Statistical recall, not regex luck.
A separate Go binary that points at your live gateway, fires N synthetic adversarial payloads, and reports how many your guardrails actually caught. The compliance question your Pest suite can't answer.
Unit tests check logic. pgfuzz checks recall.
PromptGate ships with 570+ Pest tests that verify guardrail logic: "given this exact input, does the PII regex match?" That's necessary but not sufficient.
The question a compliance team actually asks is different: "out of 1000 plausible-looking emails, embedded in code blocks, with light obfuscation, how many does my live PII Filter catch?" That's a statistical question — it needs a synthetic corpus, parallel HTTP fire against a running gateway, and aggregate counting.
pgfuzz is the answer. One Go binary, runs out of process, points at any reachable PromptGate, returns a recall table.
$ pgfuzz pii \ --target https://gateway.acme.com/api/$UUID/v1/chat/completions \ --token pg_live_… \ --count 1000 \ --variants inline,wrapped,obfuscated pgfuzz — recall report total: 1000 duration: 12.4s p50/p95: 58ms / 184ms KIND VARIANT TOTAL CAUGHT MISSED RECALL ---- ------- ----- ------ ------ ------ credit_card inline 67 67 0 100.0% credit_card wrapped 67 65 2 97.0% credit_card obfuscated 66 12 54 18.2% email inline 67 67 0 100.0% email wrapped 67 67 0 100.0% email obfuscated 66 31 35 47.0% iban inline 67 66 1 98.5% ... ---- ------- ----- ------ ------ ------ ALL (all) 1000 831 169 83.1%
Two subcommands today, six more planned.
MVP shipped 2026-05-22. The Phase 2 catalog is on the roadmap — none of it blocks the PromptGate 1.0 launch.
pgfuzz pii MVP
PII Filter recall — emails, IBANs, credit cards, phones, SSNs in inline / wrapped / obfuscated carrier text. Reports recall % per kind × variant.
pgfuzz secrets MVP
Secret Scanner recall — AWS, GitHub, Slack, OpenAI, Anthropic, Stripe, JWTs. Synthetic strings with valid prefix shapes, embedded in plausible code-snippet payloads.
pgfuzz injection Planned
Prompt injection patterns — DAN, override-previous-instructions, role-play breakouts, system-prompt-leak attempts.
pgfuzz budget Planned
Pre-flight 402 compliance — fires payloads of known cost, expects the gateway to refuse at the exact token / dollar boundary.
pgfuzz policy Planned
IP allowlist + time-window enforcement. Spoofs source headers, simulates clocks, verifies the guardrail rejects when expected.
pgfuzz load Planned
Burst-load profile — throughput, p50/p95/p99/p999 latency, failure-mode distribution. Hdr-histogram backed.
Recall test, not pentest.
This is not a pentest. pgfuzz measures recall against documented guardrail behaviour. Real adversarial red-teaming — finding novel exploit chains — is human work. pgfuzz won't replace a security engineer; it complements one.
Synthetic data is a lower bound. Recall on a generated corpus is the floor of your real-world recall, not the ceiling. Real-world adversarial input breaks filters in ways synth data cannot anticipate.
It consumes real budget. Every payload pgfuzz sends is a real chat-completion against your gateway. Run against a test project, or budget for the spend — at 1000 payloads × $0.001/call you're looking at $1 per run with cheap models.
# GitHub Actions — weekly recall sanity check name: pgfuzz nightly on: schedule: - cron: '0 2 * * *' jobs: recall: runs-on: ubuntu-latest steps: - uses: promptgate-ai/pgfuzz-action@v1 with: target: ${{ secrets.PG_URL }} token: ${{ secrets.PG_TOKEN }} count: 500 kinds: email,iban,credit_card,phone # Fail the job if any cell drops below 95% recall: min-recall: 0.95
Private until PromptGate 1.0.
The repo is currently held while we finalise the launch. Pilot customers can request binaries directly.
Repo
promptgate-ai/pgfuzz — private until 1.0 ships, then public with pre-built binaries for macOS / Linux / Windows.
License
Apache-2.0 — explicit patent grant, permissive for enterprise integration. (PromptGate itself is BSL 1.1; companion tooling gets its own license decision.)
Distribution
Single static Go binary. Homebrew tap + GitHub Actions cross-platform releases planned at 1.0. Single go install works today for source builds.
Verify what your gateway actually catches.
Read the full reference docs, or get in touch if you want a pilot binary before launch.