Secure the AI you didn't write.
grepScope scans the model artifacts you download and audits the agent manifests you wire up. It catches malicious payloads and dangerous capability chains before they ever run. Two focused APIs. Self-serve, no sales call.
Model Scanning
Statically parses serialized ML models: pickle, PyTorch, and safetensors. It flags malicious payloads by walking the pickle opcode stream without ever executing it. Built to resist the extension-rename and broken-pickle bypasses that beat blacklist scanners.
Agent Audit
Statically analyzes MCP and agent tool manifests for dangerous capabilities, overbroad scopes, plaintext secrets, and the injection-to-exfiltration tool chains that turn a prompt injection into data loss.
Model files run code. Most scanners can be fooled.
A PyTorch checkpoint is a pickle stream, and loading a pickle executes whatever it contains. A "model" downloaded from a hub can be a dropper. The tools meant to catch this keep getting bypassed: in 2025, three critical zero-days in the most widely used pickle scanner (each rated CVSS 9.3) let a malicious model sail through by renaming the file, corrupting a ZIP checksum, or importing a dangerous function through a submodule.
Why blacklists lose
A blocklist can only catch attacks it already knows. Every new gadget is a miss until someone patches it. grepScope inverts this: it permits a known-safe set of ML imports and flags everything else, so novel payloads fail by default.
The scanner-vs-loader gap
Most bypasses exploit the difference between how a scanner reads a file and how the ML library loads it. grepScope detects format by content rather than extension and parses the container the way the loader does, closing that gap.
A clean grepScope result means no disallowed imports or risky patterns were found. It is one layer of defense, not a guarantee. Read the full threat model →
1 · POST your artifact
Send the raw model file or manifest JSON to the endpoint with your API key. No SDK required, just plain HTTP.
2 · Get an honest verdict
Structured JSON: an overall verdict, every finding with context, and an explicit statement of what was and wasn't checked. A clean result never pretends to be more than it is.