MCP Model Scanner | Pickle & model security

MCP guide · Model Scanner

MCP Model Scanner: ML checkpoint supply-chain scanning — @guardbee/mcp-model-scanner

@guardbee/mcp-model-scanner scans the model artifact itself — not the code that loads it. A .pt/.pkl checkpoint is a pickle stream; torch.load() can run arbitrary Python the moment it opens the file.

What does it do?

It walks a real pickle opcode disassembler (protocols 0–5), extracts only data.pkl from PyTorch zip containers, and applies safetensors structural checks plus Keras Lambda RCE and ONNX external_data path-traversal heuristics.

Who is it for?

ML teams pulling checkpoints from Hugging Face or registries
DevSecOps scanning model artifacts in CI
Developers who want this check inside Claude or Cursor

What it is not

Dynamic runtime analysis by executing the model
A full HDF5/protobuf structural parser
A formal safety proof (findings are heuristic)

Features

Feature	Description
31 dangerous-global rules	code-execution, process, network, filesystem, reflection, deserialization
PyTorch zip + Zip64	Scan data.pkl without loading the full checkpoint
safetensors / Keras / ONNX	Disguised extensions, Lambda RCE, path traversal
SARIF 2.1.0	GitHub Code Scanning / CI gates
guardbee.yml	fail-on, max-files, exclude

MCP tools

Tool	Description
`scan_file`	Scan a single model file
`scan_directory`	Recursively scan a models directory
`list_patterns`	List the dangerous-global catalog

Install with npm

Global install (handy for Claude Desktop / Cursor):

bash

npm install -g @guardbee/mcp-model-scanner

or via npx (recommended with -y in config):

bash

npx -y @guardbee/mcp-model-scanner

npm: @guardbee/mcp-model-scanner

CLI: npx @guardbee/mcp-model-scanner scan ./models --fail-on=high --format=sarif > results.sarif. Opt out of telemetry with GUARDBEE_TELEMETRY=0.

Claude Desktop configuration

Config file paths:

macOS~/Library/Application Support/Claude/claude_desktop_config.json
Windows%APPDATA%\Claude\claude_desktop_config.json
Linux~/.config/Claude/claude_desktop_config.json

Merge this block, then restart Claude Desktop:

claude_desktop_config.json

{
  "mcpServers": {
    "guardbee-model-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@guardbee/mcp-model-scanner"
      ]
    }
  }
}

Cursor and other MCP clients

In Cursor, add the same command / args / env under Settings → MCP. stdio MCP servers use the same contract as Claude Desktop.

Example prompts in Claude

“Scan this models folder for supply-chain risks: ./models”
“Does this .pt file contain dangerous pickle globals?”
“Which dangerous-global patterns do you support?”

See surface risk with Guardbee

MCP servers speed up security work in chat. Start a 14-day free trial for brand scans and BeeAI.

Start free MCP servers

Frequently asked questions

Vs picklescan?

MCP + Claude/Cursor integration, safetensors/Keras/ONNX checks, and SARIF in one package.

Will huge files OOM?

No — bounded reads (pickle prefix, zip entry, header caps) by design.

API key?

No — fully local filesystem scanning.

MCP Model Scanner: ML checkpoint supply-chain scanning