Sunglasses vs Promptfoo
These solve different jobs, not the same job differently. Promptfoo is a developer eval and red-team framework you run before shipping. Sunglasses is a runtime pre-ingestion filter that blocks live attacks. Testing is not defending — and defending is not testing.
You test with Promptfoo to find weaknesses, then run Sunglasses at runtime so those weaknesses are actually blocked in production. Different phases of the same security lifecycle.
Side by side
One tests before you ship. One defends while you run. Pick by which phase you are solving for — or use both.
Use them together
Build an adversarial suite in Promptfoo, measure how your stack responds, then put Sunglasses at the runtime boundary so the attacks you found are blocked in production.
Both run locally in your own environment. Sunglasses runs with no API key, no cloud, no telemetry; Promptfoo runs in your dev loop and CI.
When to pick which
you need live protection — your agent is reading untrusted emails, web pages, tool output, or handoffs right now and needs a block/warn/allow decision at runtime.
you need repeatable evaluation — comparing prompts, models, or guardrail configs against test cases before you ship.
you want a full lifecycle: test adversarial cases before release, defend against them at runtime.