Model Scanner runs on your own machine — the client starts it, so there is no endpoint to ping. 327 installs a week from npm. Last commit 1 Nov 2026.
Scans ML model files (PyTorch, joblib, NumPy, GGUF, TensorFlow…) and HF repos for supply-chain risks
Nothing serious here today
Today is the operative word: we check Model Scanner every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
Connect this server
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add model-scanner -- npx -y @guardbee/mcp-model-scanner{
"mcpServers": {
"model-scanner": {
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-model-scanner"
]
}
}
}[mcp_servers.model-scanner]
command = "npx"
args = ["-y", "@guardbee/mcp-model-scanner"]{
"mcpServers": {
"model-scanner": {
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-model-scanner"
]
}
}
}{
"servers": {
"model-scanner": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@guardbee/mcp-model-scanner"
]
}
}
}Alternatives to Model Scanner
same job, measured the same wayChecks ML model files (pickle, PyTorch, joblib, NumPy, GGUF, ONNX) for code that runs on load.
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Scans for known AI coding assistant supply-chain backdoors and risky Claude Code / MCP config.
Read-only Shipcheck launch-risk scans for authorized JS, TS, and MCP repos.
Scans AI-generated code for invisible Unicode, Trojan Source, and supply-chain threats.
Scan GitHub repos and profiles for malware before cloning — commit-pinned risk verdicts for agents
Official MCP: continuous supply-chain risk monitoring and early warning, not a one-off report.
GitHub Actions supply-chain hardener: audit workflows for unpinned actions and build a SHA pin plan.
Model Scanner — questions
Answers built from our own checks of this server.