TEST · OPEN SOURCEApache-2.0 core · BUSL-1.1 enterprisePublic on GitHub · npm package pending

Omae wa mou pwned

DojoLM is the open-source dojo for LLM security. It runs the published multi-turn jailbreak canon against your models, agents and RAG pipelines, scores every finding on a standard instead of a vibe, and writes the evidence to a ledger nobody can edit afterwards. It is the platform our own engagements run on.

Clone and run it Source on GitHub

道

544

attack patterns

pattern groups

provider presets

DojoV2 controls covered

The problem

The attacks that get through are not in anyone's prompt list.

A single-turn scan tells you your model refuses the obvious ask. That is not the shape of the attack that lands. The one that lands takes four turns to build rapport, arrives base64-encoded, or never comes from the user at all: it comes from a document your RAG pipeline retrieved, or a tool result your agent trusted.

And when you do find something, you still have the harder half of the problem. Someone has to decide how bad it is, on a scale they can defend in a review, and produce evidence six months later that the finding existed and was fixed.

DojoLM does both halves. It runs the actual academic attack algorithms rather than a list of strings, and it turns what they find into scored, mapped, tamper-evident evidence.

DojoLM in two minutes: the dojo, the attack canon, and the evidence trail.

See it running

The platform, not a product shot.

DojoLM Hattori Guard showing the four platform guard modes and the defense-template catalogue — Captured 2026-08-05 from the current DojoLM control plane running its own fixture data, labelled in-frame. No customer systems, no customer results.

DojoLM Kotoba prompt hardening workbench with rubric breakdown and preset library — Captured 2026-08-05 from the current DojoLM control plane running its own fixture data, labelled in-frame. No customer systems, no customer results.

Real attacks, not a string list

The published canon, implemented and tested.

TimeChamber runs the multi-turn jailbreak canon

TAP (Tree-of-Attacks with Pruning), PAIR, Crescendo and MAD-MAX ship as orchestrators, each with its own tests, alongside a proprietary adaptive orchestrator. These are the actual state-of-the-art attack algorithms running as a product surface, not regexes named after them.

BoundaryMulti-turn orchestration costs real inference. A full ladder against a hosted frontier model is a budgeted run, not a click.

packages/bu-tpi/src/timechamber/orchestrators/

SAGE breeds attacks past your filter

A genetic core evolves payloads through population, fitness, crossover, mutation and selection, so it finds novel bypasses that no static list contains, including ones specific to your own filter.

BoundaryThe generator runs under resource limits and a content-safety gate. Offensive generation is governed here by design, not left open.

packages/bu-tpi/src/sage/genetic-core.ts

Kotoba breaks filters in encodings they never trained on

Eight dialect modules, homoglyph, emoji-smuggle, zalgo, leetspeak, rot-n, markdown-exfil, ascii-glyph and scaffold-injection, plus a prompt optimizer that hardens the other direction.

BoundaryObfuscation coverage is breadth across encodings, not a guarantee that every future encoding is anticipated.

packages/bu-tpi/src/kotoba/dialects/

One attack, tested against your whole model fleet

The transfer matrix answers whether a break on model A carries to B and C, giving a portfolio risk view no single-model scanner produces. 57 provider presets cover cloud and local endpoints, and you can bring your own.

BoundaryTransfer results describe the models and versions you tested. Providers ship silent updates, so transfer is a snapshot, not a standing property.

packages/bu-tpi/src/transfer/

Evidence, not a slide

Findings that survive an audit six months later.

AIVSS scores AI risk on a standard

An 11-metric closed-enum scoring spec with severity bands, vector strings, bulk rescore and approval elevation. Two engineers scoring the same finding land in the same place, and the score is defensible in a review.

BoundaryAIVSS is our specification, published as one. It is not yet an external standard body’s scheme, and we do not present it as one.

packages/bu-tpi/src/aivss/

Onigaeshi makes the record tamper-evident

A write-once audit ledger on S3 Object Lock in compliance mode, with periodic Merkle roots and keyless cosign signing. The evidence an auditor asks for, produced as a by-product of testing.

BoundaryWORM audit and the Bushido compliance book are the BUSL-1.1 enterprise tier. Detection and red-teaming are Apache-2.0.

packages/bu-tpi/src/onigaeshi/audit-worm-writer.ts

Bushido maps a finding to a framework in one pass

A chain builder, runner and DSL turn compliance mapping into code instead of a spreadsheet, across OWASP LLM Top 10, MITRE ATLAS, NIST AI RMF, ISO 42001 and the EU AI Act GPAI obligations.

BoundaryCoverage mapping shows where your testing reaches a framework. It is not certification and does not substitute for an assessor.

packages/bu-tpi/src/bushido/

The build fails if a marketing number drifts

A doc-metrics tool strict-equals the numbers in our documentation against the scanner source. If someone rounds 544 up in a README, CI goes red before it reaches a customer.

BoundaryThat gate covers the numbers it is wired to. It is a discipline for pattern and group counts, not a proof that every sentence we write is verified.

tools/verify-doc-metrics.js

Community scan report, specimen Lab-grade test report, specimen

Two issues of the same report system: the technical scan report the Community edition emits, and the accredited-lab-grade deliverable of the enterprise tier. Both are watermarked specimens on simulated data, no customer systems, no customer results.

Free vs paid

Offense-free, governance-paid.

Everything you need to detect and red-team is in the public repository under Apache-2.0. The enterprise governance modules are licensed separately.

CommunityApache-2.0

Scanner engine + 544 detection patterns
Attack modules and adversarial red-teaming
Telemetry client and dashboard
MCP adversarial server and verifier SDK

EnterpriseBUSL-1.1

Onigaeshi WORM audit ledger
Bushido compliance book (framework mapping)
Katana ISO-17025 validation
Advanced admin and RBAC

No price is published. Enterprise modules are quoted against your deployment, and the scoping call is where a number becomes honest.

How to start

Clone it, build it, scan something.

npm package not published yet · clone from source

Clone and build

git clone https://github.com/BlackUnicornSecurity/DojoLM.git
cd DojoLM
npm install
npm run build

Set the session signing key

export TPI_COOKIE_SIGNING_KEY_CURRENT=$(node -e "console.log(require('crypto').randomBytes(32).toString('hex'))")

Required once per deployment. Keep it stable across restarts.

Run the scanner API and the control plane

npm start --workspace=packages/bu-tpi   # scanner API on :8089
npm run start:web                       # control plane on :42001

Scan something
```
curl "http://localhost:8089/api/scan?text=ignore%20all%20previous%20instructions"
```
Returns verdict BLOCK with the matched patterns, severity counts, and elapsed time.

Requires Node.js 20 or newer and npm 10 or newer. The scanner makes no outbound calls of its own, so it runs fully offline against a local model.

What ships in the platform

Five jobs. The codenames are just names.

TEST
Scanner, deep scan, payload and fixture browser, model lab
Haiku · Shingan · Buki · Jutsu
ATTACK
Multi-turn orchestrators, genetic attack evolution, obfuscation dialects, campaigns
TimeChamber · SAGE · Kotoba · Sengoku
DEFEND AT RUNTIME
Input and output guarding, prompt hardening
Hattori Guard · Kotoba
PROVE
Standardised scoring, compliance mapping, write-once evidence
AIVSS · Bushido · Onigaeshi
OPERATE
Threat feed, fingerprinting, attack lineage, admin
Mitsuke · Kagami · AttackDNA · Admin

Buyer questions

Asked before you ask.

Can I install it from npm?

Not yet. The scanner package is not published, so the honest install path today is the git clone above. Everything in the Community edition works from source.

Is this production-ready or a demo?

It is the platform our own engagements run on. The Community edition is public under Apache-2.0 and you can read every pattern it ships. The enterprise governance modules are commercially licensed.

What does it cost?

The Community edition costs nothing and always will, under Apache-2.0. Enterprise modules have no published price; we quote against your deployment on a scoping call.

Does it need to phone home?

No. The scanner makes no outbound calls of its own, so it runs fully offline against a local model. That is deliberate: a security tool you cannot run inside an air-gapped environment is not much use to the people who need it most.

Will it work against our provider?

57 provider presets cover cloud and local endpoints, including Claude, OpenAI, Groq, Ollama, vLLM, LM Studio and llama.cpp. If yours is not in the list, point it at your own endpoint.

Next step

Three ways in, in order of friction.

Clone the repositoryApache-2.0. Running locally in four commands, no account needed.

Visit dojolm.comThe product site, and where the packaged release lands first.

Have us run it against your stackThe engagement where we drive the platform for you.

We reply inside 48 hours, scoped within a week, NDA-first.