AI-Infra-Guard: Tencent's Red Teaming Platform for AI Ecosystems
A full-stack AI Red Teaming platform securing AI ecosystems via OpenClaw Security Scan, Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.
At a glance
- What is it?
- AI-Infra-Guard is a full-stack AI red teaming platform from Tencent Zhuque Lab, covering OpenClaw security, agents, skills, MCP servers, AI infrastructure, and jailbreak evaluation. It targets security teams that need a unified scanning suite, but its Docker-first deployment and evolving CLI tools require careful verification before adoption.
- Who is it for?
- Adopt AI-Infra-Guard if you are a security team running AI infrastructure and need a broad, integrated scanning suite covering OpenClaw, agents, MCP servers, skills, and LLM jailbreaks. It is also suitable if you want a web UI and a Docker-based deployment.
- Can I use it commercially?
- Yes. Apache-2.0 is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 2 days ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 14, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What AI-Infra-Guard Solves
AI-Infra-Guard addresses a fragmented security testing landscape. Teams building AI applications often have to use separate tools for scanning LLM prompts, auditing agent behavior, inspecting MCP servers, and checking for known vulnerabilities in AI components. This platform combines those into one system. It is built by Tencent Zhuque Lab, which gives it a credibility boost for enterprise use. The intended audience is security engineers and red teams who need a self-examination tool for AI ecosystems. The README explicitly positions it as a solution for 'AI security risk self-examination.' This is not a runtime protection tool; it is a scanning and evaluation platform that you run against your own infrastructure.
How It Works: A Suite of Scanners
The platform integrates multiple scanning engines. ClawScan focuses on OpenClaw security, which is relevant for teams using the OpenClaw agent framework. Agent-Scan evaluates agent behavior, with recent versions adding OWASP skills and web-exfiltration detection. Skill-Scan inspects agent skills, and the v4.5.2 release shows it can detect .pyc bytecode bypass and charset smuggling. MCP-Scan targets Model Context Protocol servers, with rules for tool poisoning, credential exfiltration, and command injection. There is also an AI infra vulnerability scan, which uses a library of 146 AI components and over 2000 CVE rules as of v4.6.0. Finally, Jailbreak Evaluation tests LLMs against multi-turn attacks like Many-Shot, PAIR, GOAT, and ActorAttack. These scanners are available both through the web platform and as standalone CLIs, which is a practical design choice.
Getting Started: Docker and CLI Options
The quick start path is Docker-based. You clone the repository, then run `docker-compose -f docker-compose.images.yml up -d`. This pulls pre-built images from Docker Hub. The README specifies a minimum of 4GB RAM and 10GB disk space. After startup, the web interface is at `http://localhost:8088`. There is also a one-click install script: `curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash`. For those who want to avoid the web UI, the project provides standalone CLIs: `agent-scan`, `mcp-scan`, and `skill-scan`. You can also integrate with OpenClaw via the `aig-scanner` skill, installed with `clawhub install aig-scanner`, and configure `AIG_BASE_URL` to point to your running service. The README does not provide direct pip installation, so Docker is the primary supported method.
Recent Releases Show Active Evolution
The release history shows rapid iteration. v4.6.0, pushed on 2026-08-26, introduced LLM API poisoning detection, which is a black-box audit for model substitution and backdoor risks. It also refactored the Agent-Scan mutation engine and expanded the vulnerability library to 146 components and 2000+ CVE rules. v4.5.2 added .pyc bytecode bypass detection in Skill-Scan and RCE prevention via tool whitelisting in MCP-Scan dynamic mode. v4.5.1 added four multi-turn jailbreak attacks. This pace suggests the project is actively maintained, but it also means APIs and CLI behavior may change between versions. The README links to a CHANGELOG for earlier releases, which is where you would look for breaking changes.
Limitations and Failure Modes
The most obvious limitation is the Docker requirement. If you are in an environment where Docker is not allowed, or you need a lightweight CLI-only tool, this platform may be overkill. The README does not document a native pip installation, so you are tied to container orchestration. Another limitation is that the platform's breadth may come at the cost of depth. For example, the jailbreak evaluation covers specific attacks, but it is not clear how customizable the attack templates are. The README does not specify whether you can add your own jailbreak prompts or modify the scan profiles. Also, the vulnerability library, while large, is focused on AI components. If your stack uses non-AI dependencies, you will still need a general-purpose scanner. The documentation is also sparse on how to interpret scan results and what remediation steps are suggested.
Alternative Approaches
A direct alternative is to use dedicated tools for each scan type. For example, you could use OWASP's LLM Top 10 checklist and manual testing for jailbreak evaluation, or use a generic CVE scanner like Trivy for infrastructure vulnerabilities. The difference is that AI-Infra-Guard provides an integrated workflow and a unified web interface, whereas the alternative requires stitching together multiple tools yourself. Another alternative is to use commercial red teaming services or platforms that offer managed AI security assessments. The trade-off is that AI-Infra-Guard is open source and self-hosted, giving you control over data and scan frequency, but you are responsible for maintaining the platform and interpreting results. The README does not mention any built-in reporting or compliance features, so you would need to export or document findings manually.
Maintenance and License Considerations
The project is licensed under Apache-2.0, which is permissive and allows commercial use, modification, and redistribution, with the requirement to retain copyright notices. This is a favorable license for enterprise adoption. Maintenance cost is a real concern. The project pushes releases roughly every two to three weeks, which means you need to track updates to keep the vulnerability library current. The CVE rules are updated frequently, so if you deploy a static image and never update, you will miss new threats. The README does not provide a clear upgrade path, but the Docker Compose setup suggests you can pull new images and restart. The standalone CLIs are separate, so you may need to update each one independently. The project also has a user feedback survey and a community, which suggests a level of support, but there is no mention of an SLA or commercial support.
Editorial conclusion
Adopt AI-Infra-Guard if you are a security team running AI infrastructure and need a broad, integrated scanning suite covering OpenClaw, agents, MCP servers, skills, and LLM jailbreaks. It is also suitable if you want a web UI and a Docker-based deployment. Do not adopt it if you need a lightweight, single-purpose scanner or if your environment cannot run Docker. Before adopting, verify the exact capabilities of each CLI tool (agent-scan, mcp-scan, skill-scan) against your use case, check the latest release notes for breaking changes, and confirm the vulnerability library coverage matches your stack. The platform's strength is its breadth, not necessarily its depth in any single scan type.
Community notes