Inspecting MCP Servers and Agent Tools with AI-Infra-Guard

As AI agent architectures shift toward modular Model Context Protocol (MCP) servers and autonomous tool execution, the attack surface expands beyond single-prompt injections. Multi-agent systems execute tool calls, fetch remote code, and persist state, creating critical vulnerability vectors such as instruction hijacking, memory poisoning, and tool spoofing. Tencent's AI-Infra-Guard (A.I.G) addresses these challenges by combining static bytecode analysis, dynamic tool execution whitelisting, and infrastructure fingerprinting. Developed by Tencent Zhuque Lab, the platform establishes a comprehensive red-teaming pipeline tailored to agent workflows and underlying model hosting platforms.

Static Inspection Mechanics in aig-skill-scan and SkillTrustBench Taxonomy

Static security analysis for agent skills requires detecting disguised payloads without triggering malicious execution. The aig-skill-scan tool evaluates agent skills across nine distinct risk categories defined by the SkillTrustBench taxonomy (T01 through T09). These categories range from instruction hijacking (T01) and memory poisoning (T02) to remote payload download (T03), embedded malicious code (T04), system persistence (T06), and insecure dependencies (T08).

Recent releases introduced detection for .pyc bytecode bypass attempts and charset smuggling. When paired with advanced LLMs, aig-skill-scan yields high precision; for instance, configured with Claude Opus 4.6, it achieves an F1 score of 0.9848 and a recall of 0.9974 on SkillTrustBench benchmarks.

Dynamic MCP Server Verification and RCE Containment

Static code scanning alone is insufficient for MCP servers that dynamically generate function definitions or establish remote socket connections. A.I.G's mcp-scan module performs dynamic security checks to detect threats such as tool poisoning, credential exfiltration, and command injection.

To eliminate the risk of Remote Code Execution (RCE) during dynamic verification, A.I.G enforces strict tool whitelisting in dynamic mode. This mechanism ensures that synthesized tool calls operate within restricted sandbox boundaries, enabling the scanner to evaluate function return handling and payload leakage safely without executing unvetted code directly on host machines.

Active Fingerprinting for AI Infrastructure CVE Detection

At the infrastructure level, exposed inference endpoints (e.g., vLLM, Ollama, ComfyUI, Triton Inference Server) pose immediate risks to host networks. A.I.G's AI Infra scanner operates by inspecting live network addresses rather than static source repositories.

The scanner connects to operational targets—such as local runtime endpoints or enterprise LAN hosts—identifying over 100 AI framework components and matching them against a vulnerability library containing over 2,000 CVE rules. This active component fingerprinting flags actionable vulnerabilities, component version mismatches, and remediation paths without requiring local source access.

Executing Skill Audits and Service Deployment

Engineers can integrate AI-Infra-Guard tools directly into local environments or enterprise CI/CD pipelines using standalone CLI tools or Docker containers. For skill auditing, aig-skill-scan can be installed via Python's package manager:

pip install aig-skill-scan
export LLM_API_KEY="your-api-key"

aig-skill-scan --repo /path/to/your/skill \
           -m deepseek-v4-flash \
           --language en \
           -o result.json

For multi-capability deployments, A.I.G provides Docker image configurations requiring Docker 20.10 or higher, at least 4GB of RAM, and 10GB of disk space:

git clone https://github.com/Tencent/AI-Infra-Guard.git
cd AI-Infra-Guard
docker-compose -f docker-compose.images.yml up -d

Once initialized, the web console becomes accessible locally at http://localhost:8088.

Architectural Constraints and Deployment Security Boundaries

While AI-Infra-Guard offers extensive red-teaming capabilities, operators must account for critical security boundaries noted in the project documentation. The platform currently lacks built-in authentication mechanisms and is engineered strictly for internal evaluation or isolated sandbox environments. Exposing A.I.G directly to public network routes poses severe security risks.

Furthermore, when conducting dynamic scans on third-party MCP endpoints or dynamic tools, network isolation and outbound egress filtering must be maintained to prevent secondary exfiltration vectors during active evaluation.

Sources

• Tencent/AI-Infra-Guard Repository
• AI-Infra-Guard Documentation & README