# How to Use the AI-Infra-Guard WebUI: Complete Setup and Scanning Guide

> Master the AI-Infra-Guard WebUI with this complete setup and scanning guide. Learn to run AI infrastructure scans, MCP server analysis, and jailbreak evaluations easily.

- Repository: [Tencent/AI-Infra-Guard](https://github.com/tencent/AI-Infra-Guard)
- Tags: how-to-guide
- Published: 2026-08-22

---

**AI-Infra-Guard provides a browser-based interface at `http://localhost:8088` for running three security assessments—AI infrastructure scans, MCP server analysis, and jailbreak evaluations—with real-time progress streaming via WebSocket.**

The Tencent/AI-Infra-Guard project delivers a comprehensive security scanning platform for AI infrastructure and LLM deployments. This guide explains how to use the AI-Infra-Guard WebUI to perform vulnerability assessments through an intuitive browser interface without writing complex CLI commands.

## Architecture Overview

The WebUI follows a Go-backend, Vue.js-frontend architecture with real-time communication channels. Understanding this structure helps troubleshoot connectivity issues and extend functionality.

### Backend Components

The **Go binary** built from [`cmd/cli/main.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/cmd/cli/main.go) serves as the entry point. When invoked with the `webserver` sub-command, it initializes an HTTP server on `127.0.0.1:8088` by default. This server handles three critical responsibilities:

- Serves static assets (HTML, CSS, JavaScript) from the repository’s `web/` directory
- Exposes REST endpoints under `/api/scan/*` implemented in [`internal/api/scan.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/api/scan.go)
- Manages a WebSocket hub defined in [`common/websocket/hub.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/hub.go) for real-time task updates

### Frontend Implementation

The browser interface is a **Vue.js** application bundled under the `web/` directory. The main component in [`web/src/App.vue`](https://github.com/Tencent/AI-Infra-Guard/blob/main/web/src/App.vue) renders three assessment panels, manages form state, and subscribes to the WebSocket at `ws://localhost:8088/ws/tasks` for progress notifications.

## Building and Starting the WebUI Server

Before accessing the interface, compile the Go binary and launch the server.

### Step 1: Build the Binary

Run the following command from the repository root to generate the `aig` executable:

```bash
go build -o aig ./cmd/cli/main.go

```

This creates a platform-specific binary that embeds the web assets and Python scanning modules.

### Step 2: Launch the Server

Start the WebUI server by specifying the bind address and port:

```bash
./aig webserver --server 127.0.0.1:8088

```

The server logs indicate when the HTTP listener is active. Navigate to `http://localhost:8088` in your browser to load the interface.

## Running AI Infrastructure Scans

The **AI Infra Scan** fingerprints running AI services (vLLM, Ollama, ComfyUI) against a database of over 2,000 known CVEs.

### Configuration Steps

1. Select **"AI基础设施安全扫描 / AI Infra Scan"** from the landing page
2. Enter the target service address (e.g., `http://127.0.0.1:8000`)
3. Click **Start Scan**

### Technical Flow

The UI sends a **REST POST** request to `/api/scan/infra` with the target payload. The handler in [`internal/api/scan.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/api/scan.go) creates a task via the `pkg/task` manager, which orchestrates the scan. Progress updates stream through the WebSocket bridge, and the final report renders as a table showing component versions, matched CVEs, severity ratings, and remediation links.

## Scanning MCP Servers and Agent Skills

The **MCP Scan** analyzes Model Context Protocol server code for vulnerabilities and evaluates registered agent skills.

### Input Methods

The WebUI accepts two input types:

- **Source Archive**: Upload a `.zip` or `.tar.gz` file containing the MCP server code
- **Git URL**: Provide a remote repository address (e.g., `https://github.com/user/mcp-server`)

### Execution Process

After clicking **Start Scan**, the backend spawns a Python subprocess running [`mcp-scan/main.py`](https://github.com/Tencent/AI-Infra-Guard/blob/main/mcp-scan/main.py). The task controller monitors execution and pipes results through the WebSocket connection established in [`common/websocket/hub.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/hub.go). The report highlights discovered plugins, risky agent skills, and any CVEs present in the codebase.

## Performing Jailbreak Evaluations

The **Jailbreak Evaluation** assesses LLM resistance to adversarial prompts using standardized datasets.

### Prerequisites

Navigate to **Settings → Model Config** and configure:

- **Base URL**: The LLM API endpoint
- **API Key**: Authentication token (stored only in the browser session, never persisted server-side)

### Running the Assessment

1. Select a dataset from the dropdown (datasets reside in `data/eval/`)
2. Click **Run Evaluation**

The backend initiates the jailbreak evaluator as a subprocess, streaming per-prompt success rates and final safety scores to the Vue.js frontend via WebSocket messages.

## Real-Time Updates via WebSocket

All three assessment types utilize a unified real-time communication layer. The frontend establishes a connection to `ws://localhost:8088/ws/tasks` as implemented in [`web/src/App.vue`](https://github.com/Tencent/AI-Infra-Guard/blob/main/web/src/App.vue).

### Message Handling

The browser processes three message types:

- `progress`: Updates the visual progress bar component ([`web/src/components/ProgressBar.vue`](https://github.com/Tencent/AI-Infra-Guard/blob/main/web/src/components/ProgressBar.vue))
- `log`: Displays streaming terminal output
- `result`: Renders the final JSON report in the results table

## Accessing API Documentation

For programmatic integration or debugging, the server exposes auto-generated Swagger documentation at:

```

http://localhost:8088/docs/index.html

```

This interface documents all REST endpoints including `/api/scan/infra`, `/api/scan/mcp`, and `/api/eval/jailbreak` with request schemas and example payloads.

### Example API Call

You can trigger scans directly via `curl` without the UI:

```bash
curl -X POST http://127.0.0.1:8088/api/scan/infra \
     -H "Content-Type: application/json" \
     -d '{"targets":["http://127.0.0.1:8000"]}'

```

## Summary

- The AI-Infra-Guard WebUI runs on `http://localhost:8088` after building with `go build -o aig ./cmd/cli/main.go` and executing `./aig webserver`
- Three assessment modules are available: AI Infra Scan, MCP Server & Agent Skills Scan, and Jailbreak Evaluation
- Real-time progress relies on WebSocket connections managed by [`common/websocket/hub.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/common/websocket/hub.go) and rendered in [`web/src/App.vue`](https://github.com/Tencent/AI-Infra-Guard/blob/main/web/src/App.vue)
- REST endpoints in [`internal/api/scan.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/internal/api/scan.go) handle task creation while Python subprocesses perform the actual security analysis
- API documentation is accessible via Swagger UI at [`/docs/index.html`](https://github.com/Tencent/AI-Infra-Guard/blob/main//docs/index.html)

## Frequently Asked Questions

### How do I change the default port for the AI-Infra-Guard WebUI?

Modify the `--server` flag when launching the webserver. For example, use `./aig webserver --server 0.0.0.0:9000` to bind to port 9000 on all interfaces. The address must be reachable by your browser for the WebSocket connection to function.

### Is the API key for jailbreak evaluations stored on the server?

No. According to the implementation in [`web/src/App.vue`](https://github.com/Tencent/AI-Infra-Guard/blob/main/web/src/App.vue), API keys entered in **Settings → Model Config** are kept in the browser's session state only. The key is sent with each evaluation request but never persisted to disk or server configuration files.

### Can I run the AI-Infra-Guard WebUI without building from source?

The current implementation requires building the Go binary from [`cmd/cli/main.go`](https://github.com/Tencent/AI-Infra-Guard/blob/main/cmd/cli/main.go) to bundle the static assets and establish the HTTP/WebSocket server. Pre-built releases may be available in the Tencent/AI-Infra-Guard repository releases page, but compilation from source ensures compatibility with your specific platform and Go version.

### What Python modules does the WebUI execute during scans?

The task manager spawns three distinct Python subprocesses depending on the scan type: [`mcp-scan/main.py`](https://github.com/Tencent/AI-Infra-Guard/blob/main/mcp-scan/main.py) for MCP analysis, [`agent-scan/main.py`](https://github.com/Tencent/AI-Infra-Guard/blob/main/agent-scan/main.py) for agent skill evaluation, and the jailbreak evaluator for LLM safety testing. These modules are located within the repository's Python package directories and execute asynchronously while streaming output through the Go WebSocket hub.