Promptfoo Setup Guide: How I Started Testing My AI App Like Real Software
I used to test my AI apps by... vibing. Running prompts manually, eyeballing outputs, hoping nothing broke. Then I found Promptfoo. Now my AI app has CI checks, automated regression tests, and security red-team scans. Here's how to set it all up.
The Dirty Secret of Most AI Apps
Ask most developers how they test their AI applications and they'll say something like "I run a few test prompts manually before deploying" or "my users tell me when something breaks."
This is the equivalent of testing a web API by clicking around in the browser and hoping for the best. We laughed at this approach 15 years ago and built unit tests, integration tests, and CI pipelines. Then AI apps came along and we collectively regressed to manual testing — but with more confidence, because "the AI seems smart."
Promptfoo is the tool that finally brings software engineering discipline to AI application development. It's not glamorous. It's not a new model or a flashy agent framework. It's a testing framework — and right now, it might be the most underrated tool in the AI developer stack.
What Promptfoo Actually Does
Promptfoo is an open-source CLI tool and library that lets you:
- Run automated test suites against your prompts with expected outputs and assertion criteria
- Compare models side-by-side on identical test cases (great for evaluating a GPT-4o-to-Claude migration)
- Run security red-team scans to check for prompt injection vulnerabilities, jailbreaks, and data leakage risks
- Integrate into CI/CD so your GitHub Actions pipeline runs AI tests on every pull request
The moment you see what this looks like in practice — a green test suite showing your AI app behaves correctly across 200 different input variations — you can't go back to manual testing.
Step 1: Installation
Promptfoo requires Node.js 18+. Install it globally:
npm install -g promptfooInitialize a new config in your project:
promptfoo initThis creates a promptfooconfig.yaml in your current directory. This is your test suite definition file.
Step 2: Writing Your First Test Suite
Let's say you have a customer support AI that should never recommend contacting a competitor. Here's what a basic test config looks like:
providers:
- openai:gpt-4o-mini
prompts:
- "You are a helpful customer support agent for Acme Corp. Answer the following: {{question}}"
tests:
- vars:
question: "How do I reset my password?"
assert:
- type: contains
value: "reset"
- type: not-contains
value: "competitor"
- vars:
question: "What's a good alternative to your product?"
assert:
- type: not-contains
value: "CompetitorName"
- type: llm-rubric
value: "Response should redirect to Acme Corp features, not mention competitors"Run the tests with:
promptfoo evalStep 3: CI Integration and Model Comparison
Add this to your .github/workflows/ai-tests.yml:
name: AI Tests
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- run: npm install -g promptfoo
- run: promptfoo eval --ci
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}For model comparisons, just add multiple providers to your config. Promptfoo will run the same test suite against all of them and generate a side-by-side report showing which model performs better on your specific use case.
This is one of the most powerful things you can do before a model migration. Instead of guessing whether Claude is better than GPT-4o for your app, you measure it.
FAQ
Is Promptfoo free?
The core CLI tool is completely free and open-source. You pay for whatever AI API calls your tests make — which is usually minimal since test suites are designed to be efficient. There's also a paid cloud dashboard for teams.
Can Promptfoo test local models?
Yes. Promptfoo supports Ollama, LM Studio, and any OpenAI-compatible local endpoint. This means you can run your full test suite against a local model before committing to an API-based deployment.
What's the llm-rubric assertion type?
It's an assertion where another LLM call judges whether the output meets a natural-language criterion. For example, 'the response is professional and not condescending'. It's slower than string-matching assertions but handles subjective quality requirements that regex can't capture.
Explore RuView on GitHub
Browse the Rust engine, ESP32 firmware and examples.