# AI-Infra-Guard (A.I.G)

> A comprehensive open-source AI Red Teaming platform by Tencent Zhuque Lab for scanning AI agents, MCP servers, skills, infrastructure CVEs, and LLM jailbreak vulnerabilities.

A.I.G (AI-Infra-Guard) is a full-stack AI red teaming and security testing platform developed by Tencent Zhuque Lab, open-sourced under the Apache 2.0 license. It integrates agent scanning, MCP server security analysis, AI infrastructure CVE detection, skill security auditing, and LLM jailbreak evaluation into a single, self-hostable platform. The project was created in December 2024 and has been presented at Black Hat Europe 2025 Arsenal.

## What It Is

A.I.G is an AI security testing platform designed to help enterprises and individual developers identify security risks across the modern AI stack — from the underlying infrastructure (Ollama, ComfyUI, vLLM) to the agent layer (Dify, Coze workflows), MCP servers, and the LLMs themselves. It operates as a self-hosted web application accessible at `http://localhost:8088` after Docker deployment, and also exposes a full REST API with Swagger documentation. The platform is positioned as an AI red teaming tool for internal enterprise use.

## Core Scanning Capabilities

A.I.G bundles six distinct scanning and evaluation modules:

- **Agent Scan**: An independent multi-agent automated scanning framework that evaluates AI agent workflows against OWASP Top 10 for Agentic Apps risks, supporting platforms including Dify and Coze.
- **Skill Scan**: Uses AI agents to detect security threats in agent skills — covering tool poisoning, code vulnerabilities, and 9 risk categories aligned with the SkillTrustBench T01–T09 taxonomy.
- **MCP Scan**: Detects 14 major categories of security risks in MCP servers and agent skills, supporting both source code and remote URL scanning.
- **AI Infra Scan**: Fingerprints running AI service endpoints and matches them against a library of 2,000+ known CVE rules covering 130+ components including Ollama, ComfyUI, vLLM, n8n, and Triton Inference Server.
- **Jailbreak Evaluation**: Assesses LLM prompt security using curated datasets and multiple attack methods (Many-Shot, PAIR, GOAT, ActorAttack), with cross-model comparison output.
- **Model and API Relay Checker**: Provides model fingerprinting, Claude Signature verification, relay black-box auditing, and vendor quality testing.

## Deployment and Architecture

The platform is deployed via Docker Compose and requires Docker 20.10+, 4 GB RAM, and 10 GB disk space. Three installation paths are supported: pulling pre-built images from Docker Hub, a one-click install script, or building from source. Individual scanning modules (`aig-skill-scan`, `mcp-scan CLI`, `agent-scan CLI`) are also available as standalone Python packages installable via `pip`, enabling integration into CI/CD pipelines. The frontend is fully open-sourced as of v4.5.0. An extensible plugin framework allows community contributions of fingerprint rules, CVE rules, MCP security plugins, and jailbreak evaluation datasets via YAML files and pull requests.

## Update: v4.5.2

The latest release (v4.5.2, August 2026) expanded the vulnerability library to 2,000+ CVE rules and added `.pyc` bytecode bypass detection and charset smuggling defense to Skill-Scan. MCP-Scan gained RCE prevention via tool whitelisting in dynamic mode. The v4.5.0 release launched the AI Security Skill Market with 3 official skills and fully open-sourced the frontend. Earlier v4.5.1 added four multi-turn jailbreak attack methods and expanded Agent-Scan to 10 skills total. The project publishes a changelog and maintains active release cadence on GitHub.

## Research and Academic Footprint

The Tencent Zhuque Lab team behind A.I.G has published research at Black Hat, DEF CON, ICLR, CVPR, NeurIPS, and ACL. The README lists 19 academic papers that cite A.I.G, covering topics such as MCP server vulnerabilities, tool poisoning, agent red teaming, and LLM jailbreak. The project also maintains SkillTrustBench, a public benchmark for agent skill security evaluation, where the top-performing model (Claude Opus 4.6) achieves an F1 score of 0.9848 according to vendor-published results.

## Features
- Agent Scan for OWASP Top 10 Agentic Apps risks
- MCP Server security scanning (14 risk categories)
- AI Infrastructure CVE scanning (2000+ rules, 130+ components)
- Skill security auditing with SkillTrustBench T01-T09 taxonomy
- LLM Jailbreak Evaluation with multi-turn attack methods
- Model and API Relay Checker with fingerprinting
- OpenClaw/ClawScan security assessment integration
- Plugin management system for community contributions
- Docker-based self-hosted deployment
- Standalone CLI tools for CI/CD integration (pip installable)
- Full REST API with Swagger documentation
- Multi-language interface (Chinese and English)
- Real-time scanning progress tracking via web UI
- CIDR and IP range scanning support
- SkillTrustBench benchmark integration

## Integrations
Dify, Coze, Ollama, ComfyUI, vLLM, n8n, Triton Inference Server, OpenClaw / ClawHub, Docker, DeepSeek, Claude, Gemini, Kimi, GLM, llama.cpp

## Platforms
WEB, CLI, API, LINUX, MACOS, WINDOWS

## Pricing
Open Source

## Version
v4.5.2

## Links
- Website: https://tencent.github.io/AI-Infra-Guard/
- Documentation: https://tencent.github.io/AI-Infra-Guard/
- Repository: https://github.com/Tencent/AI-Infra-Guard
- EveryDev.ai: https://www.everydev.ai/tools/ai-infra-guard