method keeps conversation history, and resetConversation() clears it.

Summary

AgentCreate functionMain methodOutput
StrategistcreateStrategist(config?)selectStrategy()Strategy, phase transition, reset decision
AttackercreateAttacker(config?)generateAttack()Attack node with prompt, technique, category
EvaluatorcreateEvaluator(config?)evaluate()Leak status, confidence, recommendation
MutatorcreateMutator(config?)bestOfN()Prompt variations and scores
InspectorcreateInspector(model?, apiKey?)analyze()Defense fingerprint, weaknesses, guidance
OrchestratorcreateOrchestrator(config?)getNextPrompt()Next step prompt and temperature
InjectionEvaluatorcreateInjectionEvaluator(options?)evaluate()Compliance verdict for an injection probe

Scan Engine

createScanEngine for advanced use. Configure models, TAP parameters, Best-of-N, the inspector and orchestrator, injection probe selection, and callbacks.

Probe Library

Extraction probes across many categories, 78 behavioral injection probes, and an attack seed corpus. getAllProbes, getProbesByCategory, INJECTION_PROBES, and related helpers.

On this page

StrategistAttackerEvaluatorMutatorInspectorOrchestratorInjectionEvaluatorTargetSummary