Check a model artifact before you deploy it.
Model Intake is ShakerScan’s pre-deployment review workflow for machine-learning model repositories and artifacts. It pins the exact source and revision, acquires the artifact, runs static and dependency scanners, can qualify runtime behavior in an isolated sandbox, and emits a signed, revocable deployment admission bound to the artifact and evidence digests.
Model Intake is labeled preview in the open-source walkthrough. Deterministic static review, report generation, and the opt-in AMD64 Linux/KVM Firecracker tier are release-gated; unsupported formats, incomplete evidence, and missing tools fail closed. Production approval still requires operator-supplied tools, trust roots, runtime images, benchmarks, and evidence for the exact model and deployment.
Who it is for. ML platform, security, and compliance teams that need a defensible record of what a model artifact contains before it reaches production.
What problem it solves
Model files are executable supply-chain inputs. Pickle-based formats can run code on load, repositories ship their own code and dependencies, and licenses and provenance are often unverified.
Model Intake gives each artifact a durable identity (pinned source, revision, digests, and evidence set) and produces a decision-first report instead of a logo wall of scanner output.
How it works
- 01Resolve a model reference from Hugging Face, HTTPS, S3, GCS, Azure Blob, or bound OCI and MLflow HTTPS exports, and pin the revision.
- 02Acquire the artifact completely, or record an explicitly truncated acquisition when a size ceiling is hit.
- 03Generate evidence: SHA-256 digests, signature and trust inputs, repository manifest, model card, license, secret and malware checks, serialization analysis, and dependency resolution.
- 04Run hash-locked scanners in rebuilt source workers: ModelScan, Semgrep, Fickling, Trivy, OSV, and offline dependency scanning, each with readiness and self-test receipts.
- 05Optionally qualify runtime behavior in the isolated no-egress sandbox tier, and run embedding, vector, or graph evaluation where required by policy.
- 06Report a technical outcome of PASS, REVIEW_REQUIRED, INCOMPLETE, or BLOCK, and issue a signed, revocable admission bound to the exact subject and scan.
What you get
- A decision-first HTML report plus JSON results and a content-free evidence export.
- CycloneDX, SPDX, and AIBOM documents with declared coverage.
- A signed deployment admission that can be revoked later, bound to artifact and evidence digests.
- A safetensors conversion path for supported unsafe .bin layouts, with a strict rescan.
Example workflow
# In the web UI: Model Intake → resolve a reference → provide policy# and trust evidence → queue an admission review. # After completion, export the evidence for the scancurl http://localhost:8080/model-intake/scans/{scan_id}/evidence-export
Security and authorization
- The core API and ordinary workers never import publisher model code. Static acquisition and scanners produce bounded evidence; runtime qualification uses an isolated, opt-in runner.
- Strict controls that are unavailable fail closed. Workflow completion is never treated as a model pass.
- Model subjects stay out of ordinary web targets, DAST scores, and attack-surface coverage.
Limitations
- The isolated microVM runtime tier is separate host infrastructure. It is unsupported on macOS, Windows, and hosts without exposed hardware virtualization.
- A capped, partial download is recorded as known-unverified-truncated. It is not a verified subject and not a complete review.
- Quick checks intentionally omit full acquisition and adapters. Full reviews require complete authoritative acquisition wherever the selected policy demands it.
- Production approval requires your own trust roots, benchmarks, and deployment evidence. Model Intake records and signs the review; it does not decide your risk appetite.
Get started
- 01Install ShakerScan and open Model Intake in the web UI.
- 02Paste a model reference, pin the revision, and provide policy and trust inputs.
- 03Queue the review, then read the decision-first report and the technical outcome.
- 04Export the AIBOM, SBOM, or evidence bundle for your deployment records.