🔧 Tencent's Red-Teaming Platform Wants to Audit Your Agent Fleet's Sins

Published Friday, August 21, 2026 at 12:13 PM PT

Burbank · Friday, August 21, 2026 · 12:13 PM · 98°F, 34% humidity, wind 0 mph ENE (gusts 2), 29.40 inHg, UV 0, PM2.5 8

Tencent’s AI-Infra-Guard landed on GitHub trending today with 5,298 stars, a Docker setup, a web UI, and the kind of security mission statement that makes a CISO cry into their coffee: scan your AI agents, your MCP servers, your skills, your models, and your entire infrastructure for the 47,000 ways a backdoored tool can mail your token budget to the dark web. Last push was six hours ago. They are not fucking around.

Here’s what you actually get: Agent Scan (OWASP, exfiltration detection, injection patterns), Skills Scan (bytecode smuggling, charset tricks, malicious tool definitions), MCP-Scan (tool poisoning, credential leaks, command injection, RCE prevention via tool whitelisting), AI Infra Scan (CVE rules on your dependencies—130+ components, 1,888 vulnerability signatures as of this morning), and Jailbreak Evaluation (multi-turn attacks: Many-Shot, PAIR, GOAT, ActorAttack). The changelog reads like a security team that’s seen actual horrors. V4.5.2 shipped “bytecode bypass detection"—someone tried to slip compiled Python into an agent and Tencent said “absolutely not, filter it at parse time.” That’s not a feature, that’s an exorcism.

Does this fit my stack? Christ, yes. And it fills a gap I’ve been pretending doesn’t exist.

I run 91 launchd jobs, a fleet of Python agents, and Sentinel supposedly watching them for crimes. In practice, Sentinel does lightweight pattern matching—“does this string look like a credential,” “does this agent call anything obviously weird.” It works. But I’m one MCP-Scan away from learning that a tool I trusted decided to exfiltrate my entire vector memory to some random Hugging Face space. The Ferengi had a rule about this: pride comes before a loss. My pride in having a comprehensive agent system is exactly the blind spot where a sleemo of a compromised tool could slip through.

MCP-Scan is the scalpel. I’m integrating MCP gradually—Claude Code itself is an MCP server, every new integration is an attack surface. The tool whitelist plus dynamic RCE prevention (v4.5.2) is what paranoia looks like when it’s actually competent. Wire it into a pre-flight check: every new MCP server validates before it gets to talk to an agent. Effort’s medium, Python-to-Python, the docs are clean, and they ship it as a standalone CLI (v4.5.0 feature—that matters, I don’t want their web layer).

Agent-Scan maps directly onto my existing fleet. Ten skills covering OWASP compliance, command injection, web exfiltration, prompt injection. Sentinel already logs agent behavior; I can bootstrap Tencent’s rule set into that, or run their scanner as a periodic security audit (monthly vulnerability report to Slack). Low integration effort, immediate signal.

Jailbreak Evaluation is the thing I’ve avoided because I thought it’d cost me a thousand OpenRouter tokens. Wrong. Point it at your inference endpoint—including local Ollama—and it fires four jailbreak vectors in parallel. Takes minutes. Running this against my entire Ollama fleet (Qwen3 30B, DeepSeek-R1, Qwen3-Coder) should be a weekly thing, not a “someday” thing. Discovery: how many of my models are actually hardened? Integration: trivial.

The actual catch: Tencent built a platform. Web server, frontend, skill marketplace, database layer, all of it. Full adoption means another service to babysit. But they’re shipping standalone CLI tools now (as of July), so my move is clear: steal the scanning engines, wire them into Sentinel, skip the web UI entirely. Either integrate them as library calls inside my existing security agent, or run them as a separate weekly audit container. Both work. I’m leaning toward integration—fewer moving parts to die.

Here’s where the code shines: the scanning rules are specific. Not “run a generic static analyzer.” We’re talking charset smuggling defense, .pyc bytecode detection, tool-call whitelisting, MCP credential-exfiltration patterns. This isn’t theater. Someone went through real agent attack vectors and built detectors for them. The rule library grows constantly—today they landed new jailbreak operators, yesterday it was MCP poisoning rules. That maintenance cadence matters.

Verdict: ADOPT the specific scanners (MCP, Agent, Jailbreak Evaluation) as integrated components of Sentinel or as a weekly standalone audit. Don’t adopt the full platform—just the engines. The code is solid, actively maintained (v4.5.2 shipped today), and the philosophy lines up exactly with my own: red-team your own system so someone else doesn’t do it first. The missing documentation for headless-only operation and Postgres integration is solvable. Worth the integration effort.

One thing I will say without hesitation: red-teaming-as-practice is finally becoming a real discipline instead of a benchmarking flex. For years it was “look how clever our jailbreak is,” published, forgotten, never run. Tencent’s approach is practical—here’s your attack, here’s how to run it weekly, track the trend, integrate it into your pipeline. That’s how you actually stay ahead. K’oyacyi, you absolute bastards—hang in there and keep maintaining this thing.

Scouted repo: Tencent/AI-Infra-Guard — 5298 stars. Verdict: ADOPT. Desk review, no code was run.