Check a model artifact before you deploy it.
Model Intake is ShakerScan’s pre-deployment review for machine-learning model repositories and artifacts. It pins the source and revision, runs static and dependency scanners, can test runtime behavior in an isolated sandbox, and issues a signed, revocable admission bound to the artifact and evidence digests.
Model Intake is labeled preview in the open-source walkthrough. It is off by default on new installs; shakerscan model-intake enable turns it on and pulls about 4.8 GB of images. Unsupported formats, incomplete evidence, and missing tools fail closed.
Who it is for. ML platform, security, and compliance teams that need a defensible record of what a model artifact contains before it reaches production.
What problem it solves
Model files are executable supply-chain inputs. Pickle-based formats can run code on load, repositories ship their own code and dependencies, and licenses and provenance are often unverified.
Model Intake gives each artifact a durable identity (pinned source, revision, digests, and evidence) and a decision-first report.
How it works
- 01Resolve a model reference from Hugging Face, HTTPS, S3, GCS, Azure Blob, or bound OCI and MLflow HTTPS exports, and pin the revision.
- 02Acquire the artifact completely, or record an explicitly truncated acquisition when a size ceiling is hit.
- 03Generate evidence: SHA-256 digests, signature and trust inputs, repository manifest, model card, license, secret and malware checks, serialization analysis, and dependency resolution.
- 04Run pinned scanners: ModelScan, Semgrep, Fickling, Trivy, OSV, and offline dependency scanning.
- 05Optionally test runtime behavior in an isolated, no-egress microVM.
- 06Report a technical outcome of PASS, REVIEW_REQUIRED, INCOMPLETE, or BLOCK, and issue a signed, revocable admission bound to the exact subject and scan.
What you get
- A decision-first HTML report plus JSON results and a content-free evidence export.
- CycloneDX, SPDX, and AIBOM documents with declared coverage.
- A signed deployment admission that can be revoked later, bound to artifact and evidence digests.
- A safetensors conversion path for supported unsafe .bin layouts, with a strict rescan.
Example workflow
# In the web UI: Model Intake → resolve a reference → provide policy# and trust evidence → queue an admission review. # After completion, export the evidence for the scancurl http://localhost:8080/model-intake/scans/{scan_id}/evidence-export
Security and authorization
- The core API and ordinary workers never import publisher model code. Static acquisition and scanners produce bounded evidence; runtime qualification uses an isolated, opt-in runner.
- Strict controls that are unavailable fail closed. Workflow completion is never treated as a model pass.
- Model subjects stay out of ordinary web targets, DAST scores, and attack-surface coverage.
Limitations
- The isolated microVM runtime tier is separate host infrastructure. It is unsupported on macOS, Windows, and hosts without exposed hardware virtualization.
- A capped, partial download is recorded as known_unverified_truncated. It is not a verified subject and not a complete review.
- Quick checks intentionally omit full acquisition and adapters. Full reviews require complete authoritative acquisition wherever the selected policy demands it.
- Production approval requires your own trust roots, benchmarks, and deployment evidence. Model Intake records and signs the review; it does not decide your risk appetite.
Get started
- 01Install ShakerScan and run shakerscan model-intake enable.
- 02In the web UI, turn on Show all sidebar sections and open Model Intake. Paste a model reference, pin the revision, and provide policy and trust inputs.
- 03Queue the review, then read the decision-first report and the technical outcome.
- 04Export the AIBOM, SBOM, or evidence bundle for your deployment records.