PyRIT went read-only in March. The four tools left do not overlap the way the guides assume.

An archived repository keeps working. Nothing uninstalls itself the day the maintainer stops answering issues, which is why this sort of change spreads slowly and badly: the package still runs and the docs still read as current, while the issue tracker has quietly stopped receiving anything ^[2]. The dev.to comparison carrying the notice is one of the pages that got corrected, and even there the update is dated roughly four months after the archive ^[16]. PyRIT's audience was security researchers running structured red-team engagements rather than app developers doing a pre-ship check, and the guide puts its general-developer adoption noticeably below the other four ^[14]. There was no large user base to notice out loud.

Treating the survivors as substitutes is the second error. garak is pip-installable, ships 50+ probes, carries 8.1k GitHub stars and is described as actively maintained by NVIDIA ^[9], and none of that helps if what you ship is an application, because a model-layer scan never touches your system prompt, your tool permissions or your retrieval path ^[11]. promptfoo runs the other way: 50+ red-team plugins, zero install via npx, and report presets already mapped to OWASP LLM Top 10, NIST and MITRE ATLAS ^[6]. The same guide is honest that the plugin surface is large enough that a useful first run takes well past five minutes ^[8]. Giskard has OWASP-mapped detectors as well, but the continuous-scan Hub, the part that would let you run it repeatedly against a live app, is a paid product, leaving the free tier as a point-in-time check ^[12]. sentinel-scan-cli is placed on the app-layer side alongside those two ^[5].

Two notes on the evidence, since all of this comes from one author. The claim that promptfoo is used internally at OpenAI and Anthropic is attributed to promptfoo's own repository ^[7], which is a vendor self-report and should be read as one. And the comparison closes by routing readers to its own separate post on what to use instead ^[18]. Neither weakens the layer taxonomy, which is the most useful thing in the piece: decide whether you are testing the wrapped application or the raw model, and most of the tool choice is already made ^[4]. The place to distrust a fast answer is the multi-turn gap. PyRIT was a framework for scripting escalating conversational attacks rather than a turnkey scanner ^[13], and the guide's own suggestion is that promptfoo's red-team plugins cover a lot of the same ground ^[15]. A lot is not all, and the difference is the part nobody has rebuilt.