Six security jobs share one internal web app
AI-Infra-Guard groups 6 jobs in one project: infrastructure fingerprinting, OpenClaw checks, agent exercises, MCP and skill inspection, jailbreak evaluation, and model API relay auditing. The infrastructure scanner connects to a running service such as vLLM, Ollama, or ComfyUI and matches the detected component against vulnerability rules. MCP servers and skills can instead be supplied as a remote repository or uploaded source archive.
That breadth is useful for a security team whose AI estate has spread beyond prompts. The same interface can examine a service version, inspect tool code, and send adversarial cases to a configured model. The README says the rule library covers more than 100 AI components and 2,000 CVEs. Those are Tencent's coverage figures. A match still needs confirmation against the deployed package and any vendor patches.
What happened when we ran it
Our sandbox cloned commit 4908db1, a 138.2 MB checkout containing 5,867 files and about 139,854 lines of source. Installation succeeded in 30 seconds with 301 packages. The build also succeeded, taking 69 seconds. The repository had 3 CI workflow files, a Dockerfile, and a Compose file, but no separate tests directory.
The test command ended with exit code 1 after 147 seconds. Go reported 9 passed packages and 7 failed packages out of 16. In the final failure shown to us, TestReadSmallFile attempted to read /mcp-server/src/mcp_server/app_config.py and received a file-not-found error. The log establishes the missing path and nothing more, so we cannot say whether the fault sits in packaging, the test fixture, or our container layout.
A successful 69-second build means the source compiled in the stated Debian sandbox. The 7 failed packages mean the full check did not clear the same environment. Before trusting scanner output, rerun the tests in the deployment image and inspect every failure. A security tool deserves a stricter acceptance bar because a silent miss can look exactly like a clean target.
The 4 GB quick start leaves security work for the operator
The main quick start asks for Docker 20.10 or newer, at least 4 GB of RAM, and 10 GB of disk. It clones the repository, starts prebuilt images with Docker Compose, and exposes the interface on port 8088. Building from source is another Compose command. A separate aig-skill-scan Python package is available when the web platform is unnecessary.
Credentials depend on the job. Jailbreak evaluation needs a target model base URL and API key. The skill scanner also expects an LLM key and model choice. Infrastructure scanning needs access to a live, authorized service address, while MCP and skill inspection can accept source. Uploaded code, model credentials, scan reports, and logs should all be treated as sensitive assessment data.
Port 8088 has no authentication and the agent is privileged
AI-Infra-Guard's README explicitly says the platform lacks authentication and should not be deployed on public networks. The current image Compose file maps 8088:8088, so access control is the operator's job. Put the app behind a restricted internal route or bind it locally, and keep the scanner away from production control planes unless the test has written authorization.
The agent container receives SYS_ADMIN, and its seccomp profile is set to unconfined. Both web and agent images use the moving latest tag. Those choices make a disposable VM or dedicated worker a better home than a shared application host. Pin a tested release, inspect the Compose changes on upgrade, limit target reach, and destroy transient scanning environments after sensitive work finishes.
Version 4.6.0 fixes bypasses, while interrupted runs remain open
Release v4.6.0 shipped on August 26, 2026, with an API checker, LLM API poisoning detection, stricter rule validation, MCP SDK fixes, and Docker compatibility work. It also includes the earlier response to issue 531, where compiled Python bytecode could be hidden from the skill scanner and receive a safe result. The issue is now closed, but it is a useful regression case to keep locally.
Issue 537 was still open on August 26 and describes jailbreak runs that cannot recover after interruption. That matters when a campaign combines many methods and samples. Start with a small set, confirm that results and provider usage are recorded, then increase the matrix. A scanning dashboard can make a large job easy to launch without making it cheap or recoverable.
Same-day code and issue activity support a trial, not blind trust
GitHub recorded a push on August 26, 2026, the day v4.6.0 was released. The repository had 5,984 stars and 28 open issues and pull requests combined when fetched. Several pull requests were updated that day, including MCP error reporting, Docker work, and API checker changes. That is active maintenance, though the combined count should not be read as 28 bugs.
AI-Infra-Guard earns a trial when its 6 jobs would replace several disconnected checks. Our failed 147-second test run keeps the recommendation qualified, as do the privileged agent and unauthenticated interface. Run it inside a controlled lab, preserve a few known-bad fixtures, and have a person reproduce high-impact findings. If the task is only prompt red teaming or model-file inspection, Promptfoo, Garak, or ModelScan asks for less operational trust.