Is this model safe to load?

Loading a PyTorch checkpoint runs whatever code is pickled inside it. Check first.

Already have an SBOM? Open it in the Viewer — also entirely in your browser.

What it checks

Pickle code execution

Every import opcode resolved against the CLI's sink table. Bytecode is read, never executed.

Serialization headers

SafeTensors tensor counts and dtypes; GGUF architecture, version and quantisation.

Licence restrictions

Commercial use classified as restricted, conditional, unrestricted — or undeclared.

How the pickle scan works

Every GLOBAL and STACK_GLOBAL opcode is resolved and judged against the same sink table the AIsbom CLI uses — os.system, subprocess.Popen, builtins.eval, and the ctypes and importlib families among others. The bytecode is disassembled, never executed, and no value is ever reconstructed.

Multi-gigabyte PyTorch archives, without downloading them

A modern .pt is a ZIP with the pickle inside it. We read the archive's central directory over HTTP range requests and disassemble just that member — so a multi-gigabyte checkpoint costs kilobytes of transfer rather than a download. Local files are read the same way, in your browser, and never uploaded.

Running this on every commit

For gated models, full-repository coverage or CI enforcement, use the CLI or connect a repository to the hosted platform.