AI-Infra-Guard deep dive: Tencent Zhuque Lab turns scattered AI attack surfaces into one red teaming platform

1. At a glance

★★★★☆ (4/5). A full-stack AI red teaming platform from Tencent Zhuque Lab, Apache-2.0, 6.6k stars / 615 forks (as of 2026-09-24). This is not “yet another AI scanner” — it collapses the attack surfaces that scattered across the ecosystem after 2025 into a single executable platform: AI infrastructure CVEs, agent loss of control, MCP supply chain, agent skill backdoors, and jailbreak evaluation — and backs the methodology with homegrown benchmarks and Black Hat Europe talks. One star is withheld for two concrete reasons: the README states plainly that it has no authentication mechanism and should not be deployed on public networks, and several sub-modules remain unfinished (skills with a SKILL.md that were never registered, an English CVE store that never syncs, red-team resume not implemented). Usable as-is on an internal network, a controlled environment, or as a CI gate; public deployment requires you to add auth and network isolation yourself.

Who it’s for (scored by audience, out of 5):

Building on it: Apache-2.0, three tiers of effort (configure / integrate / extend):

2. What it is, and what it isn’t

Four clarifications before you open the repo, because A.I.G is not these things:

Not a single scanner. The “Infra Guard” name suggests a tool that only scans AI frameworks for CVEs — that was its earliest 2025 form. Today A.I.G is a platform with five peer capabilities: Agent Scan, Skill Scan, MCP Scan, AI Infra Scan, Jailbreak Evaluation, plus a Model & API Relay Checker. Infrastructure CVE scanning is one layer of five.

Not DAST or SAST. It doesn’t replace your existing web scanner or code audit. AI Infra Scan does fingerprint identification + CVE matching — it connects to your running vLLM / Ollama / ComfyUI, identifies the component and version, then matches known vulnerabilities. That’s asset inventory and known-vuln hygiene, not 0day hunting.

Not a pure rule database. MCP Scan and Skill Scan are fundamentally LLM-reviewing-code: hand the MCP server or skill source to a model, get findings and remediation against a predefined taxonomy (14 classes / T01–T09). So they come with variance in output quality and per-call cost — expanded in section 7.

Not a public-facing SaaS. README, verbatim: “It currently lacks an authentication mechanism and should not be deployed on public networks.” It is positioned as a red teaming platform for internal use by enterprises or individuals. This is the most important caveat and comes up again below.

So what is A.I.G? The official line:

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

Three keywords: full-stack / red teaming / AI ecosystems.

3. The five capabilities

A.I.G splits into five peer task types — five buttons in the web UI, five task types in the API.

One constraint on AI Infra Scan deserves calling out: it scans running service addresses — not GitHub URLs, not local source paths. So http://127.0.0.1:8000 (local vLLM), http://192.168.1.100:11434 (LAN Ollama), or 192.168.1.0/24 (whole CIDR) all work, but you cannot point it at a repository. Source scanning goes through MCP Scan / Skill Scan instead. This distinction fixes its enterprise use case as internal asset inventory, not open-source supply chain assessment.

MCP Scan needs no running instance, which is genuinely useful — hand it a remote URL or upload a source archive, and you never have to start the suspicious MCP server (starting it is itself the risk). v4.5.2 also added a tool allowlist to prevent RCE in dynamic mode: the right instinct, protect yourself before you scan someone else’s malicious code.

Skill Scan covers 9 risk classes across 5 layers — the taxonomy alone is worth studying:

4. Architecture: plugin framework + multiple scanners

The architectural cornerstone is an extensible plugin framework (README: “The extensible plugin framework serves as A.I.G’s architectural cornerstone”).

Engine and rule data are separated — every scan rule lives under data/:

The payoff is a very low contribution barrier: supporting a new AI component means adding a YAML; adding a CVE rule means adding a file. No Go code touched.

The stack is mixed, worth noting:

• Backend: Go + trpc-go, serving the web service and Task API; cmd/cli/main.go builds a unified CLI, ai-infra-guard
• Frontend: Vite + Tailwind, one-click scanning with live progress
• Sub-scanners: agent-scan / mcp-scan / skill-scan are standalone Python modules; AIG-PromptSecurity (jailbreak eval) builds on DeepTeam; services/api_checker is Python too
• Distributed: webserver + agent topology (Dockerfile_Agent); infra scanning runs via AIInfraScanAgent.executeScan on the agent side; the API checker is embedded in the agent runtime

I18n lives in the data layer, not the UI layer: the knowledge base endpoint /api/v1/knowledge/vulnerabilities reads a lang parameter (default zh), serving data/vuln_en when lang=en. Right design — but it also planted a known sync bug (section 7).

5. Research and benchmarks: where it pulls away from the pack

Most open-source security tools ship code only. A.I.G ships homegrown benchmarks and papers. This is the part I’d single out for praise.

Four in-house studies (code under Research/):

SkillJack’s choice of topic says a lot — it isn’t asking “does this round of prompt injection succeed”, it’s asking whether a backdoor can settle in while the agent evolves itself. That is the real 2026 agent-security pain point.

Three papers, two of them from Black Hat Europe 2025:

1. Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming
2. AI-Infra-Guard: An AI Red Teaming Platform (Black Hat Europe 2025 Arsenal)
3. MCP Unchained: Compromising The AI Agent Ecosystem Via Its Universal Connector (Black Hat Europe 2025)

The third is the sharpest选题 — MCP as the agent ecosystem’s universal connector is also its universal attack surface.

Cited by 19 academic papers, including MCPGuard, MCPSecBench, SkillAttack, and TRUSTDESC. An industry open-source tool serving as a reference for that much academic work means it has become a de facto baseline in agent security.

Skill Scan quality is quantified (SkillTrustBench):

Publishing all four of F1 / Precision / Recall / FPR rather than a lone accuracy number is an honest move. Note how much FPR varies (0.012 to 0.072) — if you’re gating a pipeline on Skill Scan, picking a low-FPR model like Gemini 3.5 Flash matters more than picking the top-F1 one, or false positives will drown your CI.

6. Deployment and integration

Docker one-liner (recommended):

1
2
3
4

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
docker-compose -f docker-compose.images.yml up -d
# open http://localhost:8088

Or the script: curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash

Skill Scan as a standalone CLI (the easiest CI hook):

1
2
3

pip install aig-skill-scan
export LLM_API_KEY="your-api-key"
aig-skill-scan --repo /path/to/your/skill -m deepseek-v4-flash --language en -o result.json

Embedding it in an agent workflow (agent-ready):

1
2

clawhub install aig-scanner
# point AIG_BASE_URL at your running A.I.G service

You can then invoke scans from an OpenClaw conversation. Shipping it as a plug-and-play ClawHub skill is the right instinct — half the value of a security tool is whether it fits the workflow developers already have.

Relay Checker (model and API relay auditing) exposes /api/v1/relay/* after Docker deploy, documented at http://127.0.0.1:8088/api-checker/docs. Note the checker frontend is deployed separately — Docker only guarantees the API.

7. Limits and risks

This is where the withheld star lives. Four concrete constraints.

1. No authentication — do not deploy publicly (most important)

The README states the platform lacks an auth mechanism and should not be deployed on public networks. It ships a web UI, a full API (Swagger), and one-click scanning — exposing those to the public internet unauthenticated means handing out internal asset-scanning capability to anyone. Enterprises must add auth and network isolation themselves. Treat this as the first line item in your deployment cost, not an afterthought.

2. MCP / Skill Scan depend heavily on an LLM

Both are “let a model review the code”, with three consequences:

• Quality tracks the model — the 0.98 F1 in section 5 is Claude Opus 4.6’s number; weaker models fall off
• Per-call cost — large-scale scanning isn’t cheap; high-frequency CI runs need a budget
• LLM nondeterminism — the README and commit history record models rewriting <desc> tags as <description> and wrapping output in <![CDATA[ ]]>, causing valid findings to be dropped by the validation gate (reporting 0 findings)

Robustness fixes are in place (CDATA stripping, synonym fallback), but the paradigm’s limits don’t disappear because of engineering patches. Using an LLM as a security judge means accepting that it both misses things and cries wolf.

3. Several sub-modules are half-finished

Visible from the commit history and code:

• Four agent detection skills (direct-injection-detection, file-path-traversal-detection, hardcoded-secret-detection, memory-poisoning-detection) have a SKILL.md but were never registered in _DETECTION_SKILLS — they never run
• web-exfiltration-detection is registered but has no matching row in the OWASP ASI table
• The knowledge base create/edit endpoint writes only the Chinese data/vuln, never data/vuln_en — CVEs added by an admin have no English text
• Red-team resume is not implemented; only JSONL progress logging landed
• Process termination is limited on Windows

None of this breaks the main flow, but it means the platform is more finished than each sub-module. Confirm the module you depend on is actually running before you rely on it.

4. AI Infra Scan only covers running assets

It fingerprints live services — it can’t reach components that aren’t running, or scan source repositories. Fine for internal inventory; don’t expect open-source supply chain assessment from it.

8. Getting started

Step one, sweep your AI infrastructure (fastest path to visible value):

1
2
3

# start a test vLLM (or point at one you already run)
# open http://localhost:8088 → click "AI Infra Scan"
# enter http://127.0.0.1:8000 → Start Scan

A CIDR sweep (192.168.1.0/24) or range (10.0.0.1-10.0.0.20) tells you in one pass how many AI components are live on your network.

Step two, hook skill / MCP scanning into CI:

1
2

pip install aig-skill-scan
aig-skill-scan --repo ./my-skill -m <model> -o result.json

Prefer a low-FPR model (section 5), watch the false positive rate for a few days, then decide whether to hard-gate.

Step three, configure Jailbreak Evaluation: fill in your target LLM’s base URL + API key under Settings → Model Config, pick a dataset, run, and compare across models.

Practical notes (from the README and known pitfalls):

1. Never deploy this publicly — again: it has no authentication at all
2. In CI, pick models by FPR, not F1 — false positives will drown the pipeline
3. Before relying on Agent Scan, confirm the detection skill is actually registered — having a SKILL.md doesn’t mean it runs
4. Manually sync data/vuln_en when adding CVEs — the admin endpoint writes Chinese only
5. Confirm authorization before sweeping a CIDR — it actively connects and fingerprints; don’t scan segments you shouldn’t

9. The one-line verdict

A.I.G isn’t a new scanner — it’s the layer that collapses scattered AI attack surfaces into one executable platform: five capabilities (infra CVEs / agent loss of control / MCP supply chain / skill backdoors / jailbreak eval) plus three homegrown benchmarks plus Black Hat Europe backing, with Tencent Zhuque Lab’s engineering showing in the numbers (1,918 commits, 58 tags, Apache-2.0). In the “AI security red teaming platform” niche, it is among the most complete open-source efforts available, and deserves a high marks.

The deductions cluster in two places: deployment constraints from the missing auth layer, and sub-modules that aren’t finished. The former means you can’t drop it on the public internet out of the box; the latter means verifying that the piece you depend on actually runs. Neither is hard to fix, but until they are, adoption costs extra.

Start by sweeping internal AI assets (fastest visible payoff), then consider wiring skill/MCP scanning into CI. And if you deploy it anywhere reachable, add authentication first.