Red Team Overview

Red Team attacks a registered Agent to find weaknesses a fixed Harness would miss. It creates an Engagement that runs in waves: each wave generates attack seeds from a risk taxonomy, pursues them over multiple turns, judges the transcripts, and reflects on what worked before planning the next wave. For the mechanics, see Engagements. This page covers reaching Red Team from outside the Console.

Interfaces

Interface	How To Reach It
Console	The Adaptive tab in Create Evaluation. See Run a Red Team Campaign.
MCP	The `redteam_*` tools, 16 of them. See the MCP tool catalog.
REST API	The Engagements endpoints under `/v1/redteam/engagements`.

Create an Engagement

Only the Agent ID is required. The service resolves the target endpoint and Agent card from the Agent registry, so you never pass an endpoint directly.

MCP
REST API

Red team the customer support agent over 3 waves with 5 seeds each

curl -X POST "$VIJIL_API_URL/v1/redteam/engagements" \
  -H "Authorization: Bearer $VIJIL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "'"$AGENT_ID"'",
    "team_id": "'"$TEAM_ID"'",
    "policy_ids": ["<policy_id>"],
    "redteam": {"max_waves": 3, "max_seeds_per_wave": 5}
  }'

Follow a Run

An Engagement reports status, phase, current_wave, attackers_completed, and attackers_errored while it runs.

MCP
REST API

What wave is the red team engagement on, and has anything succeeded yet?

curl "$VIJIL_API_URL/v1/redteam/engagements/$ENGAGEMENT_ID?team_id=$TEAM_ID" \
  -H "Authorization: Bearer $VIJIL_TOKEN"

A completed Engagement can report degraded with a degradation_reason when the target failed mid-run, which means the report is partial rather than a clean pass.

Read the Results

Findings are addressable per wave and per seed, so you can pull one transcript rather than the whole run.

What You Want	Endpoint
Attack seeds	`GET /v1/redteam/engagements/{id}/seeds`
Attacker runs	`GET /v1/redteam/engagements/{id}/attacks`
One attacker run	`GET /v1/redteam/engagements/{id}/attacks/{wave_id}/{seed_id}`
Judgments	`GET /v1/redteam/engagements/{id}/judgments`
One judgment	`GET /v1/redteam/engagements/{id}/judgments/{wave_id}/{seed_id}`
Reflections	`GET /v1/redteam/engagements/{id}/reflections[/{wave_id}]`
Final report	`GET /v1/redteam/engagements/{id}/report`
Report as Markdown or PDF	`GET /v1/redteam/engagements/{id}/report.md` or `report.pdf`

Every endpoint takes team_id as a query parameter.

Personas and Policies

Personas and Policies are the context an Engagement attacks with and judges against. An Engagement given neither still runs, but its judgments fall back on general safety and security expectations rather than your rules.

Input	What It Contributes
Personas	Who is attacking. Personas shape attacker behavior.
Policies	The rules the Agent must follow, so a judge can identify a concrete policy violation.

Create both from presets:

vijil persona preset-list --preset-category adversarial
vijil persona from-preset <preset_id>

vijil policy preset-list
vijil policy from-preset <preset_id>

Alternatively, you can use MCP to list Persona presets, then create a Persona from a preset. List Policy presets, then create a Policy from a preset.

Next Steps

How Engagements Work

Waves, seeds, judgments, and reflections

MCP Tools

The Red Team tool catalog for Agents

Run From the Console

Launch Red Team from the UI

Get Started

Evaluate Agents

Red Team

Protect Agents

Reference

Red Team Overview

Interfaces

Create an Engagement

Follow a Run

Read the Results

Personas and Policies

Next Steps

How Engagements Work

MCP Tools

Run From the Console

​Interfaces

​Create an Engagement

​Follow a Run

​Read the Results

​Personas and Policies

​Next Steps

How Engagements Work

MCP Tools

Run From the Console

Interfaces

Create an Engagement

Follow a Run

Read the Results

Personas and Policies

Next Steps