In 2026 the Model Context Protocol became the default way agents reach tools and data — and that reach is the attack surface. Tool descriptions can hide instructions, a trusted server can change behavior overnight, and a skill you installed months ago can exfiltrate keys.
In this deep-dive I show you how to audit all of it with AI-Infra-Guard, the open-source red-teaming platform from Tencent Zhuque Lab: MCP scan, Agent Skills audit, infra CVE scan and jailbreak evaluation — before your agent ships to prod.
1. The Problem: Your Agent’s Tools Are the Attack Surface
A year ago we worried about prompt injection in chat. Now the model chooses and calls tools, runs commands and touches business systems — so every tool description, schema, output and credential sits inside the trust boundary. Microsoft’s June 2026 guidance says it plainly: the moment a model can act, it stops being a Q&A box and becomes software that acts.
50,000+ skills scanned
Tencent Zhuque Lab audited 50,000+ Agent Skills from ClawHub with A.I.G and found stealthy attack vectors beyond the known malicious samples.
4,000+ MCP risks found
Large-scale scans of MCP marketplaces uncovered 4,000+ novel AI security risks and code flaws, distilled into a Top 10 MCP vulnerabilities list.
Miasma worm (June 2026)
A supply-chain attack planted agent configs across 73 repos including Azure/durabletask — proof that skills and MCP configs are now malware vectors.
Real CVEs, real RCE
CVE-2025-49596 (MCP Inspector RCE, CVSS 9.4) and CVE-2025-54136 (Cursor MCPoison) show MCP tooling flaws become remote code execution.
The Most Common Mistake
Reviewing the model but never the tools. Teams red-team prompts while blindly installing MCP servers and skills with full filesystem, network and credential access. Attackers know it: tool poisoning (OWASP MCP03) hides malicious instructions inside innocent-looking tool descriptions.
The fix is boring and effective: scan every MCP server and skill the same way you scan dependencies — before prod, on every update, and gated in CI. That is exactly what AI-Infra-Guard automates.
2. Minimal Concepts: What A.I.G Actually Checks
AI-Infra-Guard (6k+ stars, Apache-2.0, v4.1.13 as of June 2026) is a full-stack red-teaming platform with five scanners. You only need to understand four ideas to use it well:
MCP01–MCP10 + 3
The MCP scanner classifies findings into 10 risk categories — secret exposure, scope creep, tool poisoning, supply chain, command injection, prompt injection, broken auth, missing audit, shadow servers, context over-sharing — plus Name Confusion, Rug Pull and Tool Shadowing.
Single-stage vs three-stage
CLI mode runs a fast single-stage code audit (~3x faster, SARIF output for CI). The Web UI runs the full pipeline: Info Collection → Code Audit → Vulnerability Review, with real-time progress.
SARIF + security score
CLI output is SARIF 2.1.0 JSON, consumable by GitHub Code Scanning. Each project gets a score: 100 minus deductions (Critical −100, High −40, Medium −25, Low −10).
SkillTrustBench T01–T09
Skill verdicts follow a fixed taxonomy with three outcomes: malicious (clear attack intent), suspicious (vulnerable but no clear intent) or normal. No vague “maybe risky” labels.
Jailbreak eval + infra scan
Beyond tools, A.I.G evaluates prompt robustness with curated datasets (AdvBench, CNSafe, SafeBench) and fingerprints 100+ AI infra components against 2,000+ CVEs (Ollama, vLLM, ComfyUI, Triton…).
Scanner safety boundaries
The auditor only reads inside the target directory, never executes the skill, whitelists tool calls and truncates large outputs — so the scan itself cannot become the exploit.
When to use each scanner
MCP Scan for every server you install or ship. Skills scan (aig-skill-scan) for every skill/agent plugin. Jailbreak eval when you change system prompts or models. Infra scan when you self-host Ollama, vLLM or ComfyUI. Agent Scan for full Dify/Coze-style workflows.
3. Tutorial: Scan an MCP Server in 5 Steps
You need Docker for the full platform, or just Python 3.10+ and an LLM API key for the standalone scanners (any OpenRouter-compatible key works). I will go from zero to a CI gate.
Step 1 — Launch the platform (one command)
The fastest path is the one-click installer, or compose if you prefer. Important: A.I.G has no authentication — run it on localhost only, never on a public host.
curl https://raw.githubusercontent.com/Tencent/AI-Infra-Guard/refs/heads/main/docker.sh | bash
# or manually:
# git clone https://github.com/Tencent/AI-Infra-Guard.git
# cd AI-Infra-Guard && docker-compose up -dStep 2 — Static MCP scan from the CLI
Point mcp-scan at any server source. It pre-scans 14 high-risk regex patterns (curl|bash, cloud metadata, credential theft), then an agent does the deep audit. Save SARIF for later CI use.
cd AI-Infra-Guard/mcp-scan
uv sync # or: pip install -r requirements.txt
export LLM_API_KEY="sk-or-v1-xxxxx"
python main.py --repo ./my-mcp-server -o result.sarif.jsonStep 3 — Audit Agent Skills the same way
Skills get their own scanner with the T01–T09 taxonomy. Install from PyPI and point it at the skill directory (the one containing SKILL.md) — it also checks description-vs-code consistency.
pip install aig-skill-scan
export LLM_API_KEY="sk-or-v1-xxxxx"
aig-skill-scan --repo ./my-skill --language en -o skill-report.jsonStep 4 — Dynamic scan + jailbreak eval in the Web UI
Open http://127.0.0.1:8088, pick MCP Scan, paste a GitHub URL or upload a zip — or scan a running server for tool-poisoning behavior. Then run Jailbreak Evaluation before every system-prompt change.
python main.py --server_url "http://localhost:8000/sse" --prompt "Test tool poisoning vulnerabilities"Step 5 — Gate it in CI
Upload the SARIF artifact with the official action so new MCP01–MCP10 findings block the merge. Re-scan on every server/skills update: rug pulls only work if nobody re-checks.
python main.py --repo ./my-mcp-server -o results.sarif.json
# then: github/codeql-action/upload-sarif@v3 with path results.sarif.jsonTip: pin what you scan
A clean scan today means nothing if the server auto-updates tomorrow. Pin versions, register every server in a catalog, and alert on tool-definition drift — that is your tripwire for rug pulls.
4. Common Mistakes (and How to Avoid Them)
I see the same five failures in teams shipping agents. All of them survive a demo and explode in prod:
❌ Exposing the A.I.G UI publicly
The platform is built for internal red-teaming and ships without auth. Bind it to 127.0.0.1, put it behind your VPN, and never forward its port — a scanner with infra access is a juicy target.
❌ Static-only scanning
Source audits miss runtime-only behavior like tool shadowing and poisoned outputs. Always pair --repo scans with a --server_url dynamic pass against the running server.
❌ Granting tools the universe (MCP02)
Excessive permissions are the #1 enabler: a read-only lookup tool with shell exec scope turns any prompt injection into RCE. Declare least-privilege scopes per tool and let the scanner verify them.
❌ Trusting descriptions without pinning
Rug pulls and Name Confusion attacks exploit trust over time and similarity. Re-scan on every version bump and reject same-name tool overrides from untrusted servers.
❌ Skipping the infra + jailbreak passes
You hardened the tools but run a vulnerable Ollama/vLLM build, or you never tested the system prompt. Run the infra CVE scan on self-hosted components and the jailbreak eval on every prompt change.
Golden rule
Treat every MCP server and skill as untrusted third-party code: scan it, pin it, scope it, and re-scan it. If a tool update cannot pass your SARIF gate, it does not ship — no exceptions for “it worked in the demo”.
Conclusion
MCP turned agents from chatbots into software that acts — so agent security is now software supply-chain security. AI-Infra-Guard gives you the missing pipeline: MCP01–MCP10 audits, Skills T01–T09 verdicts, SARIF output for CI, plus jailbreak and infra coverage.
My recommended minimum before any agent reaches prod: static MCP scan, skills audit, one dynamic pass, jailbreak eval on the system prompt, and the SARIF gate in CI. Thirty minutes of setup that prevents the exact incidents filling the 2026 CVE feeds.
Pre-prod checklist
- • mcp-scan static pass on every server (SARIF saved)
- • aig-skill-scan on every skill (malicious/suspicious = block)
- • Dynamic --server_url pass for tool poisoning
- • Jailbreak eval after each system-prompt change
- • Infra CVE scan on self-hosted runtimes
- • Versions pinned + drift alerts + CI SARIF gate
