iFixAi
Independent auditing for deployed AI agents: red teaming plus operational assurance with evidence attached.
About
iFixAi answers whether a deployed AI agent is actually doing what it is supposed to do. You connect the agent you deployed, it simulates inspections against it, and you get back an audit of what it got wrong with the evidence attached. The audit covers two pillars: red teaming (can the agent be manipulated, exploited, or pushed outside its boundaries) and operational assurance (does it still do its actual job and respect authority and approval chains).
Findings are reported across five operational-misalignment modes: fabrication, manipulation, deception, unpredictability, and opacity. The core engine is open source on GitHub with 60 inspections you can run on your own infrastructure with your own model keys, guided by a wizard (ifixai setup) or explicit CLI flags for CI. The hosted iFixAi Pro service offers up to 400 inspections plus an audit dashboard.
The honest picture: the plugin tier runs against iFixAi's hosted service, so the agent under test must expose a public HTTPS endpoint speaking OpenAI-shaped chat completions. Self-run engine use keeps everything local but requires your own model keys. There is a free tier with a fast audit; paid workspaces add inspections and history.
What it can do
- Adversarial inspection probes against deployed agents
- Operational assurance and governance checks
- Scorecards with evidence-backed findings
- CI-friendly CLI with JSON and Markdown reports
Setup
pip install ifixai, then ifixai setup for the guided wizard; or install the Claude Code/Codex plugin.
Prerequisites
An agent reachable at a public HTTPS endpoint speaking OpenAI-shaped chat completions, plus model API keys for self-run audits.
Use cases
Works with
Trust score — 7/10
Scored 7/10 (metrics tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 114; Trending score 72/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.