Imported test runs

If you already test an agent with promptfoo  or garak , you can upload the result file to Morse. Morse stores the counts and the failed items, tags them with OWASP ids, and lists the run next to your replay runs. It gives you one place to see the run and the date it was imported, and a latest-result line on the Data handling page.

Morse never runs the tests. It does not generate prompts, call your agent or probe it. It reads a file you produced with your own tool, on your own schedule.

Supported files

Morse recognises the format from the file’s content, not its name. A file of at most 20 MB is accepted. Anything else, such as a CSV or the generated-tests YAML that promptfoo redteam run -o writes, is refused with 400 “Unrecognised file: expected promptfoo results JSON or garak report.jsonl”. A file over 20 MB is refused with 413.

Upload

Only owners and admins can upload. Send the file as a multipart form to the Morse API while signed in as one of them:

curl -X POST "https://api.morsehq.dev/api/v1/dashboard/evals/imports" \
  -H "Authorization: Bearer $MORSE_ACCESS_TOKEN" \
  -F "file=@results.json" \
  -F "git_sha=$(git rev-parse HEAD)" \
  -F "agent_id=<agent id>"

git_sha, agent_id and deploy_event_id are optional. They tie the run to the revision or the agent you tested, so you can read it next to the deploy that went out.

What Morse keeps

• Totals. The tool and its version, how many tests ran, and how many passed and failed. A test that errored before it reached a verdict counts toward neither, so a run that could not execute does not look like a clean pass.
• Categories. Counts per category (a promptfoo plugin or a garak probe), each with OWASP ids.
• Failed items. Up to 200 failed tests, each with its category, test or probe id, and a prompt and output excerpt.

OWASP tags. Each category carries the ids that promptfoo and garak themselves assign to it: OWASP Top 10 for LLM Applications (LLM01 to LLM10) and OWASP Top 10 for Agentic Applications (ASI01 to ASI10). Morse maps them from the tools’ own published tables and adds none of its own. A category the tool maps to nothing carries no tag. The tag says which OWASP risk a test is about; it is not a statement that your agent meets or fails an OWASP standard.

Excerpts are redacted and encrypted. Before an excerpt is stored, it passes through your workspace’s redaction, then is cut to 500 characters and encrypted. A secret that sits across the cut is still matched whole, because redaction runs first.

Where it shows

• Replay runs. On Quality, the Replay runs table lists each import with an “Imported” badge and the tool name. Selecting one opens a panel with the totals, the categories with their OWASP ids and the failed items.
• Not compared. Imported runs are left out of the compare and baseline pickers and the latest comparison, because they are not replays of your traces.
• Data handling. The Imported test runs section shows the latest run for each tool.

Before you have data

With nothing imported, the section on Data handling reads Not measured. That means no file has been uploaded, not that the tests passed.

Related

• Data handling
• Regression testing — Morse’s own replay runs.