AI-Infra-Guard: AI Red Teaming Platform by Tencent

Understanding AI-Infra-Guard

AI-Infra-Guard is a Docker-based AI red teaming platform by Tencent Zhuque Lab that scans AI infrastructure, agents, MCP servers, agent skills, and LLM behavior for security risks. It fingerprints running AI services against known CVEs, evaluates prompt's resistance to manipulation through jailbreak datasets, and audits skill/MCP source code for supply-chain threats — all accessible through a web UI at localhost:8088 or as standalone CLI tools for CI/CD pipelines.

The Challenge of AI Ecosystem Security

AI deployments sprawl across inference servers, agent frameworks, tool plugins, and model APIs — each with distinct vulnerability classes that existing security scanners miss entirely. A compromised MCP server or a poisoned agent skill can exfiltrate data or hijack an agent's behavior long before a traditional CVE database flags anything. Organizations running self-hosted AI stacks need a way to audit the full attack surface across all these layers without stitching together a dozen separate tools.

Core Capabilities for AI Red Teaming

• ✓AI infrastructure vulnerability scan — fingerprints running services (vLLM, Ollama, ComfyUI, n8n, Triton Inference Server and 100+ more) against 2000+ CVE rules
• ✓Agent Scan — multi-agent automated framework evaluating AI agent workflow security across platforms like Dify and Coze
• ✓MCP Server & Agent Skills scan — detects 14 major risk categories in MCP implementations and agent skills from source code or remote URLs, covering instruction hijacking, memory poisoning, privilege escalation, and tool spoofing
• ✓Jailbreak Evaluation — tests LLM's capacity to withstand multiple attack methods including Many-Shot, PAIR, GOAT, and ActorAttack with cross-model comparison
• ✓LLM API poisoning detection — multi-probe black-box audit for model substitution and backdoor risks introduced through relay/proxy infrastructure
• ✓Model and API Relay Checker — fingerprinting, Claude Signature verification, relay black-box auditing supporting PAMELA and Ventor QTest methods
• ✓Standalone CLI tools — skill-scan and MCP-scan run independently for CI/CD integration; aig-skill-scan pip package enables pipeline embedding
• ✓SkillTrustBench benchmark — T01–T09 taxonomy (9 risk categories) with published F1 scores; top result 0.9848 F1 with Claude Opus 4.6

Scanning AI Services and Agents

• •Scan a running vLLM instance by pointing AI-Infra-Guard at its HTTP address — the scanner fingerprints the service version and matches it against 2000+ known vulnerabilities
• •Audit an MCP server's source repository or URL before deploying it, checking for credential exfiltration, command injection, and tool poisoning patterns
• •Evaluate an LLM's jailbreak resistance by configuring its API endpoint in Settings and running one of the bundled attack datasets
• •Scan agent skills during CI/CD — pip install aig-skill-scan, point it at the skill directory, and receive a vulnerability report aligned to SkillTrustBench T01–T09 taxonomy
• •Compare multiple LLMs on jailbreak resistance using the built-in cross-model evaluation report
• •Audit agent workflow security across a Dify or Coze deployment using the Agent Scan framework

Getting Started with AI-Infra-Guard

AI-Infra-Guard is designed for Docker deployment on Linux, macOS, and Windows. The recommended path clones the repo and runs `docker-compose -f docker-compose.images.yml up -d`, which pulls pre-built images and starts the web interface at http://localhost:8088. A one-line installer (`curl ... | bash`) handles Docker installation automatically. For building from source locally, use `docker-compose up -d` instead. Standalone tools like aig-skill-scan can be installed via pip (`pip install aig-skill-scan`) without running the full platform. The API checker and unified CLI require a Go build step (`go build -o ai-infra-guard ./cmd/cli/main.go`) from the services directory.

Related Tools and Ecosystem Integration

Frequently Asked Questions

Who should try it — and who should skip

Security teams and red teams at organizations running self-hosted AI infrastructure — particularly those deploying vLLM, Ollama, ComfyUI, or agent platforms like Dify and Coze — should consider AI-Infra-Guard as a pre-deployment audit layer. MLOps teams that want a unified CVE baseline check across their AI stack will find the infrastructure fingerprinting useful. Skip it if you need a tool that can safely face the internet, if your organization prohibits Tencent-maintained open-source projects, or if you only need narrow coverage (a dedicated prompt injection tool like Garak may suffice). The no-auth constraint makes it a clear internal-only choice — do not deploy it anywhere it can be reached from untrusted networks.

Related repositories