AI-Infra-Guard

Summary

AI-Infra-Guard is an open-source AI red teaming tool, run from the command line, that scans AI infrastructure for CVE vulnerabilities, MCP server risks, agent skill security issues, and LLM jailbreak robustness. It targets AI security teams and red teamers rather than general application developers, covering fingerprinting of components like Qdrant, Chroma, and Weaviate, detection rules for MCP threats such as tool poisoning and command injection, and jailbreak methods including Many-Shot, PAIR, GOAT, and ActorAttack. Its Agent-Scan and MCP-Scan modules run standalone or integrated into the wider platform, and Skill-Scan audits agent skills with SARIF and Markdown reporting. Backed by 41 contributors and over 1,300 commits in the past year, with a release 22 days ago, it is under active development.

A full-stack AI Red Teaming platform securing AI ecosystems via Agent Scan, Skills Scan, MCP scan, AI Infra scan and LLM jailbreak evaluation.

Command line

Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.

Release history

1. v4.6.0 Aug 26, 2026 · issue 009

   AI-Infra-Guard v4.6.0 adds an API security audit module, LLM API poisoning detection, and a refactored agent red-team mutation engine.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.6.0 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.6.0

   • ›Adds aig-agent-redteam v5.0.0 mutation engine with mutation-attack (merging the former workflow-attack into it) for agent red-teaming.
   • ›New API security audit module (API Checker) with web proxy integration, unified CLI command, and detection algorithms.
   • ›New detection for LLM API poisoning attacks.
   • ›Adds strict YAML validation enforcing required id and severity fields in vulnerability rules.
   • ›New DeepSeek Harness prompt injection assessment research.
   └──▷ BREAKING ON UPGRADE

   • !In aig-agent-redteam, workflow-attack is merged into mutation-attack; any invocation or automation referencing workflow-attack must be updated to use mutation-attack.
2. v4.6.0 Aug 26, 2026 · issue 002

   AI-Infra-Guard v4.6.0 adds an API security audit module, LLM API poisoning detection, and a refactored agent red-team mutation engine.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.6.0 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.6.0

   • ›Adds aig-agent-redteam v5.0.0 mutation engine with mutation-attack (merging the former workflow-attack into it) for agent red-teaming.
   • ›New API security audit module (API Checker) with web proxy integration, unified CLI command, and detection algorithms.
   • ›New detection for LLM API poisoning attacks.
   • ›Adds strict YAML validation enforcing required id and severity fields in vulnerability rules.
   • ›New DeepSeek Harness prompt injection assessment research.
   └──▷ BREAKING ON UPGRADE

   • !In aig-agent-redteam, workflow-attack is merged into mutation-attack; any invocation or automation referencing workflow-attack must be updated to use mutation-attack.
3. v4.5.2 Aug 17, 2026 · issue 005

   AI-Infra-Guard v4.5.2 adds SkillJack research, GET-only fingerprints for Qdrant/Chroma/Weaviate, and expands the vuln library to 2000+ CVE rules.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.2 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.2

   • ›Adds the SkillJack research project, a new AI red-teaming research capability within the platform.
4. v4.5.2 Aug 17, 2026 · issue 002

   AI-Infra-Guard v4.5.2 adds SkillJack research, GET-only fingerprints for Qdrant/Chroma/Weaviate, and expands the vuln library to 2000+ CVE rules.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.2 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.2

   • ›Adds the SkillJack research project, a new AI red-teaming research capability within the platform.
5. v4.5.1 Jul 30, 2026 · issue 005

   AI-Infra-Guard v4.5.1 adds 4 multi-turn jailbreak attacks, 6 new Agent-Scan OWASP skills, and 4 new MCP security detection rules.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.1 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.1

   • ›Adds Many-Shot, PAIR, GOAT, and ActorAttack multi-turn jailbreak attack methods to PromptSecurity evaluation.
   • ›Adds 5 new OWASP detection skills to Agent-Scan: agentic-supply-chain, cascading-failure, human-agent-trust, inter-agent-comm, and unexpected-code-execution.
   • ›Adds web-exfiltration-detection skill to Agent-Scan, bringing the total to 10 detection skills.
   • ›Adds 4 new MCP security detection rules to MCP-Scan covering hardcoded secrets and insecure deserialization.
   • ›Updates AIG detection rules library with the 2026-07-24 rule set.
6. v4.5.1 Jul 30, 2026 · issue 002

   AI-Infra-Guard v4.5.1 adds 4 multi-turn jailbreak attacks, 6 new Agent-Scan OWASP skills, and 4 new MCP security detection rules.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.1 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.1

   • ›Adds Many-Shot, PAIR, GOAT, and ActorAttack multi-turn jailbreak attack methods to PromptSecurity evaluation.
   • ›Adds 5 new OWASP detection skills to Agent-Scan: agentic-supply-chain, cascading-failure, human-agent-trust, inter-agent-comm, and unexpected-code-execution.
   • ›Adds web-exfiltration-detection skill to Agent-Scan, bringing the total to 10 detection skills.
   • ›Adds 4 new MCP security detection rules to MCP-Scan covering hardcoded secrets and insecure deserialization.
   • ›Updates AIG detection rules library with the 2026-07-24 rule set.
7. v4.5.0 Jul 27, 2026 · issue 005

   AI-Infra-Guard v4.5.0 open-sources its frontend, ships standalone CLI modules for Agent/MCP/Skill scanning, and adds SARIF 2.1.0 output for skill audits.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.0 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.0

   • ›Repackages Skill-Scan as a standalone PyPI package aig-skill-scan for easy CI/CD integration.
   • ›Modularizes Agent-Scan as a standalone CLI with AIG integration support.
   • ›Modularizes MCP-Scan with dual-mode support (CLI + AIG Web) and adds a standalone mcp-scan-lite module.
   • ›Adds 4 new detection skills for AI agent security to Agent-Scan.
   • ›Adds 2 new MCP security detection rules and ATR-derived MCP detection rules covering additional attack surfaces.
   +4 moreshow less

   • ›Adds Skill-Scan Agent Skill security auditing support with 9 risk categories, achieving a SkillTrustBench top score of 0.9848.
   • ›Open-sources the full frontend code with open-source environment configuration.
   • ›Adds an agentic-tool-misuse evaluation dataset to the Eval module.
   • ›Expands the vulnerability library to 130 AI components and 1888 rules with new AI component fingerprints.
   └──▷ BREAKING ON UPGRADE

   • !Skill-Scan Stage 2 Code Audit now outputs a Markdown report instead of XML.
8. v4.5.0 Jul 27, 2026 · issue 002

   AI-Infra-Guard v4.5.0 open-sources its frontend, ships standalone CLI modules for Agent/MCP/Skill scanning, and adds SARIF 2.1.0 output for skill audits.

   └──▷ GET THIS VERSION
   copy

   $ git clone --branch v4.5.0 https://github.com/Tencent/AI-Infra-Guard.git
   # already have the repo? check out this version:
   $ git checkout v4.5.0

   • ›Repackages Skill-Scan as a standalone PyPI package aig-skill-scan for easy CI/CD integration.
   • ›Modularizes Agent-Scan as a standalone CLI with AIG integration support.
   • ›Modularizes MCP-Scan with dual-mode support (CLI + AIG Web) and adds a standalone mcp-scan-lite module.
   • ›Adds 4 new detection skills for AI agent security to Agent-Scan.
   • ›Adds 2 new MCP security detection rules and ATR-derived MCP detection rules covering additional attack surfaces.
   +4 moreshow less

   • ›Adds Skill-Scan Agent Skill security auditing support with 9 risk categories, achieving a SkillTrustBench top score of 0.9848.
   • ›Open-sources the full frontend code with open-source environment configuration.
   • ›Adds an agentic-tool-misuse evaluation dataset to the Eval module.
   • ›Expands the vulnerability library to 130 AI components and 1888 rules with new AI component fingerprints.
   └──▷ BREAKING ON UPGRADE

   • !Skill-Scan Stage 2 Code Audit now outputs a Markdown report instead of XML.