📖 文档 | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский

🚀 腾讯朱雀实验室 AI 红队测试平台

**A.I.G（AI-Infra-Guard）**整合了 ClawScan（OpenClaw 安全扫描）、Agent Scan、AI 基础设施漏洞扫描、MCP Server 与 Agent Skill 扫描以及越狱评测等能力，旨在为用户提供最全面、智能且易用的 AI 安全风险自检解决方案。

我们致力于将 A.I.G（AI-Infra-Guard）打造为行业领先的 AI 红队测试平台。更多 Star 将帮助该项目触达更广泛的受众，吸引更多开发者参与贡献，从而加速迭代和改进。你的 Star 对我们至关重要！

欢迎帮助我们改进 A.I.G！请花费 3 至 5 分钟填写用户反馈问卷。提供高质量反馈并留下有效电子邮箱的用户，将获得腾讯专属纪念礼品。

• 2026-08-17 · v4.5.2 — Skill-Scan：新增 .pyc 字节码绕过检测和字符集走私防护；MCP-Scan：动态模式下通过工具白名单防止 RCE；新增 SkillJack 研究项目；漏洞库扩展至 2,000 多条 CVE 规则。
• 2026-07-30 · v4.5.1 — Jailbreak Evaluation：新增 4 种多轮越狱攻击（Many-Shot、PAIR、GOAT、ActorAttack）；Agent-Scan：新增 5 项 OWASP Skill 与网页数据外泄检测能力（共 10 项 Skill）；MCP-Scan：新增 4 条安全规则。
• 2026-07-27 · v4.5.0 — AI 安全 Skill 市场上线（3 个官方 Skill）；前端全面开源；Skill 扫描引擎升级（9 个风险类别，SkillTrustBench 最高得分 0.9848）；Skill/MCP/Agent 扫描支持作为独立 CLI 使用；漏洞库扩展至 130 个组件、1,888 条规则。
• 2026-06-25 · v4.1.15 — MCP Scan：新增 3 条威胁检测规则（工具投毒、凭据外泄、命令注入）；新增 6 条 llama.cpp CVE 规则；model.token 现为可选项，未配置时可回退使用系统默认值。
• 2026-06-18 · v4.1.14 — Prompt Security：新增 9 个单轮越狱算子；新增用于全面 Agent 红队评估的 aig-agent-redteam Skill。

👉 更早版本 · 🛒 AI 安全 Skill 市场 · 🔍 skill-scan CLI · 🔍 mcp-scan CLI · 🔍 agent-scan CLI · 📊 SkillTrustBench

🐳 使用 Docker 部署 A.I.G

Docker	内存	磁盘空间
20.10 或更高版本	4GB+	10GB+

# 此方法会从 Docker Hub 拉取预构建镜像，以便快速启动
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# 对于 Docker Compose V2+，请将“docker-compose”替换为“docker compose”
docker-compose -f docker-compose.images.yml up -d

服务运行后，可通过以下地址访问 A.I.G Web 界面：http://localhost:8088

你也可以通过 aig-scanner Skill，直接从 OpenClaw 聊天中调用 A.I.G。

clawhub install aig-scanner

随后，将 AIG_BASE_URL 配置为指向正在运行的 A.I.G 服务。

更多详情请参阅 aig-scanner README。

更多安装选项

其他安装方式

方式 2：一键安装脚本（推荐）

# 此方法将自动安装 Docker，并通过一条命令启动 A.I.G
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash

方式 3：从源代码构建并运行

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# 此方法将从本地源代码构建 Docker 镜像并启动服务
# （对于 Docker Compose V2+，请将“docker-compose”替换为“docker compose”）
docker-compose up -d

注意：AI-Infra-Guard 项目定位为供企业或个人内部使用的 AI 红队测试平台。目前尚未提供认证机制，不应部署在公共网络上。

更多信息请参阅：https://tencent.github.io/AI-Infra-Guard/?menu=getting-started

⚡ 单条命令安装 aig-skill-scan

Agent Skill 安全审计工具，可轻松集成至企业 CI/CD 流水线。漏洞分类与 SkillTrustBench T01–T09 分类体系保持一致。了解更多 →

pip install aig-skill-scan

# 通过环境变量设置 API key
export LLM_API_KEY="your-api-key"

# 扫描本地 Skill 项目目录
aig-skill-scan --repo /path/to/your/skill \
           -m deepseek-v4-flash \
           --language en \
           -o result.json

模型与 API Relay 检查器

检查器前端单独部署。Docker 部署将保留检查器 API，包括 GET /api/v1/relay/models 和 POST /api/v1/relay/check/stream；API 文档位于 http://127.0.0.1:8088/api-checker/docs。如需从源代码运行检查器和统一 CLI：

python3 -m venv services/api_checker/.venv
services/api_checker/.venv/bin/pip install -r services/api_checker/requirements.txt
go build -o ai-infra-guard ./cmd/cli/main.go

export AIG_API_CHECKER_PYTHON="$PWD/services/api_checker/.venv/bin/python"
./ai-infra-guard api-checker list
./ai-infra-guard api-checker audit

有关嵌入 Agent 的运行时架构、HTTP API、配置和安全边界，请参阅 API Checker 集成指南。

🌟 试用在线 Pro 版本

体验具备高级功能和更好性能的 Pro 版本。Pro 版本需要邀请码，已提交 Issue、Pull Request 或讨论，或积极帮助社区成长的贡献者将被优先考虑。访问：https://aigsec.ai/。

🔍 aig-skill-scan 性能与覆盖范围

不同 LLM 下在 SkillTrustBench 上的性能：

| 模型 | F1 | 精确率 | 召回率 | FPR

---|---|---|---|---|--- 1 | Claude Opus 4.6 | 0.9848 | 0.9725 | 0.9974 | 0.0663 2 | GLM 5.1 | 0.9836 | 0.9701 | 0.9974 | 0.0723 3 | Gemini 3.5 Flash | 0.9792 | 0.9947 | 0.9641 | 0.0120 4 | Kimi 2.6 | 0.9780 | 0.9895 | 0.9667 | 0.0241 5 | DeepSeek v4 Flash | 0.9740 | 0.9868 | 0.9615 | 0.0301

覆盖 9 类 Skill 安全风险（SkillTrustBench T01–T09）：

层级	风险
A · 指令与记忆	T01 Skill 指令劫持、T02 记忆投毒
B · 代码执行	T03 远程载荷下载与执行、T04 内嵌恶意代码
C · 系统权限	T05 权限提升与未授权访问、T06 系统持久化
D · 工具链与依赖项	T07 工具劫持与伪造、T08 不安全依赖项
E · Skill 代码质量	T09 不安全编码实践

完整排行榜及详细信息请访问 SkillTrustBench。

🔬 安全扫描与评估

功能	更多信息
ClawScan（OpenClaw 安全扫描）	支持一键评估 OpenClaw 安全风险，可检测不安全配置、Skill 风险、CVE 漏洞和隐私泄露。
Agent Scan	这是一个独立的多 Agent 自动化扫描框架，旨在评估 AI Agent 工作流的安全性，并可无缝支持运行在 Dify、Coze 等不同平台上的 Agent。
MCP Server 与 Agent Skills 扫描	深度检测 14 大类安全风险，同时适用于 MCP Server 和 Agent Skill，并灵活支持从源代码及远程 URL 发起扫描。
AI 基础设施漏洞扫描	精准识别超过 100 个 AI 框架组件，覆盖 2,000 多个已知 CVE 漏洞。支持 Ollama、ComfyUI、vLLM、n8n、Triton Inference Server 等框架。
越狱评测	使用精心整理的数据集评估 Prompt 安全风险，通过多种攻击方法测试模型鲁棒性，并提供详细的跨模型对比能力。
模型与 API Relay 检查器	支持模型指纹识别、Claude Signature 验证、Relay 黑盒审计、PAMELA 和 Ventor QTest。
💎 附加优势

• 🖥️ 现代化 Web 界面：提供易用 UI，支持一键扫描和实时进度跟踪。
• 🔌 完整 API：提供完整接口文档与 Swagger 规范，便于集成。
• 🤖 面向 Agent：ClawHub 提供开箱即用的 Agent Skill——EdgeOne ClawScan、EdgeOne Skill Scanner 和 AIG Scanner——可将安全扫描无缝嵌入任意 AI Agent 工作流。
• 🌐 多语言：提供中英文界面及本地化文档。
• 🐳 跨平台：支持 Linux、macOS 和 Windows，并支持基于 Docker 的部署。
• 🆓 免费且开源：采用 Apache 2.0 许可证，完全免费。

[![插件管理](/Tencent/AI-Infra-Guard/raw/main

📖 Documentation | 🌐 🇨🇳 中文 · 🇯🇵 日本語 · 🇪🇸 Español · 🇩🇪 Deutsch · 🇫🇷 Français · 🇰🇷 한국어 · 🇧🇷 Português · 🇷🇺 Русский

🚀 AI Red Teaming Platform by Tencent Zhuque Lab

A.I.G (AI-Infra-Guard) integrates capabilities such as ClawScan(OpenClaw Security Scan), Agent Scan，AI infra vulnerability scan, MCP Server & Agent Skills scan, and Jailbreak Evaluation, aiming to provide users with the most comprehensive, intelligent, and user-friendly solution for AI security risk self-examination.

We are committed to making A.I.G(AI-Infra-Guard) the industry-leading AI red teaming platform. More stars help this project reach a wider audience, attracting more developers to contribute, which accelerates iteration and improvement. Your star is crucial to us!

Help us improve A.I.G! Please take 3-5 minutes to fill out our User Feedback Survey. Users who provide high-quality feedback and leave a valid email address will receive an exclusive Tencent souvenir gift.

• 2026-08-17 · v4.5.2 — Skill-Scan: .pyc bytecode bypass detection + charset smuggling defense; MCP-Scan: RCE prevention via tool whitelisting in dynamic mode; new SkillJack research project; vuln library expanded to 2000+ CVE rules.
• 2026-07-30 · v4.5.1 — Jailbreak Evaluation: 4 multi-turn jailbreak attacks (Many-Shot, PAIR, GOAT, ActorAttack); Agent-Scan: 5 new OWASP skills + web-exfiltration detection (10 skills total); MCP-Scan: 4 new security rules
• 2026-07-27 · v4.5.0 — AI Security Skill Market launched (3 official skills); frontend fully open-sourced; Skill scan engine upgraded (9 risk categories, SkillTrustBench top score 0.9848); Skill/MCP/Agent scan as standalone CLI; vuln library expanded to 130 components, 1888 rules
• 2026-06-25 · v4.1.15 — MCP Scan: 3 new threat detection rules (tool poisoning, credential exfiltration, command injection); 6 new llama.cpp CVE rules; model.token now optional with system default fallback.
• 2026-06-18 · v4.1.14 — Prompt Security: 9 new single-turn jailbreak operators; new aig-agent-redteam skill for comprehensive Agent red-team assessment.

👉 Earlier releases · 🛒 AI Security Skill Market · 🔍 skill-scan CLI · 🔍 mcp-scan CLI · 🔍 agent-scan CLI · 📊 SkillTrustBench

🐳 Deploy A.I.G with Docker

Docker	RAM	Disk Space
20.10 or higher	4GB+	10GB+

# This method pulls pre-built images from Docker Hub for a faster start
git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# For Docker Compose V2+, replace 'docker-compose' with 'docker compose'
docker-compose -f docker-compose.images.yml up -d

Once the service is running, you can access the A.I.G web interface at: http://localhost:8088

You can also call A.I.G directly from OpenClaw chat via the aig-scanner skill.

clawhub install aig-scanner

Then configure AIG_BASE_URL to point to your running A.I.G service.

For more details, see the aig-scanner README.

More installation options

Other Installation Methods

Method 2: One-Click Install Script （Recommended）

# This method will automatically install Docker and launch A.I.G with one command
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash

Method 3: Build and run from source

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
# This method builds a Docker image from local source code and starts the service
# (For Docker Compose V2+, replace 'docker-compose' with 'docker compose')
docker-compose up -d

Note: The AI-Infra-Guard project is positioned as an AI red teaming platform for internal use by enterprises or individuals. It currently lacks an authentication mechanism and should not be deployed on public networks.

For more information, see: https://tencent.github.io/AI-Infra-Guard/?menu=getting-started

⚡ Install aig-skill-scan with a Single Command

Agent Skill security audit tool, easily integrated into enterprise CI/CD pipelines. Vulnerability classification aligns with SkillTrustBench T01–T09 taxonomy. Learn more →

pip install aig-skill-scan

# Set API key via environment variable
export LLM_API_KEY="your-api-key"

# Scan a local Skill project directory
aig-skill-scan --repo /path/to/your/skill \
           -m deepseek-v4-flash \
           --language en \
           -o result.json

Model and API Relay Checker

The checker frontend is deployed separately. Docker deployment keeps the checker APIs available at GET /api/v1/relay/models and POST /api/v1/relay/check/stream; API documentation is available at http://127.0.0.1:8088/api-checker/docs. To run the checker and unified CLI from source:

python3 -m venv services/api_checker/.venv
services/api_checker/.venv/bin/pip install -r services/api_checker/requirements.txt
go build -o ai-infra-guard ./cmd/cli/main.go

export AIG_API_CHECKER_PYTHON="$PWD/services/api_checker/.venv/bin/python"
./ai-infra-guard api-checker list
./ai-infra-guard api-checker audit

See the API Checker integration guide for the Agent-embedded runtime architecture, HTTP API, configuration, and security boundaries.

🌟 Try the Online Pro Version

Experience the Pro version with advanced features and improved performance. The Pro version requires an invitation code and is prioritized for contributors who have submitted issues, pull requests, or discussions, or actively help grow the community. Visit: https://aigsec.ai/.

🔍 aig-skill-scan Performance & Coverage

Performance on SkillTrustBench with different LLMs:

| Model | F1 | Precision | Recall | FPR

---|---|---|---|---|---
1 | Claude Opus 4.6 | 0.9848 | 0.9725 | 0.9974 | 0.0663
2 | GLM 5.1 | 0.9836 | 0.9701 | 0.9974 | 0.0723
3 | Gemini 3.5 Flash | 0.9792 | 0.9947 | 0.9641 | 0.0120
4 | Kimi 2.6 | 0.9780 | 0.9895 | 0.9667 | 0.0241
5 | DeepSeek v4 Flash | 0.9740 | 0.9868 | 0.9615 | 0.0301

Covers 9 categories of Skill security risks (SkillTrustBench T01–T09):

Layer	Risks
A · Instruction & Memory	T01 Skill Instruction Hijacking, T02 Memory Poisoning
B · Code Execution	T03 Remote Payload Download & Execution, T04 Embedded Malicious Code
C · System Privilege	T05 Privilege Escalation & Unauthorized Access, T06 System Persistence
D · Toolchain & Dependencies	T07 Tool Hijacking & Spoofing, T08 Insecure Dependencies
E · Skill Code Quality	T09 Insecure Coding Practices

For full leaderboard and details, visit SkillTrustBench.

🔬 Security Scanning & Evaluation

Feature	More Info
ClawScan(OpenClaw Security Scan)	Supports one-click evaluation of OpenClaw security risks. It detects insecure configurations, Skill risks, CVE vulnerabilities, and privacy leakage.
Agent Scan	This is an independent, multi-agent automated scanning framework. It is designed to evaluate the security of AI agent workflows. It seamlessly supports agents running across various platforms, including Dify and Coze.
MCP Server & Agent Skills scan	It thoroughly detects 14 major categories of security risks. The detection applies to both MCP Servers and Agent Skills. It flexibly supports scanning from both source code and remote URLs.
AI infra vulnerability scan	This scanner precisely identifies over 100 AI framework components. It covers more than 2000 known CVE vulnerabilities. Supported frameworks include Ollama, ComfyUI, vLLM, n8n, Triton Inference Server and more.
Jailbreak Evaluation	It assesses prompt security risks using carefully curated datasets. The evaluation applies multiple attack methods to test robustness. It also provides detailed cross-model comparison capabilities.
Model and API Relay Checker	Model fingerprinting, Claude Signature verification, relay black-box auditing, PAMELA, and Ventor QTest.
💎 Additional Benefits

• 🖥️ Modern Web Interface : User-friendly UI with one-click scanning and real-time progress tracking
• 🔌 Complete API : Full interface documentation and Swagger specifications for easy integration
• 🤖 Agent-Ready : Plug-and-play agent skills on ClawHub — EdgeOne ClawScan, EdgeOne Skill Scanner, and AIG Scanner — seamlessly embed security scanning into any AI agent workflow
• 🌐 Multi-Language : Chinese and English interfaces with localized documentation
• 🐳 Cross-Platform : Linux, macOS, and Windows support with Docker-based deployment
• 🆓 Free & Open Source: Completely free under the Apache 2.0 license

After deployment, open http://localhost:8088 in your browser.

AI Infrastructure Vulnerability Scan

What to enter as the target URL / IP?

The target is the network address of a running AI service you want to scan - not a GitHub URL or source code path. A.I.G connects to the live service and fingerprints it for known CVE vulnerabilities.

Scenario	Example target
A locally running vLLM instance	http://127.0.0.1:8000
An Ollama server on your LAN	http://192.168.1.100:11434
A ComfyUI instance exposed internally	http://10.0.0.5:8188
Multiple hosts (one per line)	192.168.1.0/24 (CIDR), 10.0.0.1-10.0.0.20 (range)

Step-by-step: Scan a local vLLM instance

1. Start vLLM normally (e.g. python -m vllm.entrypoints.api_server --model meta-llama/...)
2. In the A.I.G web UI, click "AI基础设施安全扫描 / AI Infra Scan"
3. Enter http://127.0.0.1:8000 (or the IP/port where vLLM is listening)
4. Click Start Scan - A.I.G will fingerprint the service and match it against 2000+ known CVEs
5. View the report: component version, matched vulnerabilities, severity, and remediation links

💡 Tip : To scan the nightly build of vLLM specifically, just run that nightly build and point A.I.G at its address. The scanner detects the version automatically.

MCP Server & Agent Skills Scan

Enter either a remote URL (e.g. https://github.com/user/mcp-server) or upload a local source archive - no running instance required.

Configure the target LLM's API endpoint (base URL + API key) in Settings → Model Config , then select a dataset and start the evaluation.

---

Visit our online documentation: https://tencent.github.io/AI-Infra-Guard/

For more detailed FAQs and troubleshooting guides, visit our documentation.

A.I.G provides a comprehensive set of task creation APIs that support AI infra scan, MCP Server Scan, and Jailbreak Evaluation capabilities.

After the project is running, visit http://localhost:8088/docs/index.html to view the complete API documentation.

For detailed API usage instructions, parameter descriptions, and complete example code, please refer to the Complete API Documentation.

The extensible plugin framework​​ serves as A.I.G's architectural cornerstone, inviting community innovation through Plugin and Feature contributions.​

Plugin Contribution Rules

1. Fingerprint Rules : Add new YAML fingerprint files to the data/fingerprints/ directory.
2. Vulnerability Rules : Add new vulnerability scan rules to the data/vuln/ directory.
3. MCP Plugins : Add new MCP security scan rules to the data/mcp/ directory.
4. Jailbreak Evaluation Datasets : Add new Jailbreak evaluation datasets to the data/eval directory.

Please refer to the existing rule formats, create new files, and submit them via a Pull Request.

This project is led and developed by Tencent Zhuque Lab , part of the Tencent Security Platform Department. Founded in 2019, Tencent Zhuque Lab is a top-tier security research lab focused on real-world offensive and defensive research and frontier technology in the AI security space, covering large model security, AI agent security, AI-empowered security, and AI-generated content detection.

The team has helped major vendors such as NVIDIA, Google, and Microsoft , as well as open-source communities like OpenClaw, Linux, and Hugging Face , fix a large number of high-risk vulnerabilities, and has been publicly acknowledged by them.

We have released open-source AI security products including the AI Red Team Security Testing Platform A.I.G (AI-Infra-Guard) and the Zhuque AI Detection Assistant. Our research has been widely published at top international security and AI conferences such as Black Hat, DEF CON, ICLR, CVPR, NeurIPS, and ACL , and we have authored the book "AI Security: Technology and Practice".

👥 Core Members & Contributions

Role	Member	Contribution
Head of Tencent Security Platform Department	Yong Yang	Initiated A.I.G and proposed automated assessment of AI agent loss-of-control risks, guiding the platform's expansion from AI infrastructure vulnerability scanning to agent execution risk, tool misuse, and permission-boundary evaluation.
Head of Tencent Zhuque Lab	Xing Zheng	Proposed the automated vulnerability-update and benchmark-alignment mechanism, helping AI Infra fingerprints, CVE/GHSA rules, and benchmarks iterate continuously.
Project Lead	Nicky	Frontier security research, product planning, technical-route decisions, internal and external collaboration, and communications.
Technical Lead	Python	Overall architecture design, core module development, and version iteration.
Core Contributor	Zona	Frontend interaction, product experience, community operations, and user-feedback loop.
Core Contributor	Fyoung	AI Infra vulnerability component fingerprint updates and Benchmark system construction.
Core Contributor	Xiangfan	Security capability development for Skill risks and agent loss-of-control scenarios.
Core Contributor	Elwood	Enhancing Agent security scanning capabilities and updating technical reports.
Core Contributor	Robert	LLM safety assessment and jailbreak-evaluation strategy operations.
Core Contributor	Zoe	LLM safety assessment, jailbreak evaluation, and model-integration module development.
Contributor	Ronin	Participated in AI agent security scanning development.
Contributor	Rsin	Participated in community operations and campaign communications.

🎓 Academic Collaborations

We thank our academic partners for their research contributions and technical support.

👥 Gratitude to Contributing Developers

Thanks to all the developers who have contributed to the A.I.G project.

🤝 Appreciation for Our Users

Thanks to the users from the following organizations and teams for using A.I.G and their valuable feedback.

💬 Join the Community

📱 Discussion Community

For collaboration inquiries or feedback, please contact us at: zhuque@tencent.com

🔗 Recommended Security Tools

If you are interested in code security, check out A.S.E (AICGSecEval), the industry's first repository-level AI-generated code security evaluation framework open-sourced by the Tencent Wukong Code Security Team.

If you use A.I.G in your research, please cite:

@misc{Tencent_AI-Infra-Guard_2025,
  author={{Tencent Zhuque Lab}},
  title={{AI-Infra-Guard: A Comprehensive, Intelligent, and Easy-to-Use AI Red Teaming Platform}},
  year={2025},
  howpublished={GitHub repository},
  url={https://github.com/Tencent/AI-Infra-Guard}
}

📂 Research Projects — Open-source code, datasets, and artifacts from our research work.

1. "Securing the AI Agent: A Unified Framework for Multi-Layer Agent Red Teaming" — A comprehensive framework for securing AI agent systems through multi-layer red teaming across infrastructure, supply chain, runtime interaction, and deployment surfaces. [arXiv] [pdf]

2. "AI-Infra-Guard: An AI Red Teaming Platform" — Black Hat Europe 2025 Arsenal presentation showcasing A.I.G's capabilities and real-world use cases. [pdf]

3. "MCP Unchained: Compromising The AI Agent Ecosystem Via Its Universal Connector" — Black Hat Europe 2025 talk revealing security risks in the MCP protocol within the AI agent ecosystem. [pdf]

Thanks to the research teams who have cited A.I.G in their academic work (19 papers):

📄 View all 19 cited papers

1. Chenning Li, Pan Hu, Justin Xu et al. "ADR: An Agentic Detection System for Enterprise Agentic AI Security." arXiv preprint arXiv:2605.17380 (2026). [pdf]

2. Zhaojiacheng Zhou. "Proteus: A Self-Evolving Red Team for Agent Skill Ecosystems." arXiv preprint arXiv:2605.11891 (2026). [pdf]

3. Hengkai Ye, Zhechang Zhang, Jinyuan Jia et al. "TRUSTDESC: Preventing Tool Poisoning in LLM Applications via Trusted Description Generation." arXiv preprint arXiv:2604.07536 (2026). [pdf]

4. Zenghao Duan, Yuxin Tian, Zhiyi Yin et al. "SkillAttack: Automated Red Teaming of Agent Skills through Attack Path Refinement." arXiv preprint arXiv:2604.04989 (2026). [pdf]

5. Yiheng Huang, Zhijia Zhao, Bihuan Chen et al. "From Component Manipulation to System Compromise: Understanding and Detecting Malicious MCP Servers." arXiv preprint arXiv:2604.01905 (2026). [pdf]

6. Yi Ting Shen, Kentaroh Toyoda, Alex Leung. "MCP-38: A Comprehensive Threat Taxonomy for Model Context Protocol Systems (v1.0)." arXiv preprint arXiv:2603.18063 (2026). [pdf]

7. Yuepeng Hu, Yuqi Jia, Mengyuan Li et al. "MalTool: Malicious Tool Attacks on LLM Agents." arXiv preprint arXiv:2602.12194 (2026). [pdf]

8. Naen Xu, Jinghuai Zhang, Ping He et al. "FraudShield: Knowledge Graph Empowered Defense for LLMs against Fraud Attacks." arXiv preprint arXiv:2601.22485v1 (2026). [pdf]

9. Ruiqi Li, Zhiqiang Wang, Yunhao Yao et al. "MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP." arXiv preprint arXiv:2601.07395v1 (2026). [pdf]

10. Jingxiao Yang, Ping He, Tianyu Du et al. "HogVul: Black-box Adversarial Code Generation Framework Against LM-based Vulnerability Detectors." arXiv preprint arXiv:2601.05587v1 (2026). [pdf]

11. Teofil Bodea, Masanori Misono, Julian Pritzi et al. "Trusted AI Agents in the Cloud." arXiv preprint arXiv:2512.05951v1 (2025). [pdf]

12. Yunyi Zhang, Shibo Cui, Baojun Liu et al. "Beyond Jailbreak: Unveiling Risks in LLM Applications Arising from Blurred Capability Boundaries." arXiv preprint arXiv:2511.17874v2 (2025). [pdf]

13. Bin Wang, Zexin Liu, Hao Yu et al. "MCPGuard: Automatically Detecting Vulnerabilities in MCP Servers." arXiv preprint arXiv:2510.23673v1 (2025). [pdf]

14. Weibo Zhao, Jiahao Liu, Bonan Ruan et al. "When MCP Servers Attack: Taxonomy, Feasibility, and Mitigation." arXiv preprint arXiv:2509.24272v1 (2025). [pdf]

15. Ping He, Changjiang Li, et al. "Automatic Red Teaming LLM-based Agents with Model Context Protocol Tools." arXiv preprint arXiv:2509.21011 (2025). [pdf]

16. Christian Coleman. "Behavioral Detection Methods for Automated MCP Server Vulnerability Assessment." (2025). [pdf]

17. Yixuan Yang, Daoyuan Wu, Yufan Chen. "MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols." arXiv preprint arXiv:2508.13220 (2025). [pdf]

18. Yongjian Guo, Puzhuo Liu, et al. "Systematic Analysis of MCP Security." arXiv preprint arXiv:2508.12538 (2025). [pdf]

19. Zexin Wang, Jingjing Li, et al. "A Survey on AgentOps: Categorization, Challenges, and Future Directions." arXiv preprint arXiv:2508.02121 (2025). [pdf]

📧 If you have used A.I.G in your research or product, or if we have inadvertently missed your publication, we would love to hear from you! Contact us here.

This project is open-sourced under the Apache License 2.0. We warmly welcome and encourage community contributions, integrations, and derivative works, subject to the following attribution requirements:

1. Retain notices : You must retain the LICENSE and NOTICE files from the original project in any distribution.
2. Product attribution : If you integrate AI-Infra-Guard's core code, components, or scanning engine into your open-source project, commercial product, or internal platform, you must clearly state the following in your product documentation, usage guide, or UI "About" page :

"This project integrates AI-Infra-Guard, open-sourced by Tencent Zhuque Lab."

3. Academic & article citation: If you use this tool in vulnerability analysis reports, security research articles, or academic papers, please explicitly mention "Tencent Zhuque Lab AI-Infra-Guard" and include a link to the repository.

Repackaging this project as an original product without disclosing its origin is strictly prohibited.