Why this matters
AI deployment stacks expose heterogeneous risks—from vulnerable servlets and inference endpoints to malicious agent skills and untrusted MCP connectors. This project treats that surface as layered and matches detection paradigms to each layer: deterministic fingerprinting for infra CVEs, agentic LLM analysis for semantic code/skill threats, and large-scale jailbreak enumeration for model alignment robustness.
What Sets It Apart
- Layer-matching approach: uses deterministic fingerprint rules for components and CVEs, LLM-driven agentic audits for MCP/skill semantics, and a jailbreak harness for alignment testing — so findings are mapped to the kind of evidence that best supports remediation.
- Broad coverage and telemetry: fingerprints for 100+ AI components and a vulnerability database covering thousands of CVE rules (project has reported >1600–2000+ rules across releases), plus specialized scanners for Ollama, ComfyUI, vLLM and others, enabling automated matching of live service fingerprints to known flaws.
- Agent- and skill-focused tooling: standalone CLIs and agent-scan/skill-scan modules that evaluate tool-poisoning, code vulnerabilities, credential exfiltration and other agentic threats, with integration points for CI/CD and skill marketplaces.
- Practical operator UX: Docker-based deployment, web UI at localhost:8088, API checker and plugin-driven rule updates to let teams adapt fingerprints and datasets without core changes.
Who it's for — and tradeoffs
Great fit if you operate or evaluate LLM/agent deployments and need reproducible, layered security tests (infrastructure CVE checks, MCP/skill audits, and jailbreak benchmarking) that can be automated in CI or run interactively. It is production-focused for internal networks and research workflows.
Look elsewhere if you need a turnkey SaaS with built-in authentication for public deployment — the project notes it lacks a production authentication layer and is intended for internal/private use unless hardened and wrapped by an operator. Also expect engineering effort to tune rule plugins and LLM backends for skill/MCP semantic scans.
