Promptfoo alternatives, 2026.Q3: every real option, ranked

The short answer

Edition v2026.Q3 · pricing and status verified 2026-08-06.

sandbox-runtime is the strongest Promptfoo alternative for most — putting a hard filesystem and network boundary around any agent process — coding agents especially — without containers or a cloud bill. Then: NVIDIA NeMo Guardrails · Amazon Bedrock Guardrails · Lakera Guard. Below, all 26 real options in the guardrails category, with pricing and honest watch-outs — plus the 8 "alternatives" other lists still recommend that are dead, renamed, or sunsetting.

Why people look past Promptfoo at all: It tests; it does not enforce. A green promptfoo run is not a runtime control, and nothing here blocks a live request. The OpenAI acquisition also puts the category's most-used neutral scanner inside a frontier lab — the OSS pledge is a pledge, not a governance structure.

The top Promptfoo alternatives, ranked

1. 2sandbox-runtimeAnthropic (Apache-2.0, beta research preview)

   Free · Apache-2.0 · no service, no account

   Best for Putting a hard filesystem and network boundary around any agent process — coding agents especially — without containers or a cloud bill.

   Watch Explicitly a "beta research preview": Windows support is alpha, and the API is not stable. It does nothing about content — no injection detection, no PII, no topic control. And a sandbox with an over-broad network allowlist is theatre; the config is the product.

   4.6k stars, Apache-2.0, v0.0.64 released Jul 7, 2026 [src] · 84% reduction in permission prompts after OS-level sandboxing replaced approval-gating in Claude Code [src]

2. 3NVIDIA NeMo GuardrailsNVIDIA (Apache-2.0)

   Free · Apache-2.0 · self-hosted; NemoGuard NIM microservices require NVIDIA AI Enterprise licensing (not publicly priced)

   Best for Teams that want programmable, self-hosted rails — including rails on tool calls — rather than a hosted moderation endpoint.

   Watch Colang is a language you have to learn, and the config surface sprawls fast. Every rail is another LLM call, so latency and token cost stack; teams routinely ship with rails disabled in the hot path. The best detectors are NVIDIA NIMs behind enterprise licensing, so the free tier is the scaffolding, not the models.

   6.9k stars, 802 forks, 3,765 commits, Apache-2.0, v0.23.0 (Aug 2026) [src] · Five rail types including execution rails that validate tool calls and external interactions [src]

3. 4Amazon Bedrock GuardrailsAWS

   Usage-based, no subscription: content filters & denied topics $0.15/1k text units · sensitive-info filters $0.10 · contextual grounding $0.10 · Automated Reasoning $0.17 per policy · word filters and regex free · standalone InvokeGuardrailChecks prompt-attack $0.08/1k (1 text unit = 1,000 characters)

   Best for Shipping a managed filter today without building one — including in front of models you don't host on AWS.

   Watch The headline numbers — "blocks up to 88% of harmful content", "99% accuracy" on Automated Reasoning — are AWS's own, with no independent benchmark to check them against. Per-1k-character billing gets expensive on long agent contexts, every enabled policy is a separate charge and a separate round trip, and you're inside an AWS account. It filters text, not actions: it will not stop an agent from calling the wrong tool.

   ApplyGuardrail works with any foundation model including self-hosted and third-party (OpenAI, Google Gemini) — vendor page, Aug 2026 [src] · Exact list pricing: $0.15/1k text units content filters; $0.17/1k per Automated Reasoning policy; word filters free (AWS pricing page, Aug 2026) [src]

4. 5Lakera GuardLakera → Check Point Software (announced Sep 16, 2025)

   Not published — enterprise via Check Point sales; SaaS and self-hosted deployment options

   Best for Startups selling into enterprises that want a named vendor, an SLA and a real adversarial dataset behind the injection filter.

   Watch No public pricing at all — the least startup-friendly entry on this list, and you're now buying from a large network-security vendor whose roadmap answers to CloudGuard, not to you. All performance figures are first-party. Detection percentages on prompt injection are also structurally soft: there is no accepted public benchmark, so >98% is a claim about Lakera's own test set.

   Gandalf network: 80M+ adversarial patterns; >98% detection, sub-50ms latency, <0.5% false positives (Check Point release, Sep 16, 2025) [src] · Vendor site (Aug 2026): 1M+ hackers, 100+ languages, sub-50ms latency, 0.01% production false-positive rate [src]

Every other live option in guardrails

The "Promptfoo alternatives" to avoid — no longer what they were

Listicles still recommend these. As of 2026-08-06, they are not what the listicles think.

How to choose

If your agent can run a shell, write files or reach the network

Sandbox first, filter second. Adversa's GuardFall work (Jun 2026) bypassed pattern-based command guards in 10 of 11 open-source coding agents; sandbox-runtime or an E2B-class VM sandbox is the boundary that doesn't depend on reading intent correctly.

If you have no guardrails and one afternoon

Run Promptfoo's red-team against your own agent and fix what it finds. It's free, self-hosted, and the exercise tells you which of the other four picks you actually need — instead of buying a filter for a hole you don't have.

If you want a managed filter and you're not on AWS

Bedrock's ApplyGuardrail API or Google Model Armor both work in front of third-party models. Model Armor is the cheaper start — 2M tokens/month free, then $0.10 per million — and covers indirect prompt injection and malicious URLs; Bedrock wins if you need denied topics or formally verified policy.

If your agent consumes MCP servers or third-party tools

Treat the tool registry as untrusted input: pin and scan servers (Snyk agent-scan, ex-Invariant MCP-Scan), gate them behind an MCP gateway, and put an allowlist on egress. GitGuardian found 24,008 secrets in public MCP configs in 2026, 2,117 of them still valid.

If a customer's security review is what's blocking the deal

Buy a named vendor — Lakera Guard/Check Point, Prisma AIRS or Cisco AI Defense — and map your controls to the OWASP Top 10 for Agentic Applications (Dec 9, 2025). The document is what enterprise reviewers are grading against; the filter is what they'll ask to see evidence for.

This analysis is drawn from the Guardrails element dossier — the ranked top 5, the comparison matrix, and the complete field of 30 more tools live there, with every source. Data: gd.json (CC BY 4.0).