Tencent/AI-Infra-Guard

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

🤖 AI‑Infra‑Guard (A.I.G) – Tencent’s Open‑Source AI Red‑Team Platform

What it is – A.I.G is a free, Apache‑2.0‑licensed suite for security testing of AI systems. It bundles several scanners (ClawScan, Agent Scan, MCP Scan, infrastructure CVE scan, jailbreak evaluation, and model‑API relay checking) behind a web UI and a REST API, letting you audit LLM services, AI‑agent workflows, and the underlying AI infrastructure.

🎯 Core capabilities

Component What it checks Typical targets
ClawScan / OpenClaw Insecure configs, skill‑level risks, privacy leaks OpenClaw chat bots, custom skills
Agent Scan Multi‑agent workflow safety (loss‑of‑control, tool misuse, privilege escalation) Agents built on Dify, Coze, etc.
MCP Scan 14 categories of security issues in Model‑Control‑Plane servers and agent skills MCP servers, skill repos (source or URL)
AI‑Infra Vulnerability Scan Fingerprints AI framework versions and matches > 2 000 CVE/GHSA rules Ollama, vLLM, ComfyUI, Triton, n8n, etc.
Jailbreak Evaluation Runs multi‑turn jailbreak attacks on a target LLM and reports success rates
Model & API Relay Checker Model fingerprinting, Claude‑style signature verification, black‑box relay audit

🚀 Quick start (Docker)

# clone & start (Docker Compose v2+)
git clone https://github.com/Tencent/AI-Infra-Guard.git && cd AI-Infra-Guard
docker-compose -f docker-compose.images.yml up -d   # pulls pre‑built images

The UI becomes available at http://localhost:8088.

For a one‑click install on a fresh machine:

curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/main/docker.sh | bash

(Installs Docker if needed, pulls the image, and launches the service.)

🛠️ Using the scanners

  • Infra scan – enter the address of a running AI service (e.g. http://127.0.0.1:8000 for vLLM) and click Start Scan. A.I.G fingerprints the service, looks up matching CVEs, and returns a report with severity and remediation links.
  • MCP / Skill scan – upload a zip of a skill repo or give a Git URL; the scanner analyses source code for the nine SkillTrustBench risk categories (instruction hijacking, memory poisoning, remote code execution, privilege escalation, tool hijacking, insecure dependencies, etc.).
  • Agent scan – point the tool at an agent endpoint (or a Dify/Coze project) and it runs a mutation‑engine that probes for loss‑of‑control behaviours such as tool misuse or unintended tool calls.
  • Jailbreak eval – configure the target model’s API key, pick a built‑in jailbreak dataset, and run a multi‑turn attack suite (Many‑Shot, PAIR, GOAT, ActorAttack). Results include success‑rate per model.
  • API checker – run the bundled CLI (./ai-infra-guard api-checker …) to audit model‑relay endpoints for fingerprint mismatches, back‑door risks, or PAMELA‑style tampering.

📦 Install the skill‑scan CLI directly

pip install aig-skill-scan
export LLM_API_KEY="your‑key"
aig-skill-scan -m deepseek-v4-flash -l en -o result.json /path/to/skill

The CLI follows the SkillTrustBench T01‑T09 taxonomy, making it easy to embed into CI/CD pipelines.

🌐 Ecosystem & integrations

  • ClawHub skills – aig-scanner, edgeone-clawscan, edgeone-skill-scanner let you call A.I.G from any OpenClaw chat bot.
  • Swagger / OpenAPI – the web UI ships with /docs and /api-checker/docs for programmatic use.
  • Plugin framework – add new fingerprint or vulnerability rules by dropping YAML files into data/fingerprints/, data/vuln/, or data/mcp/ and submitting a PR.

📚 Who should use it?

  • Enterprises that run private LLM services (self‑hosted vLLM, Ollama, Triton, etc.) and need an automated CVE audit.
  • AI‑agent developers (Dify, Coze, custom pipelines) who want to verify that their agents cannot be hijacked or cause unintended tool usage.
  • Red‑teamers / security researchers looking for a ready‑made platform to evaluate jailbreak robustness and model‑relay integrity.
  • CI/CD pipelines – the aig-skill-scan CLI can be added as a lint step for skill repositories.

📖 Documentation & community

  • Full docs: https://tencent.github.io/AI-Infra-Guard/
  • API reference: http://localhost:8088/docs/index.html
  • Issue tracker, feature requests, and contribution guide are all in the GitHub repo.
  • Community chat and plugin marketplace are hosted on the Matrix platform (skill‑market link in the README).

🏆 Recent highlights (as of Sep 2026)

  • v4.6.2 – added 155 new CVE rules for 40+ AI components, improved skill‑scan false‑positive handling, introduced loss‑of‑control benchmarks (FORGE‑Bench, RogueHandoff‑20).
  • v4.6.0 – first LLM‑API poisoning detection (black‑box model substitution/back‑door audit).
  • v4.5.2 – byte‑code (.pyc) bypass detection and charset‑smuggling defenses.

📜 License

Apache 2.0 – free for commercial and non‑commercial use.

Related

  • Project
    rogue-security/rogue

    An AI agent evaluator and red teaming platform that stress-tests agents against business policies and adversarial attacks to identify security vulnerabilities.

  • Project
    confident-ai/deepteam

    DeepTeam is an open-source LLM red teaming framework that simulates adversarial attacks like jailbreaking and prompt injection to uncover vulnerabilities such as bias, data leakage, and SQL injection in AI agents, RAG pipelines, and chatbots. It runs locally, offers 50+ pre-built vulnerabilities, 20+ attack methods, and production guardrails.

  • Project
    AgentSafeLabs/safelabs-eval

    safelabs‑eval is an open‑source Python framework that red‑teams AI agents. It sends 300 curated adversarial prompts (30 per OWASP‑inspired ASI01‑ASI10 categories) to a target agent—via HTTP or a Python callable—and scores the replies with pure‑Python pattern detectors. The tool is framework‑agnostic (supports LangChain, CrewAI, AutoGen, LlamaIndex, OpenAI Agents SDK, Google ADK, Semantic Kernel via optional adapters), produces human‑readable or JSON reports, and requires no extra LLM calls. It helps developers discover prompt‑injection, data leakage, tool‑use safety, hallucination, and other agent‑specific risks before deployment.

  • Project
    CyberStrikeus/CyberStrike

    CyberStrike is an open‑source AI agent that turns any LLM (Claude, GPT, Gemini, etc.) into an autonomous penetration‑testing platform. It adds a security‑focused “intelligence layer”, ships 13+ specialised agents and 7,600+ signed security‑skill files, supports 150+ AI providers (including offline models), and can orchestrate real tools locally or on remote Bolt servers. A TUI, optional web UI, and built‑in HackBrowser complete the workflow.

  • Project
    Unclecheng-li/DeepSec

    An AI security platform combining a three-layer code auditing system (Shield) and an automated, authorized penetration testing engine (Spear).