AI-Infra-Guard is an open-source AI security tool from Tencent Zhuque Lab. The project combines AI infrastructure, agent, MCP, skill, OpenClaw, and jailbreak testing in one red-team platform.
The tool is also called A.I.G. It provides a browser interface, task APIs, and standalone command-line scanners under the Apache 2.0 license.
What is AI-Infra-Guard?
AI-Infra-Guard tests several layers of an AI system. Infrastructure scans fingerprint running services, while agent, MCP, and skill scans inspect the components that give models tools and execution paths.
Release 4.5.0 documented 130 AI components and 1,888 vulnerability rules. It also added standalone skill, MCP, and agent scanners and opened the front-end source.
Release 4.5.1 , published July 30, 2026, added four multi-turn jailbreak attacks. It also expanded Agent Scan to 10 detection skills and added four MCP security rules.
Key features
| Scan type | What it checks |
|---|---|
| AI infrastructure | Running AI services and known component vulnerabilities |
| Agent scan | Agent configurations, prompts, tools, permissions, and workflow risks |
| MCP and skill scan | Source archives or remote repositories for 14 risk categories |
| OpenClaw assessment | Configuration, skills, known vulnerabilities, and privacy leakage |
| Jailbreak evaluation | Model endpoints against selected datasets and attack methods |
| Task API | Programmatic creation of infrastructure, MCP, and jailbreak jobs |
| Standalone CLIs | Separate skill, MCP, and agent scan commands |
AI infrastructure scanning
Infrastructure scans target a running service URL or IP address. The scanner fingerprints the exposed component, matches its version against vulnerability rules, and produces remediation references.
The project documents targets such as vLLM, Ollama, ComfyUI, n8n, and NVIDIA Triton Inference Server. Version 4.5.0 reports coverage for 130 components.
The target is a live service, not a source repository. CIDR ranges and IP ranges can be submitted when several internal hosts need review.
Agent security scanning
Agent Scan connects to a running agent through its API, sends test prompts, and analyzes the responses. Its three-stage pipeline collects information, runs vulnerability checks, and reviews findings with OWASP Agentic Security Initiative mappings.
The scanner documents 10 detection skills, with five enabled by default. Provider adapters include Dify, Coze, OpenAI-compatible applications, Anthropic, Google Gemini, custom HTTP endpoints, and WebSocket targets.
MCP servers and agent skills
The platform documentation describes MCP and skill scanning from source code and remote URLs. The standalone skill scanner and MCP scanner take local project directories.
The main project README describes 14 risk categories across MCP server and agent-skill scanning. Release 4.5.0 also introduced standalone command-line packaging for skill, MCP, and agent scans.
The skill scanner maps findings to nine SkillTrustBench categories. These cover instruction hijacking, memory poisoning, malicious code, privilege abuse, persistence, tool hijacking, dependencies, and insecure coding.
Jailbreak evaluation
Jailbreak evaluation connects to a configured model API, applies a selected dataset and attack methods, then produces model-level scores and case details.
The interface separates the original input, transformed attack input, and model output. Reviewers can inspect individual cases instead of relying only on an aggregate score.
Installation requirements
The documented Docker deployment requires Docker 20.10 or newer, at least 4 GB of RAM, and 10 GB of disk space. The browser interface is served on port 8088.
The official quick start uses the repository’s Docker Compose file with prebuilt images:
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
docker-compose -f docker-compose.images.yml up -d
Docker Compose V2 users can substitute docker compose. The project also provides a source-build path and an installation script, but the prebuilt image flow is the shortest documented route.
After startup, API documentation is available from /docs/index.html on the A.I.G server. The task APIs cover infrastructure, MCP, and jailbreak jobs.
The Docker deployment supports Linux, macOS, and Windows hosts. The web interface and project documentation are available in Chinese and English, with additional translated README files.
For infrastructure scans, submit only services you are authorized to test. Keep the scanner and its result data on an internal network because the default service has no login boundary.
Project status and license
Tencent Zhuque Lab maintains AI-Infra-Guard. The repository had 4,345 GitHub stars when checked on July 31, 2026, and release 4.5.1 was published on July 30.
The code is licensed under Apache 2.0 . The project asks downstream products using its core components to retain notices and acknowledge AI-Infra-Guard in product documentation or an About screen.
When to use AI-Infra-Guard
AI-Infra-Guard fits labs and security teams that need several AI red-team workflows behind one self-hosted interface. It covers more system layers than a model-only jailbreak tool.