I built a small red-team harness because chat-safe and tool-safe are different claims

I am building RedThread, an early open-source CLI for testing LLM agents with adversarial prompts and tool paths.

A chat response can look safe while the agent still moves a bad instruction into a tool call. That changed how I think about prompt injection. The visible answer is not enough once the model can touch code, files, or external systems.

RedThread runs repeatable attempts, keeps the trace, and lets me replay a failure after changing the prompt or tool boundary. It is not a magic shield and it is not a finished product.

Repo: https://github.com/matheusht/redthread

The interesting question for me is where the record needs to begin for a reviewer to understand why the action happened.