AI-Infra-Guard is an open-source AI security tool from Tencent Zhuque Lab. The project combines AI infrastructure, agent, MCP, skill, OpenClaw, and jailbreak testing in one red-team platform.
The tool is also called A.I.G. It provides a browser interface, task APIs, and standalone command-line scanners under the Apache 2.0 license.
What is AI-Infra-Guard?
AI-Infra-Guard tests several layers of an AI system. Infrastructure scans fingerprint running services, while agent, MCP, and skill scans inspect the components that give models tools and execution paths.
Version 4.5.0 lists 130 AI components and 1,888 vulnerability rules. The same release added standalone skill, MCP, and agent scanners and opened the front-end source.
Key features
| Scan type | What it checks |
|---|---|
| AI infrastructure | Running AI services and known component vulnerabilities |
| Agent scan | Agent configurations, prompts, tools, permissions, and workflow risks |
| MCP and skill scan | Source archives or remote repositories for 14 risk categories |
| OpenClaw assessment | Configuration, skills, known vulnerabilities, and privacy leakage |
| Jailbreak evaluation | Model endpoints against selected datasets and attack methods |
| Task API | Programmatic creation of infrastructure, MCP, and jailbreak jobs |
| Standalone CLIs | Separate skill, MCP, and agent scan commands |
AI infrastructure scanning
Infrastructure scans target a running service URL or IP address. The scanner fingerprints the exposed component, matches its version against vulnerability rules, and produces remediation references.
The project documents targets such as vLLM, Ollama, ComfyUI, n8n, and NVIDIA Triton Inference Server. Version 4.5.0 reports coverage for 130 components.
The target is a live service, not a source repository. CIDR ranges and IP ranges can be submitted when several internal hosts need review.
Agent security scanning
Agent Scan evaluates an AI agent’s exposed configuration, prompt behavior, tool list, and permissions. The report maps findings to agent security risks and retains the evidence collected during the test.
The official interface shows agent tests against Dify. The repository also describes support for Coze and a plugin system for extending scan behavior.
MCP servers and agent skills
MCP and skill scans accept a remote repository URL or an uploaded source archive. No running server is required for this mode.
The project says this scanner covers 14 risk categories. Version 4.5.0 also ships dedicated mcp-scan, skill-scan, and agent-scan command-line tools.
The skill scanner maps findings to nine SkillTrustBench categories. These cover instruction hijacking, memory poisoning, malicious code, privilege abuse, persistence, tool hijacking, dependencies, and insecure coding.
Jailbreak evaluation
Jailbreak evaluation connects to a configured model API, applies a selected dataset and attack methods, then produces model-level scores and case details.
The interface separates the original input, transformed attack input, and model output. This makes individual cases reviewable instead of showing only an aggregate score.
Installation requirements
The documented Docker deployment requires Docker 20.10 or newer, at least 4 GB of RAM, and 10 GB of disk space. The browser interface is served on port 8088.
The official quick start uses the repository’s Docker Compose file with prebuilt images:
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
docker-compose -f docker-compose.images.yml up -d
Docker Compose V2 users can substitute docker compose. The project also provides a source-build path and an installation script, but the prebuilt image flow is the shortest documented route.
After startup, API documentation is available from /docs/index.html on the A.I.G server. The task APIs cover infrastructure, MCP, and jailbreak jobs.
The Docker deployment supports Linux, macOS, and Windows hosts. The web interface and project documentation are available in Chinese and English, with additional translated README files.
For infrastructure scans, submit only services you are authorized to test. Keep the scanner and its result data on an internal network because the default service has no login boundary.
Project status and license
Tencent Zhuque Lab maintains AI-Infra-Guard. The repository had 4,319 GitHub stars and release 4.5.0 was published on July 27, 2026.
The code is licensed under Apache 2.0. The project requires downstream products using its core components to retain notices and acknowledge AI-Infra-Guard in product documentation or an About screen.
When to use AI-Infra-Guard
AI-Infra-Guard fits labs and security teams that need several AI red-team workflows behind one self-hosted interface. It covers more system layers than a model-only jailbreak tool.