BEE
Binary, Evidence & Evaluation.
BEE is a CLI for vetting AI/ML model artifacts before they enter your environment: it examines the binary artifact itself, gathers evidence about what it actually is, and produces an evaluation — a concrete, explained finding rather than a bare pass/fail label. Today that means establishing an artifact's identity, detecting its real structural format (never trusting the file extension), and flagging mismatches between the two.
This is early. Static security analysis beyond format-mismatch detection (pickle call-graph analysis, SafeTensors bounds checks, GGUF metadata inspection, and more), provenance, supply-chain checks, licensing, and policy enforcement are planned in later releases.
Install
pip install bee-guard
or, for local development:
git clone https://github.com/Aj7Ay/BEE.git
cd BEE
uv sync
Usage
# Initialize a workspace in the current directory
bee init
# Scan a file or directory
bee scan ./models
# Inspect a single artifact in detail
bee inspect ./models/model.safetensors
# JSON output, for scripting or CI
# --format is a root option, so it comes before the subcommand
bee --format json scan ./models
# Fail the build if anything at or above a severity is found
# --fail-on works identically on scan, inspect, and show
bee scan ./models --fail-on high
bee inspect ./model.safetensors --fail-on critical
# Reproducible output: identical input -> byte-identical JSON
bee --format json scan ./models --deterministic
# Past runs, and re-displaying one by id -- e.g. re-checking a stored
# run in CI without re-scanning
bee history
bee show <run-id>
bee show <run-id> --fail-on critical
Example
$ bee scan ./models
BEE SCAN
Target: models
Artifacts scanned: 2
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ PATH ┃ FORMAT ┃ SIZE ┃ FINDINGS ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
│ models/model.gguf │ gguf │ 16 │ - │
│ models/weights.pt │ numpy │ 24 │ 1 │
└───────────────────┴────────┴──────┴──────────┘
Findings: 0 critical, 0 high, 0 medium, 1 low, 0 info
weights.pt is flagged (BEE-FMT-001) because its extension claims
PyTorch but the file is structurally a NumPy array — exactly the kind of
mismatch a renamed or mislabeled artifact would produce.
What BEE detects today
Structural signatures for: SafeTensors, GGUF, NumPy, HDF5/Keras, Pickle
(all protocols, resistant to trailing-byte padding), PyTorch (zip-based),
ONNX (structural heuristic), and generic zip/tar/gzip archives. Anything
else is reported as unknown rather than guessed.
bee scan and bee inspect both flag:
- symlinks whose target resolves outside the scanned/inspected
directory (
BEE-SYM-001) — the target is never opened (so never hashed) unless you pass--follow-symlinks; the same rule applies whether you pointinspectat the symlink directly orscanfinds it while walking a directory - files it couldn't read, without aborting the rest of the scan
(
BEE-IO-001)
The magic-bytes field shown by inspect (and stored per-artifact by
scan) records exactly the bytes a detector matched on — nothing more.
For a format whose signature is a real fixed byte sequence (GGUF, NumPy,
HDF5, a zip/gzip magic), that's the signature itself, at whatever offset
it actually lives at. For anything else — unknown, but also
safetensors, pickle, PyTorch, tar, ONNX, whose evidence is descriptive
rather than a raw byte match — it's left empty, never a blind fixed-size
read from the start of the file that could just as easily land on
someone's .env contents or an archive member's filename.
Development
uv sync
uv run pytest -v
License
Apache License 2.0 — see LICENSE.
1 maintainer
Release files for bee-guard 0.2.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| bee_guard-0.2.4.tar.gz | 2.2 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| bee_guard-0.2.4-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 2.2 MB
Release files / bee_guard-0.2.4.tar.gz
| Download URL | bee_guard-0.2.4.tar.gz |
|---|---|
| Size | 2.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
eaa918df1fa2c8acb3f79ed32be029d0d24fe9c6efd00b2b2a366798589fde6a
|
|
BLAKE2b-256 checksum How to use checksums |
f7951640dcbb63f219a68007a2eb73f02d5862caf82771c32e356c8e5f900b65
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logRelease files / bee_guard-0.2.4-py3-none-any.whl
| Download URL | bee_guard-0.2.4-py3-none-any.whl |
|---|---|
| Size | 26.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
7c1e3b3be5f33a2d5b261ef25874df68cab932fbfb0e132648d4f5116e2cb2cf
|
|
BLAKE2b-256 checksum How to use checksums |
80d229cd1e76c604fb7324668be93c0753bc96af3d9a41f9db02b84f6dea8766
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency log
