AI-Infra-Guard (A.I.G) – AI Red Teaming Platform by Tencent Zhuque Lab
Full-stack AI security self-inspection: OpenClaw security scan, agent/MCP/skill scan, AI infra vulnerability scan, and jailbreak evaluation.
- Source repo
- Tencent/AI-Infra-Guard
- Stars
- ★ 6.9k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Python
- FA score
- 48/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free tier plus a paid hosted plan
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Security teams deploy A.I.G internally to scan running AI services like vLLM and Ollama for vulnerabilities, ensuring infrastructure security
- Not a fit if
- Teams that must stay fully offline or air-gapped without external LLM APIs
- Users wanting a lightweight tool without Docker, 4GB RAM and 10GB disk
- Anyone needing public-network exposure or built-in authentication
- Source review
- 48/100 · Major gaps 2 safety controls not found
What does this agent do, and when should you use it?
A.I.G (AI-Infra-Guard) is an open-source AI red teaming platform by Tencent Zhuque Lab, designed to help enterprises and individuals conduct comprehensive security self-assessments of AI systems. It integrates multiple core capabilities: ClawScan (OpenClaw security scan), agent security scan, MCP server and agent skills scan, AI infrastructure vulnerability scanning (covering 100+ components and 1900+ CVEs), and LLM jailbreak evaluation. Users can deploy it quickly via Docker and use the web UI (default port 8088) or CLI tools (e.g., aig-skill-scan). The project is open-sourced under Apache 2.0, with complete API documentation and a plugin extension mechanism.
A.I.G offers several scanning and evaluation capabilities: 1) AI infrastructure vulnerability scan: fingerprints running AI services (e.g., vLLM, Ollama, ComfyUI) and matches against 1900+ known CVEs, outputting component version, vulnerability severity, and remediation links; 2) MCP server and agent skills scan: detects 14 major categories of security risks from source code or remote URLs, including tool poisoning, credential exfiltration, command injection, etc.; 3) Agent scan: an independent multi-agent automated scanning framework to evaluate the security of AI agent workflows on platforms like Dify and Coze; 4) Jailbreak evaluation: tests target LLM APIs with curated datasets and multiple attack methods (e.g., multi-turn PAIR, GOAT) and provides cross-model comparisons; 5) ClawScan: one-click evaluation of OpenClaw security risks. Users can trigger scans via the web UI or use CLI tools (e.g., aig-skill-scan) to integrate into CI/CD pipelines.
- Security teams deploy A.I.G internally to scan running AI services like vLLM and Ollama for vulnerabilities, ensuring infrastructure security
- Developers integrate aig-skill-scan into CI/CD pipelines to automatically audit agent skills and prevent malicious skills from going live
- AI application vendors use the jailbreak evaluation module before release to test their LLM applications' resilience to prompt injection attacks
- MCP server developers use the MCP scan feature to detect security risks such as tool poisoning and command injection in their servers
- Enterprise security personnel use the agent scan to evaluate AI agent workflows on Dify or Coze for permission abuse or data leakage risks
- Security researchers extend A.I.G with custom fingerprints and vulnerability rules via its API and plugin mechanism
How do you install or deploy this agent?
Recommended installation is via Docker Compose:
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# For Docker Compose V2+, use 'docker compose'
docker-compose -f docker-compose.images.yml up -dAfter deployment, visit http://localhost:8088 . Alternatively, use the one-click install script:
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bashOr install the aig-scanner skill in OpenClaw:
clawhub install aig-scannerHow do you use this agent?
For AI infrastructure scanning: in the web UI, click 'AI Infra Scan' and enter the URL of a running service (e.g., http://127.0.0.1:8000), then click Start Scan. For jailbreak evaluation: configure the target LLM's API endpoint (base URL + API key) in Settings → Model Config, select a dataset, and start the evaluation. For skill scanning via CLI:
pip install aig-skill-scan
export LLM_API_KEY="your-api-key"
aig-skill-scan --repo /path/to/your/skill -m deepseek-v4-flash --language en -o result.jsonWhat are this agent's strengths and limitations?
- Comprehensive coverage: integrates multiple scanning capabilities – AI infra, MCP, agent skills, jailbreak evaluation – providing a one-stop solution for AI security risks
- Leading performance: skill scan achieves 0.9848 F1 score on SkillTrustBench (with Claude Opus 4.6), at the forefront of the industry
- Open ecosystem: Apache 2.0 license, plugin extension mechanism supports custom fingerprints, vulnerability rules, MCP rules, and evaluation datasets
- Multi-platform integration: provides web UI, CLI tools, API, and ClawHub skills (e.g., EdgeOne ClawScan) that can be embedded into any AI agent workflow
- High deployment requirements: needs Docker, at least 4GB RAM and 10GB disk
- Lacks authentication: positioned for internal corporate use, no auth mechanism, cannot be exposed on public networks, adding deployment constraints
- Model dependency: skill scanning and jailbreak evaluation rely on external LLM APIs (e.g., DeepSeek), requiring API keys, external dependencies, and costs
- Scan target limitation: AI infrastructure scanning requires the target service to be running and accessible, cannot scan source code offline
How does this agent compare with similar options?
The project does not explicitly mention direct competitors, but it can be compared to other AI security tools such as commercial red teaming platforms.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AI-Infra-Guard (A.I.G) – AI Red Teaming Platform by Tencent Zhuque Lab This agent | 48 · Major gaps | Self-hosted serviceFreemium | ★ 6.9k | today | Python | — |
| DeepTeam - LLM Red Teaming Framework | 29 · Major gaps | Library / SDKFree + model costs | ★ 3k | 2d ago | Python | — |
| Agentic Security | 45 · Major gaps | CLIFree + model costs | ★ 2k | today | Python | OpenAI API |
| T3MP3ST Security Harness | 55 · Major gaps | CLIFree + model costs | ★ 6.6k | 1mo ago | TypeScript | Codex · Claude Code · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README explicitly states the platform lacks authentication and is intended for internal use only, defaulting to 127.0.0.1, reflecting least privilege (least_privilege=1). No user confirmation mechanism is provided (user_confirmation=0). Data flow transparency: README describes scan targets, API keys, etc., but lacks internal processing details (data_flow_transparency=1). Sensitive data handling: SECURITY.md provides API key protection advice but no implementation evidence (sensitive_data_handling=1). Dependency security: go.mod lists many dependencies but no vulnerability scanning or audit evidence (dependency_security=1). External effects: scanning actively connects to targets, but README clarifies this is intended (external_effects=1). Rollback mechanism not mentioned (rollback=0). Source attribution: README and code files attribute to Tencent Zhuque Lab, but publisher unverified (source_attribution=1).
Evidence shows: README and SECURITY.md are consistent in describing platform positioning and trust model (self_consistency=2). Dependency availability: go.mod lists many dependencies but no version pinning or mirror info (dependency_availability=1). Failure messages: SECURITY.md provides report template but no runtime error handling (failure_messages=1).
Evidence shows: README identifies target users (enterprise/individual internal use) and multiple scenarios (audience_and_scenarios=2). Capability boundaries: README details scan types and limitations (capability_boundaries=2). Trigger precision: provides commands and parameters but not detailed trigger conditions (trigger_precision=1). Environment fit: supports Docker, CLI, multi-platform, but lacks system requirements (environment_fit=2).
Evidence shows: README is well-structured with quick start, features, API docs (information_architecture=2). Install notes: provides Docker, script, source methods (install_notes=2). Naming stability: consistent project and module naming (naming_stability=2). Examples and FAQ: README provides examples, FAQ links to external docs (examples_and_faq=2). Known limitations: README explicitly states lack of authentication, internal use only (known_limitations=2). License: Apache-2.0 full text (license=3). Versioning and changelog: README lists version updates, CHANGELOG.md exists (versioning_changelog=2). Maintenance responsibility: SECURITY.md provides maintainer contact and disclosure process (maintenance_responsibility=2).
Evidence shows: Output usability: provides report format and API docs (output_usability=2). Marginal value: offers multiple scanning capabilities with unique value (marginal_value=2). Cost benefit: free and open source, but requires Docker and resources (cost_benefit=2).
Evidence shows: Claim traceability: README performance data lacks test methodology or source (claim_traceability=1). Cross-source corroboration: relies only on README and SECURITY.md, no independent verification (cross_source_corroboration=1). Fact-inference separation: README mixes facts and inferences without clear distinction (fact_inference_separation=1).
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- The platform lacks authentication and is intended for internal use only; do not expose to public networks.
- Protect sensitive information such as API keys to avoid leakage.
- Many dependencies; recommend security audit.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v4.6.6 AI-Infra-Guard v4.6.6
Release notes excerpt
[v4.6.6] - 2026-10-15 Added - Agent-Scan: Add Atlas Cloud provider preset (PR #706, 6a14a56a) - Agent-Scan: Add API Route provider preset (PR #697, c752770e) - Agent-Scan: Add memory/RAG poisoning detection skill (PR #429, a25426cb) - CLI: Add JSON scan output (PR #682, 3eb7b466) - Dashboard: Edit extra_headers / extra_body in the model dialog (PR #690, 57fad501) - Eval: Add BadPhoneAgent bilingual benchmark (PR #698, 0586cb9b) Fixed - Agent-Scan: Stream SSE responses and stop at [DONE] instead of waiting for connection close (PR #708, 1e2c69d9) …View on GitHub ↗ -
v4.6.5 AI-Infra-Guard v4.6.5
Release notes excerpt
[v4.6.5] - 2026-10-08 Added - Agent-Scan: Support custom transforms for SSE responses (PR #600, f59fbe14) - MCP-Scan: Support modern/legacy protocol auto-negotiation and record protocol version (PR #579, 890f21dd) - Agent-Scan: Add OrcaRouter as a first-class provider (PR #619, a7c9b006) - Models: Send extra headers and body fields to the model API (PR #669, ae6fc0d6) - DeepTeam: Resume an interrupted red team run (PR #668, a2ac397e) - Data: Add vulnerability rules [2026-09-25] — 154 CVE rules + 9 fingerprints (PR #679, 1f8ab6f2) …View on GitHub ↗ -
v4.6.4 AI-Infra-Guard v4.6.4
Release notes excerpt
[v4.6.4] - 2026-10-01 Added - Research: Vendor pikit (https://github.com/NY1024/pikit), a composable prompt-injection research toolkit, under Research/pikit (fe84b853, PR #681) Fixed - Skill-Scan: Forward optional reasoning effort to the model API (PR #676, 14beb9b9) Changed - Docs: Update Research/pikit README (9f889209) Contributors Elwood Zonghao Ying (NY1024), Patrick ErichsenView on GitHub ↗