BEE
BEE is a CLI for vetting AI/ML model artifacts before they enter your environment. It establishes an artifact's identity, detects its real structural format (never trusting the file extension), and flags mismatches between the two.
This is early. Static security analysis beyond format-mismatch detection (pickle call-graph analysis, SafeTensors bounds checks, GGUF metadata inspection, and more), provenance, supply-chain checks, licensing, and policy enforcement are planned in later releases.
Install
pip install bee-guard
or, for local development:
git clone https://github.com/Aj7Ay/BEE.git
cd BEE
uv sync
Usage
# Initialize a workspace in the current directory
bee init
# Scan a file or directory
bee scan ./models
# Inspect a single artifact in detail
bee inspect ./models/model.safetensors
# JSON output, for scripting or CI
# --format is a root option, so it comes before the subcommand
bee --format json scan ./models
# Fail the build if anything at or above a severity is found
bee scan ./models --fail-on high
# Reproducible output: identical input -> byte-identical JSON
bee --format json scan ./models --deterministic
# Past runs, and re-displaying one by id
bee history
bee show <run-id>
Example
$ bee scan ./models
BEE SCAN
Target: models
Artifacts scanned: 2
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ PATH ┃ FORMAT ┃ SIZE ┃ FINDINGS ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ models/model.gguf │ gguf │ 16 │ - │
│ models/weights.pt │ numpy │ 24 │ 1 │
└───────────────────┴────────┴──────┴──────────┘
Findings: 0 critical, 0 high, 0 medium, 1 low, 0 info
weights.pt is flagged (BEE-FMT-001) because its extension claims
PyTorch but the file is structurally a NumPy array — exactly the kind of
mismatch a renamed or mislabeled artifact would produce.
What BEE detects today
Structural signatures for: SafeTensors, GGUF, NumPy, HDF5/Keras, Pickle
(all protocols, resistant to trailing-byte padding), PyTorch (zip-based),
ONNX (structural heuristic), and generic zip/tar/gzip archives. Anything
else is reported as unknown rather than guessed.
bee scan also flags:
- symlinks whose target resolves outside the scanned directory
(
BEE-SYM-001) - files it couldn't read, without aborting the rest of the scan
(
BEE-IO-001)
Development
uv sync
uv run pytest -v
License
Apache License 2.0 — see LICENSE.
1 maintainer
Release files for bee-guard 0.2.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| bee_guard-0.2.0.tar.gz | 35.2 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| bee_guard-0.2.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 58.2 kB
Release files / bee_guard-0.2.0.tar.gz
| Download URL | bee_guard-0.2.0.tar.gz |
|---|---|
| Size | 35.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
32c400dbf335cc694043e388bdc5c6301fa666e739ce9e8beaf151e4dc727c2f
|
|
BLAKE2b-256 checksum How to use checksums |
24505ed90818d7b9a2028240e8c696d50aebfe1515284c9011a22676aea26071
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency logRelease files / bee_guard-0.2.0-py3-none-any.whl
| Download URL | bee_guard-0.2.0-py3-none-any.whl |
|---|---|
| Size | 23.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
5769994ca4762f497df2b7cb990cb48e5cd78e0be3c016c0ec09636075eba851
|
|
BLAKE2b-256 checksum How to use checksums |
ed8780d32f8e7a899271ad537797142bf3d590349d035d11583e948b72575db5
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 11, 2026.
Transparency log
