Layer 3 of 8, Secure what you build and buy

Model and supply chain: check what you pull in before it runs

This layer checks models, datasets and AI components from outside before use: model file scanning, signing and verification, AI bills of materials and license checks.

9 tools + 8 also cover it
Last reviewed October 21, 2026

See the tools How the eight layers work

Executive summary

What it is: This layer checks models, datasets and AI components from outside before use: model file scanning, signing and verification, AI bills of materials and license checks.
The risk: OWASP's LLM04 page names malicious pickling, which executes harmful code when a model is loaded. Tampered or impersonated models, unknown provenance and MCP tool descriptions that change after approval are the other ways in.
What to buy or do: Scan model files in CI or at the registry before anyone loads them, prefer formats that cannot run code, sign and verify the models you ship, and keep an AI bill of materials. Budget it with software supply chain security.

Our analysis Our editorial model, not a standard: OWASP, MITRE and NIST did not create or endorse it. Layer placements are our analysis, based on documented capabilities. How the model works.

The question this layer answers

Can a model, dataset or AI component we pull in run code or hide a backdoor, and can we prove where it came from?

Budget line
AI and ML supply chain security, usually inside application security, software supply chain or artifact registry budgets.

What it protects against

Our analysis

Model files that run code when loaded (pickle)
Tampered or impersonated models
Unknown provenance
Poisoned data and backdoors in third-party models (partly)
License risk
Agent components such as MCP servers and tool descriptors that change after approval or carry hidden instructions

Typical controls

Our analysis

Scan model files before loading
Prefer formats that cannot run code
Sign and verify models
AI and ML bills of materials (CycloneDX)
License checks
Curated registries and proxies
CI gates on scan results
Pin and re-check MCP servers and tool descriptions
Vulnerability disclosure programs

How it maps to standards

Source states means the framework's own text names the control or outcome this layer delivers. Our analysis means we drew the link. OWASP LLM ids are the 2025 edition; the ATLAS hub holds the MITRE data version.

Model and supply chain: standards entries, basis, where the source says it and how it applies
Framework	Entry	Basis	Where the source says it	How it applies
OWASP LLM Top 10 (2025)	LLM03 Supply Chain	Source states	Prevention list	Verifiable sources checked with signatures and file hashes, signed SBOMs and AI or ML BOMs such as CycloneDX, and license tracking.
OWASP LLM Top 10 (2025)	LLM04 Data and Model Poisoning	Source states	Prevention list	Track data origins with an ML bill of materials. The LLM04 page also names unsafe pickle files in shared models.
OWASP Agentic Top 10 (2026)	ASI04 Agentic Supply Chain Vulnerabilities (opens in a new tab) OWASP relates it to LLM03.	Source states	Mitigations 1, 2, 7	Sign and attest manifests, prompts and tool definitions, keep SBOMs and AIBOMs, gate dependencies, and pin by content hash.
OWASP Agentic Top 10 (2026)	ASI05 Unexpected Code Execution (RCE) (opens in a new tab) OWASP relates it to LLM01, LLM05.	Our analysis	Not named by the source	ASI05 lists unsafe object deserialization as an attack scenario, and model file scanners inspect serialized files.
MITRE ATLAS	AML.M0013 Code Signing	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0014 Verify AI Artifacts	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0016 Vulnerability Scanning	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0023 AI Bill of Materials	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0025 Maintain AI Dataset Provenance	Source states	Mitigation name	The mitigation's name is the control.
MITRE ATLAS	AML.M0007 Sanitize Training Data	Our analysis	Not named by the source	Sanitizing training data belongs with the other model and data integrity controls in this layer.
MITRE ATLAS	AML.T0010 AI Supply Chain Compromise	Our analysis	Not named by the source	Supply chain compromise of models and AI components.
MITRE ATLAS	AML.T0011.000 User Execution: Unsafe AI Artifacts	Our analysis	Not named by the source	Unsafe AI artifacts that run code when a user loads them.
MITRE ATLAS	AML.T0020 Training Data Poisoning	Our analysis	Not named by the source	Training data poisoning.
MITRE ATLAS	AML.T0070 RAG Poisoning	Our analysis	Not named by the source	RAG poisoning through unverified data sources.
MITRE ATLAS	AML.T0109 AI Supply Chain Rug Pull	Our analysis	Not named by the source	A tool or server that changes after approval, known as a rug pull.
NIST AI RMF	GOVERN Govern (opens in a new tab)	Source states	GOVERN 6.1	Policies and procedures address AI risks from third-party entities.
NIST AI RMF	MAP Map (opens in a new tab)	Source states	MAP 4.1, 4.2	Risks of components, including third-party data or software, are mapped and their risk controls documented.
NIST AI RMF	MANAGE Manage (opens in a new tab)	Source states	MANAGE 3.1, 3.2	Third-party AI risks are monitored with controls applied, and pre-trained models are monitored as part of regular maintenance.

Tools in this layer (9)

Tools whose category is Model & ML supply-chain security, listed by name. Compare them with Coverage Scores on the Supply chain hub.

Fickling

Trail of Bits · pickle decompiler and static analyzer
674 GitHub stars as of Oct 21, 2026; last push Oct 15, 2026

Open sourceLGPL-3.0
HiddenLayer Model Scanner (AI Supply Chain Security)

HiddenLayer · commercial AI model supply chain scanner

Commercial
Hugging Face Hub malware and pickle scanning

Hugging Face · set of built-in scans on the Hugging Face Hub

Commercial
JFrog ML Model Security (Xray and AI Catalog)

JFrog · commercial scanner for ML models in Artifactory

Commercial
ModelAudit (Promptfoo)

OpenAI (Promptfoo) · open-source static scanner for ML model files
81 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026

Open sourceMIT
ModelScan

Palo Alto Networks (Protect AI) · open-source model file scanner
786 GitHub stars as of Oct 21, 2026; last push Sep 28, 2026

Open sourceApache-2.0
picklescan

Matthieu Maitre · open-source pickle file scanner
428 GitHub stars as of Oct 21, 2026; last push Oct 20, 2026

Open sourceMIT
safetensors

PyTorch Foundation (Linux Foundation) · safe tensor file format for model weights
3,931 GitHub stars as of Oct 21, 2026; last push Oct 6, 2026

Open sourceApache-2.0
Sigstore model-transparency (model-signing)

Sigstore · open-source ML model signing tool
249 GitHub stars as of Oct 21, 2026; last push Oct 19, 2026

Open sourceApache-2.0

Also cover this layer (8)

Our analysis Tools from other categories that document a capability in this layer. Each row names the layer the tool belongs to first and the documented capability our placement rests on.

Tools from other categories that also cover Model and supply chain, with the capability each placement rests on
Tool	Its primary layer	How it applies	Based on
Cisco DefenseClaw888 GitHub stars as of Oct 21, 2026; last push Oct 22, 2026	L7 Agent access	Scans skills and MCP servers before an agent loads them and quarantines critical and high findings.	Scans skills and MCP servers before an agent loads them, wrapping Cisco's skill and MCP scanners; critical and high findings quarantine a skill by default
Cisco MCP Scanner1,096 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents scanning of MCP tools, prompts and resources before a client connects.	Scans MCP server tools, prompts, resources and server instructions, on remote or stdio servers and from client config files; The static subcommand scans pre-generated MCP JSON files offline, in what the README calls CI/CD mode; Static scanning docs list the offline mode as CI/CD ready with air-gapped support, for tools, prompts and resources files; Optional analyzers cover server source code behavior, PyPI and npm packages, vulnerable dependencies and VirusTotal hash lookups
Cisco Skill Scanner2,620 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Scans skill folders for hidden instructions and malicious code before an agent loads them.	Scans agent skills for prompt injection, data exfiltration and malicious code patterns before they run; Static analyzers (YAML and YARA patterns, bytecode, shell pipeline taint) need no key; a behavioral analyzer follows dataflow in Python files; Optional VirusTotal hash checks on binaries and Cisco AI Defense cloud analysis of text, each needing its own key
Lasso MCP Gateway396 GitHub stars as of Oct 21, 2026; last push Jan 22, 2026	L7 Agent access	Documents checks of server reputation and tool descriptions before loading.	Scan option checks MCP server reputation and tool descriptions before loading and can block risky servers
mcp-context-protector226 GitHub stars as of Oct 21, 2026; last push Apr 14, 2026	L7 Agent access	Documents pinning of the approved MCP server configuration.	Pins an approved server configuration and blocks downstream tool calls when it changes until the user approves it again; Pinning compares server instructions, tool descriptions and tool input schemas semantically, ignoring tool and parameter order; Sanitizes ANSI control characters, with an option to show escape codes as visible ESC text
MCP-Scan (Snyk Agent Scan)3,161 GitHub stars as of Oct 21, 2026; last push Oct 21, 2026	L7 Agent access	Documents scanning of MCP servers and skills for tool poisoning, with tool pinning.	Scans MCP servers, including their tools, prompts and resources; Looks for tool poisoning and tool shadowing in MCP tool definitions; Launch post describes tool pinning that tracks changes to tool descriptions through hashing; Risk indicators for MCP servers include private data exposure and destructive capabilities (v0.6 and later)
Noma Security	L2 Discovery	Documents scanning of models from open registries for vulnerabilities.	Scans models from open registries for malicious artifacts, hidden instructions and known vulnerabilities
Palo Alto Networks Prisma AIRS	L2 Discovery	Documents scanning of model files for backdoors and malicious code.	Scans GGUF, Pickle, PyTorch and Safetensors model files for hidden backdoors, malicious code and deserialization flaws

Gaps we can see

No tool in this directory documents MITRE ATLAS mitigation AML.M0007 Sanitize Training Data.

What this layer will not do

A scan finds known unsafe patterns in a file; it does not prove a model is free of backdoors or poisoned behavior. OWASP's LLM04 page says backdoored behavior is hard to test for and detect, and its LLM03 page says that static inspection offers little security assurance for models, which are binary black boxes. Signing proves who published a file and that it has not changed since, not that it is safe. Pair this layer with testing (layer 4) for behavior, and with agent access controls (layer 7) for MCP servers that agents connect to at runtime.

Related guides

Model and supply chain FAQ

Why are pickle model files a risk?

OWASP's LLM04 page warns that shared models can carry malware through malicious pickling, which can execute harmful code when the model is loaded. Model file scanners inspect such files without loading them, and formats that store only tensor data avoid that code path. MITRE ATLAS lists this route as User Execution: Unsafe AI Artifacts.

Does model signing stop poisoned models?

No. Signing and verification show who published a model and that the file has not changed since; MITRE ATLAS lists Code Signing and Verify AI Artifacts as mitigations. A signed model can still carry poisoned behavior, which OWASP's LLM04 page says is hard to test for and detect. Combine signing with dataset provenance and behavior testing.

Why are MCP servers part of the supply chain layer?

The OWASP Agentic Top 10 treats MCP servers and tool descriptors as agentic supply chain components (ASI04) and asks for signed manifests, curated registries and pinning by content hash. So MCP server scanning and pinning count here as a secondary layer, while control of what an agent may do with a tool stays in layer 7.

What does OWASP recommend for third-party models?

Source states: the OWASP LLM03 page says to use models only from verifiable sources with integrity checks through signing and file hashes, to keep an inventory of components in a software bill of materials, to inventory licenses with BOMs, and to apply AI red teaming and evaluations when selecting a third-party model.

Framework sources & last reviewed

Last reviewed October 21, 2026. We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.

Drafted with AI assistance; facts checked against primary sources on October 21, 2026.

OWASP Top 10 for LLM Applications 2025 (list page) (1 sources)