Tencent/AI-Infra-GuardPublic

📖 Documentation  |  🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский

A.I.G (AI-Infra-Guard) integrates capabilities such as ClawScan(OpenClaw Security Scan), Agent Scan，AI infra vulnerability scan, MCP Server & Agent Skills scan, and Jailbreak Evaluation, aiming to provide users with the most comprehensive, intelligent, and user-friendly solution for AI security risk self-examination.

We are committed to making A.I.G(AI-Infra-Guard) the industry-leading AI red teaming platform. More stars help this project reach a wider audience, attracting more developers to contribute, which accelerates iteration and improvement. Your star is crucial to us!

Help us improve A.I.G! Please take 3-5 minutes to fill out our User Feedback Survey. Users who provide high-quality feedback and leave a valid email address will receive an exclusive Tencent souvenir gift.

• 2026-09-17 · v4.6.2 — Vuln library expanded with 155 new CVE rules across 40+ AI components (LangFlow, n8n, PraisonAI, vLLM, llama-cpp, MLflow & more); Skill-Scan accuracy improvements (fewer evidence-free false positives, stall-free streaming); new agent loss-of-control benchmarks (FORGE-Bench, RogueHandoff-20).
• 2026-09-10 · v4.6.1 — API Checker: expanded model fingerprint coverage (Gemini 2.5/3.1, Gemma 2/3/4, GLM-5.3 & GLM-5.3-Flash); MCP-Scan reliability: flags empty/incomplete scans, preserves security findings during context compaction, surfaces underlying connection errors; corrected mislabeled CVE product names.
• 2026-08-26 · v4.6.0 — LLM API poisoning detection (multi-probe black-box audit for model substitution & backdoor risks); Agent-Scan v5.0.0 mutation engine refactor; vuln library expanded to 146 AI components & 2000+ CVE rules; MCP/Skill scan stability & compatibility fixes.
• 2026-08-17 · v4.5.2 — Skill-Scan: .pyc bytecode bypass detection + charset smuggling defense; MCP-Scan: RCE prevention via tool whitelisting in dynamic mode; new SkillJack research project; vuln library expanded to 2000+ CVE rules.
• 2026-07-30 · v4.5.1 — Jailbreak Evaluation: 4 multi-turn jailbreak attacks (Many-Shot, PAIR, GOAT, ActorAttack); Agent-Scan: 5 new OWASP skills + web-exfiltration detection (10 skills total); MCP-Scan: 4 new security rules

👉 Earlier releases · 🛒 AI Security Skill Market · 🔍 skill-scan CLI · 🔍 mcp-scan CLI · 🔍 agent-scan CLI · 📊 SkillTrustBench

• 🚀 Quick Start
• ✨ Features
• 🖼️ Showcase
• 📖 User Guide
• 🔧 API Documentation
• 🏗️ Architecture Evolution
• 📝 Contribution Guide
• 🛡️ About the Team
• 🙏 Acknowledgements
• 💬 Join the Community
• 📖 Citation
• 📚 Research & Papers
• ⚖️ License & Attribution
  
  

# This method pulls pre-built images from Docker Hub for a faster start
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# For Docker Compose V2+, replace 'docker-compose' with 'docker compose'
docker-compose -f docker-compose.images.yml up -d

Once the service is running, you can access the A.I.G web interface at: http://localhost:8088

You can also call A.I.G directly from OpenClaw chat via the aig-scanner skill.

clawhub install aig-scanner

Then configure AIG_BASE_URL to point to your running A.I.G service.

For more details, see the aig-scanner README.

# This method will automatically install Docker and launch A.I.G with one command
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# This method builds a Docker image from local source code and starts the service
# (For Docker Compose V2+, replace 'docker-compose' with 'docker compose')
docker-compose up -d

Agent Skill security audit tool, easily integrated into enterprise CI/CD pipelines. Vulnerability classification aligns with SkillTrustBench T01–T09 taxonomy. Learn more →

pip install aig-skill-scan

# Set API key via environment variable
export LLM_API_KEY="your-api-key"

# Scan a local Skill project directory
aig-skill-scan --repo /path/to/your/skill \
           -m deepseek-v4-flash \
           --language en \
           -o result.json

The checker frontend is deployed separately. Docker deployment keeps the checker APIs available at GET /api/v1/relay/models and POST /api/v1/relay/check/stream; API documentation is available at http://127.0.0.1:8088/api-checker/docs. To run the checker and unified CLI from source:

python3 -m venv services/api_checker/.venv
services/api_checker/.venv/bin/pip install -r services/api_checker/requirements.txt
go build -o ai-infra-guard ./cmd/cli/main.go

export AIG_API_CHECKER_PYTHON="$PWD/services/api_checker/.venv/bin/python"
./ai-infra-guard api-checker list
./ai-infra-guard api-checker audit

See the API Checker integration guide for the Agent-embedded runtime architecture, HTTP API, configuration, and security boundaries.

Experience the Pro version with advanced features and improved performance. The Pro version requires an invitation code and is prioritized for contributors who have submitted issues, pull requests, or discussions, or actively help grow the community. Visit: https://aigsec.ai/.

Performance on SkillTrustBench with different LLMs:

Covers 9 categories of Skill security risks (SkillTrustBench T01–T09):

For full leaderboard and details, visit SkillTrustBench.

After deployment, open http://localhost:8088 in your browser.

What to enter as the target URL / IP?

The target is the network address of a running AI service you want to scan - not a GitHub URL or source code path. A.I.G connects to the live service and fingerprints it for known CVE vulnerabilities.

Step-by-step: Scan a local vLLM instance

1. Start vLLM normally (e.g. python -m vllm.entrypoints.api_server --model meta-llama/...)
2. In the A.I.G web UI, click "AI基础设施安全扫描 / AI Infra Scan"
3. Enter http://127.0.0.1:8000 (or the IP/port where vLLM is listening)
4. Click Start Scan - A.I.G will fingerprint the service and match it against 2000+ known CVEs
5. View the report: component version, matched vulnerabilities, severity, and remediation links

💡 Tip: To scan the nightly build of vLLM specifically, just run that nightly build and point A.I.G at its address. The scanner detects the version automatically.

Enter either a remote URL (e.g. https://github.com/user/mcp-server) or upload a local source archive - no running instance required.

Configure the target LLM's API endpoint (base URL + API key) in Settings → Model Config, then select a dataset and start the evaluation.

Visit our online documentation: https://tencent.github.io/AI-Infra-Guard/

For more detailed FAQs and troubleshooting guides, visit our documentation.

A.I.G provides a comprehensive set of task creation APIs that support AI infra scan, MCP Server Scan, and Jailbreak Evaluation capabilities.

After the project is running, visit http://localhost:8088/docs/index.html to view the complete API documentation.

For detailed API usage instructions, parameter descriptions, and complete example code, please refer to the Complete API Documentation.

The extensible plugin framework​​ serves as A.I.G's architectural cornerstone, inviting community innovation through Plugin and Feature contributions.​

1. Fingerprint Rules: Add new YAML fingerprint files to the data/fingerprints/ directory.
2. Vulnerability Rules: Add new vulnerability scan rules to the data/vuln/ directory.
3. MCP Plugins: Add new MCP security scan rules to the data/mcp/ directory.
4. Jailbreak Evaluation Datasets: Add new Jailbreak evaluation datasets to the data/eval directory.

Please refer to the existing rule formats, create new files, and submit them via a Pull Request.

• 🐛 Report a Bug
• 💡 Suggest a New Feature
• ⭐ Improve Documentation

This project is led and developed by Tencent Zhuque Lab, part of the Tencent Security Platform Department. Founded in 2019, Tencent Zhuque Lab is a top-tier security research lab focused on real-world offensive and defensive research and frontier technology in the AI security space, covering large model security, AI agent security, AI-empowered security, and AI-generated content detection.

The team has helped major vendors such as NVIDIA, Google, and Microsoft, as well as open-source communities like OpenClaw, Linux, and Hugging Face, fix a large number of high-risk vulnerabilities, and has been publicly acknowledged by them.

We have released open-source AI security products including the AI Red Team Security Testing Platform A.I.G (AI-Infra-Guard) and the Zhuque AI Detection Assistant. Our research has been widely published at top international security and AI conferences such as Black Hat, DEF CON, ICLR, CVPR, NeurIPS, and ACL, and we have authored the book "AI Security: Technology and Practice".

We thank our academic partners for their research contributions and technical support.

Prof. hui Li

Bin Wang

Zexin Liu

Hao Yu

Ao Yang

Zhengxi Lin

Prof. Zhemin Yang

Kangwei Zhong

Jiapeng Lin

Cheng Sheng

Thanks to all the developers who have contributed to the A.I.G project.

Thanks to the users from the following organizations and teams for using A.I.G and their valuable feedback.

• GitHub Discussions: Join our community discussions
• Issues & Bug Reports: Report issues or suggest features

WeChat Group	Discord [link]

For collaboration inquiries or feedback, please contact us at: zhuque@tencent.com

If you are interested in code security, check out A.S.E (AICGSecEval), the industry's first repository-level AI-generated code security evaluation framework open-sourced by the Tencent Wukong Code Security Team.

If you use A.I.G in your research, please cite:

@misc{Tencent_AI-Infra-Guard_2025,
  author={{Tencent Zhuque Lab}},
  title={{AI-Infra-Guard: A Comprehensive, Intelligent, and Easy-to-Use AI Red Teaming Platform}},
  year={2025},
  howpublished={GitHub repository},
  url={https://github.com/Tencent/AI-Infra-Guard}
}

Research:

1. "RogueHandoff-20: Measuring Susceptibility to Unsafe Agent Trajectories" — A Docker-based benchmark measuring whether an agent adopts an unsafe trajectory supplied as preceding state, testing susceptibility after exposure to another agent's unsafe strategy. [code]

2. "FORGE-Bench: A Deterministic Benchmark for Loss of Control in Autonomous Agents" — A deterministic, oracle-based benchmark studying how autonomous agents lose control while pursuing legitimate tasks, evaluating goal pressure, constraint degradation, and unsafe opportunity across 16 domains and 1,800 trajectories. [arXiv] [code]

3. "DeepSeek Harness Indirect Prompt-Injection Assessment" — Authorized security assessment of DeepSeek Harness against indirect prompt-injection across 14,560 agent runs. [code]

4. "SkillJack: Persistent Skill Backdoors in Self-Evolving Agents" — Demonstrates how poisoned trajectories can inject persistent backdoors into self-evolving agent skill systems. [code]

Papers:

1. "Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming" — A comprehensive framework for securing AI agent systems through multi-layer red teaming across infrastructure, supply chain, runtime interaction, and deployment surfaces. [arXiv] [pdf]

2. "AI-Infra-Guard: An AI Red Teaming Platform" — Black Hat Europe 2025 Arsenal presentation showcasing A.I.G's capabilities and real-world use cases. [pdf]

3. "MCP Unchained: Compromising The AI Agent Ecosystem Via Its Universal Connector" — Black Hat Europe 2025 talk revealing security risks in the MCP protocol within the AI agent ecosystem. [pdf]

Thanks to the research teams who have cited A.I.G in their academic work (19 papers):

📧 If you have used A.I.G in your research or product, or if we have inadvertently missed your publication, we would love to hear from you! Contact us here.

This project is open-sourced under the Apache License 2.0. We warmly welcome and encourage community contributions, integrations, and derivative works, subject to the following attribution requirements:

1. Retain notices: You must retain the LICENSE and NOTICE files from the original project in any distribution.
2. Product attribution: If you integrate AI-Infra-Guard's core code, components, or scanning engine into your open-source project, commercial product, or internal platform, you must clearly state the following in your product documentation, usage guide, or UI "About" page:

   "This project integrates AI-Infra-Guard, open-sourced by Tencent Zhuque Lab."

3. Academic & article citation: If you use this tool in vulnerability analysis reports, security research articles, or academic papers, please explicitly mention "Tencent Zhuque Lab AI-Infra-Guard" and include a link to the repository.

Repackaging this project as an original product without disclosing its origin is strictly prohibited.