Run an assessment | Respan Docs

Respan Red Team tests how your AI agent behaves when it is targeted by prompt injection, data-extraction attempts, unsafe requests, and other adversarial techniques.

Each assessment profiles your agent, adapts its attacks to the behavior it observes, and produces a report with confirmed findings and evidence. You do not need to install or host the Red Team engine yourself.

Before you begin

You can assess either:

Your own endpoint: connect an agent that accepts OpenAI-compatible Chat Completions requests.
A sample sandbox: run a safe demonstration against a deliberately vulnerable target hosted by Respan.

Only test endpoints and connected systems that you own or are explicitly authorized to assess.

Open Red Team

In the Respan platform, open Red Team, then select Assessments.

The Assessments page lists your previous runs with their:

Target name
Status
Creation and completion times
Final grade

Select an assessment to open it in the side panel. You can expand the panel to full screen or move between adjacent assessments without returning to the list.

To start a new run, select New assessment.

Connect your agent

On the Create an assessment page, select Connect an endpoint and enter:

Field	What to enter
Target name	A recognizable name, such as `Customer support agent`. This appears in the assessment list and report.
Model	The model, deployment, or agent identifier expected by your endpoint.
Base URL	Your OpenAI-compatible base URL, such as `https://agent.example.com/v1`.
API key	An optional bearer token used to call the endpoint.

Respan appends /chat/completions when the Base URL does not already end with that path. You can therefore enter either:

https://agent.example.com/v1

or the complete endpoint:

https://agent.example.com/v1/chat/completions

Endpoint requirements

The browser sends an OpenAI-compatible request containing the configured model, the conversation’s messages, and stream: false.

Your endpoint must return assistant text in:

choices[0].message.content

The endpoint can use any HTTP(S) host, provider, or underlying agent implementation, but it must support this request and response format. If your agent uses a different API shape, place a small OpenAI-compatible adapter in front of it.

Browser access and CORS

Requests to a connected target run directly from your browser. Your endpoint must:

Be reachable from the browser and its current network.
Allow the Respan application’s origin through CORS.
Use HTTPS when the Respan application is loaded over HTTPS.
Return each response within approximately two minutes.

The optional target API key is kept in browser memory for the assessment session. It is not sent to or stored by the Respan backend.

Keep the Respan tab open while a connected-endpoint assessment is running. Closing or refreshing the tab interrupts the browser connection used to reach your target.

Use the sample sandbox

To explore the product without connecting your own system:

Select Use sample sandbox

On the Create an assessment page, select Use sample sandbox instead of connecting an endpoint.

Choose an available sample target

Pick one of the Respan-hosted sample targets.

Review its difficulty and expected grade

Each sample target lists its difficulty and the grade you can expect, so you know what the run will demonstrate.

The sample assessment runs only against a Respan-hosted target and performs no actions on your systems. It is useful for learning the interface and seeing an example report.

Launch the assessment

Before launching, select the authorization checkbox confirming that you are authorized to assess the selected endpoint and any systems it can access.

Select Launch assessment. Respan creates the assessment and opens its live workspace.