modelvet

Vet a Hugging Face model before you trust it.

MIT licensed CLI, stdlib + picklescan + model-signing v1

Why

Malicious PyTorch checkpoints have repeatedly bypassed picklescan (Hugging Face's own scanning dependency) via documented, CVE-tracked techniques — CVE-2025-1889, CVE-2025-10155, CVE-2026-53875, and more.

Hugging Face's website shows scan-result badges, but huggingface_hub's hf_hub_download() / snapshot_download() have no API to check "was this scanned, and did it pass" from a script. A developer or agent downloading a model programmatically never sees that signal at all. modelvet closes that gap: it re-scans what you actually downloaded, and checks for a Sigstore / OpenSSF Model Signing signature (real, working, but essentially unadopted on Hugging Face today).

Install & use

Not on PyPI yet — install straight from the source repo:

pip install git+https://github.com/sangmorg1-debug/modelvet.git

modelvet scan bert-base-uncased
modelvet scan bert-base-uncased --format json
modelvet scan local-check --local-dir ./downloaded-model

Example scan (captured output, not a live demo)

This Space is static — Hugging Face's free tier no longer includes compute for Gradio or Docker Spaces, only static pages. So this isn't an interactive scanner; it's a real, captured run of modelvet scan hf-internal-testing/tiny-random-gpt2 against an actual public model, shown as-is. Install the CLI locally to scan a real repo of your own.

.gitattributespicklescan · clean

config.jsonpicklescan · clean

merges.txtpicklescan · clean

model.safetensorspicklescan · clean

pytorch_model.binpicklescan · clean

special_tokens_map.jsonpicklescan · clean

tf_model.h5picklescan · clean

tokenizer.jsonpicklescan · clean

tokenizer_config.jsonpicklescan · clean

vocab.jsonpicklescan · clean

signature: no_signature — expected; this repo, like almost every repo on Hugging Face today, has never published one.

exit code: 0

What it does not do (yet)

No transformers.from_pretrained() wrapper — CLI only in v1.
No custom pickle-opcode engine — detection is built on picklescan (an actively maintained, if imperfect, tool), with two narrowly-scoped checks added for its documented bypasses (archive-format mismatch, hidden pickles under non-pickle extensions).
Signature verification only works against --local-dir today, not a bare Hub repo id — Hugging Face's cache layout gives no place to put a signature file for a model you didn't download and sign yourself.