BEE - AI/ML Model Supply-Chain Security Vetting
BEE is a production-ready CLI tool for comprehensive security vetting of AI/ML model artifacts. Detect malicious code, track provenance, enforce policies, and generate security reports.
Features
🔍 Security Analysis
- Format Detection & Validation - Detects SafeTensors, GGUF, Pickle, PyTorch, and more
- Pickle RCE Detection - Identifies dangerous opcodes (os.system, subprocess, eval)
- Custom Code Scanning - Detects os.system, subprocess, eval, network access, credential leaks, dynamic imports
- Dependency Analysis - Parses requirements.txt, pyproject.toml, package.json, poetry.lock, and more
- Vulnerability Lookup - Queries OSV.dev for known CVEs in dependencies
- Bounds Checking - Validates tensor metadata, detects overlaps and size bombs in GGUF/SafeTensors
📋 Provenance & Policy
- Provenance Tracking - Records source, hash, size, acquisition method
- Policy Engine - YAML-based security policies with ALLOW/REVIEW/BLOCK verdicts
- Fail-Closed by Default - Critical/high findings block without explicit policy override
📊 Reporting
- JSON Output - Machine-readable verdicts for automation
- HTML Reports - Dark-themed security reports with detailed findings
- Model Cards - BEE-compliant README.md generation from scans
- Terminal Output - Rich, color-coded scan summaries
Installation
pip install bee-guard
# or with uv
uv pip install bee-guard
Quick Start
1. Scan a Model File
# Scan a single file
bee scan model.gguf
# Scan a directory recursively
bee scan ./models/
# Get JSON output for downstream tools
bee --format json scan model.safetensors
2. Vet with Security Gate
# Vet and apply policy
bee vet --policy security-policy.yaml model.gguf
# Fail on high/critical findings
bee vet model.gguf --fail-on high
3. Generate Reports
# Generate HTML report
bee report --scan model.gguf -o security-report.html
# Generate model card from scan
bee modelcard --scan model.gguf -o README.md
4. Validate Policies
# Check policy YAML syntax
bee policy security-policy.yaml
Commands
| Command | Purpose |
|---|---|
bee scan <target> |
Scan model files for security issues |
bee inspect <target> |
Inspect model artifact metadata |
bee vet <target> |
Full security vetting with policy support |
bee report <target> |
Generate HTML security report |
bee modelcard <target> |
Generate BEE-compliant model card |
bee policy <file> |
Validate security policy YAML |
bee verify <file> |
Verify signed model files |
bee sign <file> |
Digitally sign model artifacts |
bee keygen |
Generate signing keypair |
bee history <target> |
Show scan history from database |
bee show <run-id> |
Display scan results by ID |
bee ollama vet <model> |
Vet local Ollama models (experimental) |
Policy Example
integrity:
require_sha256: true
provenance:
require_publisher: false
require_repository: false
require_revision: false
formats:
blocked: ["pickle"]
findings:
critical: block
high: block
medium: review
low: allow
info: allow
custom_code:
allowed: true
licenses:
allowed: ["MIT", "Apache-2.0"]
vulnerabilities:
critical: block
high: block
medium: allow
low: allow
Save as policy.yaml and use:
bee vet --policy policy.yaml model.gguf
Threat Model
BEE detects and prevents:
| Threat | Detection | Prevention |
|---|---|---|
| Malicious Pickle | Opcode analysis (os.system, subprocess, eval) | BLOCK by format |
| Size Bombs | Bounds checking, overlap detection | BLOCK on mismatch |
| Vulnerable Dependencies | OSV.dev lookup | BLOCK on critical |
| Dangerous Code | Pattern scanning (20+ patterns) | BLOCK by policy |
| Tampered Artifacts | SHA-256 validation, signature verification | BLOCK on mismatch |
| Unknown Provenance | Source tracking, publisher verification | REVIEW without policy |
Exit Codes
| Code | Meaning |
|---|---|
0 |
Scan complete, no blocking issues |
1 |
Security findings at threshold level |
2 |
Usage error (missing file, bad policy, etc.) |
Output Formats
JSON Mode
bee --format json vet model.gguf
Returns:
{
"id": "run-abc123",
"target": "model.gguf",
"verdict": "allow",
"decision": "allow",
"findings": [...],
"severity_count": {
"critical": 0,
"high": 0,
"medium": 0,
"low": 0,
"info": 0
},
"provenance": {...},
"timestamp": "2026-09-22T15:30:00Z"
}
Text Mode (default)
BEE SCAN
Target: model.gguf
Artifacts scanned: 1
┏━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ PATH ┃ FORMAT ┃ SIZE ┃ FINDINGS ┃
┡━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ model.gguf │ gguf │ 5.2G │ - │
└───────────────┴────────┴──────┴──────────┘
Findings: 0 critical, 0 high, 0 medium, 0 low, 0 info
Development
Install from source
git clone https://github.com/Aj7Ay/BEE.git
cd BEE
uv install
Run tests
uv run pytest
Run linting
uv run ruff check src/
License
Apache License 2.0 — see LICENSE file
Contributing
We welcome contributions. Please open an issue or submit a pull request on GitHub.
Security
Report security vulnerabilities to security@example.com. Do not open public issues for security bugs.
BEE: Because model safety is not optional.
1 maintainer
Release files for bee-guard 0.16.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| bee_guard-0.16.0.tar.gz | 2.3 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| bee_guard-0.16.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.4 MB
Release files / bee_guard-0.16.0.tar.gz
| Download URL | bee_guard-0.16.0.tar.gz |
|---|---|
| Size | 2.3 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
e9234056260d58ffa58b78ce09ea39636a3c455b0b2e3a414a62e7fed1ef46e5
|
|
BLAKE2b-256 checksum How to use checksums |
a210436bec2779e200c855fa166f5cd43bbce17c9adc855169193aef2a9ed793
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency logRelease files / bee_guard-0.16.0-py3-none-any.whl
| Download URL | bee_guard-0.16.0-py3-none-any.whl |
|---|---|
| Size | 94.8 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
b3027bf6b1332f9eba425600cb30c6583da5d3668e30e2748451f133db514638
|
|
BLAKE2b-256 checksum How to use checksums |
bfdee47a9f7d78fd7cdeaa2c492d26eb25a0c769f86ad2793442f6822a9d0e5a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 22, 2026.
Transparency log
