Is AI-Infra-Guard — Scan MCP Servers and AI Stacks free to use?

Yes. AI-Infra-Guard — Scan MCP Servers and AI Stacks is freely available on TokRepo. Check the Source & Thanks section on the asset page for the specific open-source license.

How do I install AI-Infra-Guard — Scan MCP Servers and AI Stacks?

Visit the asset page on TokRepo and click "Copy for agent" to get the installation instructions. Most assets can be installed with a single command.

SkillsMay 12, 2026·2 min read

AI-Infra-Guard — Scan MCP Servers and AI Stacks

AI-Infra-Guard runs a web UI + scanners that assess MCP servers, agent skills, and AI infra components for security risks, CVEs, and jailbreak exposure.

Agent Toolkit · Community

Agent ready

Review-first install path

This asset needs a review step. The copied prompt tells the agent to dry-run, show the writes, then proceed only after confirmation.

Needs Confirmation · 64/100Policy: confirm

Agent surface

Any MCP/CLI agent

Kind

Skill

Install

Single

Trust

Trust: Established

Entrypoint

Asset

Review-first command

npx -y tokrepo@latest install 9f00bc44-9576-4392-a4d5-1b6ba3fdbf31 --target codex

Dry-run first, confirm the writes, then run this command.

Intro

AI-Infra-Guard runs a web UI + scanners that assess MCP servers, agent skills, and AI infra components for security risks, CVEs, and jailbreak exposure.

Best for: security reviews for AI agent stacks: MCP servers, skills, and local AI services
Works with: Docker 20.10+, Docker Compose, local or staged environments (no public exposure recommended)
Setup time: 30–90 minutes

Practical Notes

Data point: README lists baseline resources: 4GB+ RAM and 10GB+ disk.
Data point: the default UI address is http://localhost:8088.

Pattern: scan before you connect

For MCP servers and agent skills, scan before you wire them into your agent runtime:

remote URL scan for third-party repos,
source scan for internal forks,
and keep an allowlist of approved servers.

Deployment note

The README notes the project lacks an authentication mechanism and should not be deployed on public networks. Use a local/staging environment and restrict access.

FAQ

Q: Is it open-source? A: Yes. The repo is Apache-2.0 licensed.

Q: Can it scan MCP servers? A: Yes. The README lists MCP server & agent skills scanning capabilities.

Q: Is it safe to expose publicly? A: The README warns it lacks auth; keep it off public networks.

🙏

Source & Thanks

Source: https://github.com/Tencent/AI-Infra-Guard > License: Apache-2.0 > GitHub stars: 3,657 · forks: 363

Discussion

No comments yet. Be the first to share your thoughts.

Related Assets

Aguara — Security Scanner for MCP & Skills

Offline scanner for agent skills and MCP servers. Detect prompt injection and exfiltration; outputs JSON/SARIF and supports CI thresholds.

SkillsCLI Tools

Script Depot

langchain-mcp-adapters — MCP Tools in LangGraph

Use MCP servers inside LangChain/LangGraph by loading MCP tools into agents via MultiServerMCPClient, without writing one-off wrappers per server.

Skills

Agent Toolkit

Agentic Security — LLM/MCP Red-Team Scanner

Agentic Security is a Python tool to probe LLM apps with attack prompts and run scans; it also ships an MCP server entrypoint for tool-based workflows.

Skills

Agent Toolkit

Tracecat — Agentic Security Automation

Tracecat is an open-source security automation platform for teams and AI agents, built on Temporal with sandboxed tool runs and a self-hostable UI.

Skills

Agent Toolkit

◈Home 🔍Search 👤Me