How to Scan Your LLM Agent for Vulnerabilities with Giskard: Step-by-Step Tutorial
A hands-on tutorial: run Giskard with Docker, upload your model, scan for prompt injection and hallucinations, and deploy auto-generated tests to CI/CD.
You built an LLM agent. Now prove it actually works. In this tutorial you'll use Giskard to scan your model for vulnerabilities and generate a custom test suite — in under 10 minutes.
🚀 Want to deploy Giskard yourself?
Docker configs, system requirements, and installation guides — all on one page.
View Giskard Tool Page →Step 1: Start the Giskard server
The easiest path is the official Docker image. With docker-compose up you get the full Giskard UI at localhost:19000 — no Python environment needed. The project's requirements page on Run This Ai lists 4GB RAM minimum and 8GB recommended.
Step 2: Upload your model
Connect any LLM — OpenAI, Anthropic, Hugging Face, or a local model. For RAG apps, provide your knowledge base so Giskard can evaluate retrieval and grounding, not just raw generation.
Step 3: Run the vulnerability scan
Click Scan. Giskard automatically probes for the most critical failure modes:
What the scan checks:
- 🔓 Prompt injection resistance
- 💬 Hallucination and factual accuracy
- 🔐 Data leakage and PII exposure
- ⚖️ Bias and fairness across inputs
Step 4: Generate & run your test suite
From the scan results, Giskard auto-generates a domain-specific test suite built from your own data. Run it locally or plug it into CI/CD as a quality gate — every deploy gets tested before it ships.
| Step | Action |
|---|---|
| 1 | Start Giskard with Docker |
| 2 | Upload your LLM or RAG app |
| 3 | Run the automatic scan |
| 4 | Deploy the generated test suite to CI |
Step 5: Fix, retest, ship
Address the failures Giskard found, re-run the suite, and watch your scores improve. Repeat on every release — that's how you keep agents reliable at scale.
🚀 Want to deploy Giskard yourself?
Docker configs, system requirements, and installation guides — all on one page.
View Giskard Tool Page →Giskard turns "I think our agent is fine" into "we have proof." Try the tutorial with your own model and see what the scan uncovers — most teams find at least one critical issue on the first run.