📖 Documentation  |  🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский

🚀 AI Red Teaming Platform by Tencent Zhuque Lab

A.I.G (AI-Infra-Guard) integrates capabilities such as ClawScan(OpenClaw Security Scan), Agent Scan，AI infra vulnerability scan, MCP Server & Agent Skills scan, and Jailbreak Evaluation, aiming to provide users with the most comprehensive, intelligent, and user-friendly solution for AI security risk self-examination.

We are committed to making A.I.G(AI-Infra-Guard) the industry-leading AI red teaming platform. More stars help this project reach a wider audience, attracting more developers to contribute, which accelerates iteration and improvement. Your star is crucial to us!

📋 User Feedback Survey

Help us improve A.I.G! Please take 3-5 minutes to fill out our User Feedback Survey. Users who provide high-quality feedback and leave a valid email address will receive an exclusive Tencent souvenir gift.

🚀 What's New

• 2026-09-10 · v4.6.1 — API Checker: expanded model fingerprint coverage (Gemini 2.5/3.1, Gemma 2/3/4, GLM-5.3 & GLM-5.3-Flash); MCP-Scan reliability: flags empty/incomplete scans, preserves security findings during context compaction, surfaces underlying connection errors; corrected mislabeled CVE product names.
• 2026-08-26 · v4.6.0 — LLM API poisoning detection (multi-probe black-box audit for model substitution & backdoor risks); Agent-Scan v5.0.0 mutation engine refactor; vuln library expanded to 146 AI components & 2000+ CVE rules; MCP/Skill scan stability & compatibility fixes.
• 2026-08-17 · v4.5.2 — Skill-Scan: .pyc bytecode bypass detection + charset smuggling defense; MCP-Scan: RCE prevention via tool whitelisting in dynamic mode; new SkillJack research project; vuln library expanded to 2000+ CVE rules.
• 2026-07-30 · v4.5.1 — Jailbreak Evaluation: 4 multi-turn jailbreak attacks (Many-Shot, PAIR, GOAT, ActorAttack); Agent-Scan: 5 new OWASP skills + web-exfiltration detection (10 skills total); MCP-Scan: 4 new security rules
• 2026-07-27 · v4.5.0 — AI Security Skill Market launched (3 official skills); frontend fully open-sourced; Skill scan engine upgraded (9 risk categories, SkillTrustBench top score 0.9848); Skill/MCP/Agent scan as standalone CLI; vuln library expanded to 130 components, 1888 rules

Table of Contents

• 🚀 Quick Start
• ✨ Features
• 🖼️ Showcase
• 📖 User Guide
• 🔧 API Documentation
• 🏗️ Architecture Evolution
• 📝 Contribution Guide
• 🛡️ About the Team
• 🙏 Acknowledgements
• 💬 Join the Community
• 📖 Citation
• 📚 Research & Papers
• ⚖️ License & Attribution

🚀 Quick Start

🐳 Deploy A.I.G with Docker

| Docker | RAM | Disk Space | |:-------|:----|:----------| | 20.10 or higher | 4GB+ | 10GB+ |

# This method pulls pre-built images from Docker Hub for a faster start
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
For Docker Compose V2+, replace 'docker-compose' with 'docker compose'
docker-compose -f docker-compose.images.yml up -d

Once the service is running, you can access the A.I.G web interface at: http://localhost:8088

Use from OpenClaw

You can also call A.I.G directly from OpenClaw chat via the aig-scanner skill.

clawhub install aig-scanner

Then configure AIG_BASE_URL to point to your running A.I.G service.

For more details, see the aig-scanner README.

# This method will automatically install Docker and launch A.I.G with one command
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
This method builds a Docker image from local source code and starts the service
(For Docker Compose V2+, replace 'docker-compose' with 'docker compose')
docker-compose up -d

⚡ Install aig-skill-scan with a Single Command

Agent Skill security audit tool, easily integrated into enterprise CI/CD pipelines. Vulnerability classification aligns with SkillTrustBench T01–T09 taxonomy. Learn more →

pip install aig-skill-scan
Set API key via environment variable
export LLM_API_KEY="your-api-key"
Scan a local Skill project directory
aig-skill-scan --repo /path/to/your/skill \
           -m deepseek-v4-flash \
           --language en \
           -o result.json

Model and API Relay Checker

The checker frontend is deployed separately. Docker deployment keeps the checker APIs available at GET /api/v1/relay/models and POST /api/v1/relay/check/stream; API documentation is available at http://127.0.0.1:8088/api-checker/docs. To run the checker and unified CLI from source:

python3 -m venv services/api_checker/.venv
services/api_checker/.venv/bin/pip install -r services/api_checker/requirements.txt
go build -o ai-infra-guard ./cmd/cli/main.go
export AIG_API_CHECKER_PYTHON="$PWD/services/api_checker/.venv/bin/python"
./ai-infra-guard api-checker list
./ai-infra-guard api-checker audit

See the API Checker integration guide for the Agent-embedded runtime architecture, HTTP API, configuration, and security boundaries.

🌟 Try the Online Pro Version

✨ Features

🔍 aig-skill-scan Performance & Coverage

Performance on SkillTrustBench with different LLMs:

| # | Model | F1 | Precision | Recall | FPR | |:--|:------|:---|:----------|:-------|:----| | 1 | Claude Opus 4.6 | 0.9848 | 0.9725 | 0.9974 | 0.0663 | | 2 | GLM 5.1 | 0.9836 | 0.9701 | 0.9974 | 0.0723 | | 3 | Gemini 3.5 Flash | 0.9792 | 0.9947 | 0.9641 | 0.0120 | | 4 | Kimi 2.6 | 0.9780 | 0.9895 | 0.9667 | 0.0241 | | 5 | DeepSeek v4 Flash | 0.9740 | 0.9868 | 0.9615 | 0.0301 |

Covers 9 categories of Skill security risks (SkillTrustBench T01–T09):

| Layer | Risks | |:------|:--------| | A · Instruction & Memory | T01 Skill Instruction Hijacking, T02 Memory Poisoning | | B · Code Execution | T03 Remote Payload Download & Execution, T04 Embedded Malicious Code | | C · System Privilege | T05 Privilege Escalation & Unauthorized Access, T06 System Persistence | | D · Toolchain & Dependencies | T07 Tool Hijacking & Spoofing, T08 Insecure Dependencies | | E · Skill Code Quality | T09 Insecure Coding Practices |

For full leaderboard and details, visit SkillTrustBench.

🔬 Security Scanning & Evaluation

| Feature | More Info | |:--------|:------------| | ClawScan(OpenClaw Security Scan) | Supports one-click evaluation of OpenClaw security risks. It detects insecure configurations, Skill risks, CVE vulnerabilities, and privacy leakage. | | Agent Scan | This is an independent, multi-agent automated scanning framework. It is designed to evaluate the security of AI agent workflows. It seamlessly supports agents running across various platforms, including Dify and Coze. | | MCP Server & Agent Skills scan | It thoroughly detects 14 major categories of security risks. The detection applies to both MCP Servers and Agent Skills. It flexibly supports scanning from both source code and remote URLs. | | AI infra vulnerability scan | This scanner precisely identifies over 100 AI framework components. It covers more than 2000 known CVE vulnerabilities. Supported frameworks include Ollama, ComfyUI, vLLM, n8n, Triton Inference Server and more. | | Jailbreak Evaluation | It assesses prompt security risks using carefully curated datasets. The evaluation applies multiple attack methods to test robustness. It also provides detailed cross-model comparison capabilities. | | Model and API Relay Checker | Model fingerprinting, Claude Signature verification, relay black-box auditing, PAMELA, and Ventor QTest. |

🖼️ Showcase

A.I.G Main Interface

Plugin Management

🗺️ Quick Usage Guide

After deployment, open http://localhost:8088 in your browser.

AI Infrastructure Vulnerability Scan

What to enter as the target URL / IP?

The target is the network address of a running AI service you want to scan - not a GitHub URL or source code path. A.I.G connects to the live service and fingerprints it for known CVE vulnerabilities.

| Scenario | Example target | |:---------|:--------------| | A locally running vLLM instance | http://127.0.0.1:8000 | | An Ollama server on your LAN | http://192.168.1.100:11434 | | A ComfyUI instance exposed internally | http://10.0.0.5:8188 | | Multiple hosts (one per line) | 192.168.1.0/24 (CIDR), 10.0.0.1-10.0.0.20 (range) |

Step-by-step: Scan a local vLLM instance

1. Start vLLM normally (e.g. python -m vllm.entrypoints.api_server --model meta-llama/...) 2. In the A.I.G web UI, click "AI基础设施安全扫描 / AI Infra Scan" 3. Enter http://127.0.0.1:8000 (or the IP/port where vLLM is listening) 4. Click Start Scan - A.I.G will fingerprint the service and match it against 2000+ known CVEs 5. View the report: component version, matched vulnerabilities, severity, and remediation links

💡 Tip: To scan the nightly build of vLLM specifically, just run that nightly build and point A.I.G at its address. The scanner detects the version automatically.

MCP Server & Agent Skills Scan

Enter either a remote URL (e.g. https://github.com/user/mcp-server) or upload a local source archive - no running instance required.

Jailbreak Evaluation

Configure the target LLM's API endpoint (base URL + API key) in Settings → Model Config, then select a dataset and start the evaluation.

---

📖 User Guide

Visit our online documentation: https://tencent.github.io/AI-Infra-Guard/

For more detailed FAQs and troubleshooting guides, visit our documentation.

🔧 API Documentation

A.I.G provides a comprehensive set of task creation APIs that support AI infra scan, MCP Server Scan, and Jailbreak Evaluation capabilities.

After the project is running, visit http://localhost:8088/docs/index.html to view the complete API documentation.

For detailed API usage instructions, parameter descriptions, and complete example code, please refer to the Complete API Documentation.

📝 Contribution Guide

The extensible plugin framework​​ serves as A.I.G's architectural cornerstone, inviting community innovation through Plugin and Feature contributions.​

Plugin Contribution Rules

Please refer to the existing rule formats, create new files, and submit them via a Pull Request.

Other Ways to Contribute

• 🐛 Report a Bug
• 💡 Suggest a New Feature
• ⭐ Improve Documentation

🛡️ About the Team

This project is led and developed by Tencent Zhuque Lab, part of the Tencent Security Platform Department. Founded in 2019, Tencent Zhuque Lab is a top-tier security research lab focused on real-world offensive and defensive research and frontier technology in the AI security space, covering large model security, AI agent security, AI-empowered security, and AI-generated content detection.

The team has helped major vendors such as NVIDIA, Google, and Microsoft, as well as open-source communities like OpenClaw, Linux, and Hugging Face, fix a large number of high-risk vulnerabilities, and has been publicly acknowledged by them.

We have released open-source AI security products including the AI Red Team Security Testing Platform A.I.G (AI-Infra-Guard) and the Zhuque AI Detection Assistant. Our research has been widely published at top international security and AI conferences such as Black Hat, DEF CON, ICLR, CVPR, NeurIPS, and ACL, and we have authored the book "AI Security: Technology and Practice".

👥 Core Members & Contributions

| Role | Member | Contribution | | --- | --- | --- | | Head of Tencent Security Platform Department | Yong Yang | Initiated A.I.G and proposed automated assessment of AI agent loss-of-control risks, guiding the platform's expansion from AI infrastructure vulnerability scanning to agent execution risk, tool misuse, and permission-boundary evaluation. | | Head of Tencent Zhuque Lab | Xing Zheng | Proposed the automated vulnerability-update and benchmark-alignment mechanism, helping AI Infra fingerprints, CVE/GHSA rules, and benchmarks iterate continuously. | | Project Lead | Nicky | Frontier security research, product planning, technical-route decisions, internal and external collaboration, and communications. | | Technical Lead | Python | Overall architecture design, core module development, and version iteration. | | Core Contributor | Zona | Frontend interaction, product experience, community operations, and user-feedback loop. | | Core Contributor | Fyoung | AI Infra vulnerability component fingerprint updates and Benchmark system construction. | | Core Contributor | Xiangfan | Security capability development for Skill risks and agent loss-of-control scenarios. | | Core Contributor | Elwood | Enhancing Agent security scanning capabilities and updating technical reports. | | Core Contributor | Robert | LLM safety assessment and jailbreak-evaluation strategy operations. | | Core Contributor | Zoe | LLM safety assessment, jailbreak evaluation, and model-integration module development. | | Contributor | Ronin | Participated in AI agent security scanning development. | | Contributor | Rsin | Participated in community operations and campaign communications. |

🙏 Acknowledgements

🎓 Academic Collaborations

We thank our academic partners for their research contributions and technical support.

Prof. hui Li

Bin Wang

Zexin Liu

Hao Yu

Ao Yang

Zhengxi Lin

Prof. Zhemin Yang

Kangwei Zhong

More Today's Trending projects 1 debpalash / VoiceStudio Python★ 29,840⑂ 3,606▲ 2,776 stars → 2 JustVugg / colibri C★ 32,609⑂ 3,430▲ 2,173 stars → 3 bilawalsidhu / gods-eye-view JavaScript★ 33,945⑂ 6,772▲ 1,831 stars → 4 alibaba / open-code-review Go★ 26,516⑂ 1,906▲ 1,571 stars → 5 ever-co / ever-gauzy TypeScript★ 6,164⑂ 994▲ 1,130 stars → 6 pacifio / atlas Rust★ 4,440⑂ 274▲ 1,091 stars →