Discover, inventory, and risk-analyze the AI supply chain of a public repository. Static & evidence-backed — the scanner never runs the code it scans.
The score measures the supply-chain hygiene of the AI components detected in this repository — models, datasets, prompts, agents, AI services, and AI packages. It is not a general security audit of the codebase; a repository with no AI components shows "no AI components detected" instead of a score.
Categories. integrity: can what you load be silently swapped or execute code (pickle weights, unpinned models/packages, known CVEs)? provenance: do you know where components come from (typosquats, missing model cards, undocumented datasets)? licensing: are licenses known and usable? configuration: risky settings and exposure (trust_remote_code, hardcoded secrets, MCP tool surfaces).
Formula. Each category starts at 100 and loses points per finding — critical −40, high −20, medium −10, low −3 — floored at 0, counting at most 3 findings per rule. Overall = 0.55 × mean + 0.45 × worst category, so one bad category is not averaged away.
Grades. A ≥ 90 (good hygiene) · B ≥ 75 (minor
issues) · C ≥ 60 (needs attention) · D ≥ 40 (poor hygiene) · F < 40 (serious
issues). Every point lost is traceable to a finding with a
file:line evidence trail below.
| Severity | Rule | Finding | Where |
|---|
| Type | Name | Provider/Source | Usage | Context | Evidence / Detector |
|---|