> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://www.respan.ai/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://www.respan.ai/docs/_mcp/server.

# Run a red team campaign

Red teaming sends adversarial messages to your agent, such as prompt injections, requests for its hidden instructions, and attempts to trigger actions it shouldn't take, then grades how it holds up. Try the hosted sample agent first, then connect your own agent with the CLI.

> **Warning**
>
> Only test agents you own or have permission to test. Prefer a non-production environment, and give the agent only the credentials and tools the test needs.

## Start a campaign

#### Open the launchpad

Go to **Red teaming** and click **Add agent**. If your project has no campaigns yet, **Red teaming** opens the launchpad directly.

#### Try the sample agent

Next to **Sample agent**, click **Run**. It attacks a deliberately weak agent that Respan hosts, so you get a full report without any setup.

#### Connect your agent with the CLI

Next to **CLI**, click **Set up**. The CLI runs on your machine and relays the attacks to your agent, so your agent can stay private.

![The Test your agent launchpad with a Sample agent row, the CLI row expanded to three steps (Install and sign in, Ask your coding agent, Run the scan), and 7 campaigns left](/docs/_fern-img/1c60e49c705f97eaae2851feaf0921eeb7b587195ef2616ca3f8d778d9c5b838.webp)![The Test your agent launchpad with a Sample agent row, the CLI row expanded to three steps (Install and sign in, Ask your coding agent, Run the scan), and 7 campaigns left](/docs/_fern-img/71520fd30f714dc3836b14342213767fc24c36b6578f1ae50d25c10f2ffc7929.webp)

Install the CLI and sign in:

```bash
pip install respan-redteam
respan-redteam auth login
```

On a machine without a browser, click **No browser? Use an API key** to create an API key for the CLI.

Then ask your coding agent to write the adapter that connects the CLI to your agent:

```
Fetch https://www.respan.ai/redteam-setup.txt
and follow it to create adapter.py for my agent, then tell me how to run the scan.
```

Run the scan:

```bash
respan-redteam scan adapter.py
```

Leave the launchpad open. When the scan starts, the campaign opens by itself.

#### Watch it live

The campaign moves through **Profile**, **Attack**, **Verify**, and **Report**. Attacks, findings, and the score fill in as they land, and the score stays **Preliminary** until the report is ready.

![A running campaign in the Attack stage with a Live indicator, a preliminary security score of 70, the attack surface by category, and a moment where the agent issued a refund without verification](/docs/_fern-img/470c8cd8dd67f5111d447b8ca8c63a2c4ecdc5d13ba90e69658c5565a6cfd0f7.webp)![A running campaign in the Attack stage with a Live indicator, a preliminary security score of 70, the attack surface by category, and a moment where the agent issued a refund without verification](/docs/_fern-img/3ae583938037f9120b336688243df863daba864f56ab7c2bc70c642b9d8add43.webp)

Keep the CLI running until you see **Report ready**. If it stops early, the campaign is **Paused**: run the scan command again to continue.

Then [review the report](/docs/documentation/red-team/results).

## Write a good adapter

The setup file tells your coding agent what to build. Check these points before you scan:

* The adapter's `label` is the agent's name in Respan. Runs with the same label are grouped under one agent, and retests match findings by it, so keep it stable.
* `open()` starts a fresh conversation for each attack, and `send()` takes one user message and returns the reply as a string.
* Test it with one message:

```bash
python -c "import adapter; c = adapter.TARGET.open(); print(c.send('hello'))"
```

## Campaign allowance

Every campaign you start counts against your project's allowance, including sample runs and CLI scans. Failed campaigns don't count. The launchpad shows **campaigns left**, and **Red teaming** shows **runs left**. Hover the count to see your plan's allowance and, on Team and above, when it resets. Team and above include 10 campaigns a month.

When none are left, click **Upgrade**, then **View plans**.

## Run in CI

Store a Respan API key as the `RESPAN_API_KEY` secret, then run the scan with a grade threshold:

```bash
pip install respan-redteam
respan-redteam scan adapter.py --output report.json --fail-under B
```

`--output` saves the report as JSON, and `--fail-under B` fails the job when the grade is below B.