Veritensor
The Anti-Virus for AI Artifacts & RAG Firewall. A static analysis tool scanning Models and Notebooks for RCE, Datasets and RAG docs for Data Poisoning, PII, and Prompt Injections. Secure your AI Supply Chain.
Last verified:
What is Veritensor?
Veritensor is an open-source (Apache 2.0) AI security scanner and MLSecOps platform designed specifically for securing the AI software supply chain. Unlike traditional SAST/SCA tools that focus on code, Veritensor focuses on AI Artifacts: Models (Pickle/PyTorch/Keras/GGUF), Datasets (Parquet/CSV/Excel), and RAG Documents (PDF/Docx). It detects malware in models via Pickle VM emulation, identifies data poisoning in training datasets, scans for prompt injections and PII leaks in RAG pipelines, and audits Agentic AI/MCP server logic for Agent Hijacking risks.
Key features include deep static analysis with custom engines for each artifact type, Hash-to-API verification against Hugging Face Hub for model integrity, Pickle bytecode analysis that emulates stack execution without running code, semantic PII detection using GLiNER zero-shot NER across 100+ languages, stealth detection (CSS-hidden text in PDFs, LSB steganography in images), MCP tool logic scanning for os.system/eval/SQL mutations, and cryptographic manifest generation for AI-SBOM compliance (EU AI Act, SOC2, DORA, CRA). It also supports container signing via Sigstore Cosign and integrates with CI/CD pipelines.
Veritensor is built for ML engineers, MLOps teams, AI security professionals, and enterprises requiring strict AI governance. It serves organizations deploying RAG systems, fine-tuning LLMs, downloading models from Hugging Face, or building Agentic AI applications. The tool is particularly valuable for teams needing to comply with European regulations (EU AI Act, Cyber Resilience Act, NIS2, DORA) and那些 wanting to discover Shadow AI usage across their organization.
The platform offers both a lightweight open-source CLI (~50MB core scanner) and an enterprise Control Plane with centralized asset inventory, active PII sanitization, air-gapped deployment options, and S3 bucket scanning. The CLI runs locally without sending data to the cloud, ensuring zero data exfiltration for sensitive AI projects.
Veritensor pricing
Pricing model: Freemium
Veritensor is 100% open-source (Apache 2.0) and free to use. The Core Scanner (~50MB) is installed via 'pip install veritensor' and scans models (Pickle/Keras), notebooks, and dependencies. The Full Platform (~700MB) with dataset scanning, RAG document support, and PII discovery is free via 'pip install veritensor[all]'. Modular installation allows installing specific extras: [data] for Parquet/Excel, [rag] for PDFs, [pii] for GLiNER, or [aws] for S3. An enterprise Control Plane with centralized asset inventory, active PII sanitization, air-gapped deployment, and S3 bucket scanning is in development - join the waitlist for early access and free security audit consultation. No paid tiers or subscription plans exist for the open-source CLI tool.
Veritensor pros
- 100% open-source under Apache 2.0 license
- Detects Pickle RCE malware via VM emulation without executing code
- Verifies model SHA256 hash against Hugging Face Hub registry
- Scans Parquet/CSV/Excel datasets for data poisoning injections
- Detects prompt injections in RAG PDFs including stealth CSS attacks
- PII discovery using GLiNER zero-shot NER in 100+ languages
- Audits MCP server tool logic for Agent Hijacking risks
- Finds hardcoded AWS keys and HF tokens in Jupyter Notebooks
- Detects restrictive licenses (CC-BY-NC, AGPL) in model metadata
- Integrates with Sigstore Cosign for container signing
- Generates AI-SBOM and cryptographic manifests for compliance
- Smart filtering drops regex false positives to eliminate alert fatigue
- Lightweight core scanner (~50MB) perfect for CI/CD pipelines
- Runs locally with zero data exfiltration to the cloud
- Supports PyTorch, Keras Lambda layers, and GGUF formats
- Scans dependencies for typosquatting via OSV.dev integration
- Detects LSB steganography in images and Excel formula injection
- Permission auditor finds Lethal Trifecta in mcp.json configs
Veritensor cons
- Full platform requires ~700MB disk space with all extras
- Requires spaCy en_core_web_lg model download for full installation
- Open-source CLI lacks centralized dashboard for teams
- Enterprise Control Plane features behind waitlist (not yet available)
- No graphical UI - CLI only for open-source version
- Heavy ML analysis (DeBERTa, EasyOCR) requires Dockerized control plane
- PII detection extra - not included in core scanner
Frequently asked questions about Veritensor
What is Veritensor and what does it do?
Veritensor is an open-source security scanner designed specifically for the AI Supply Chain. Unlike traditional SAST tools that focus on code, Veritensor focuses on AI Artifacts: Models, Datasets, and RAG Documents. It detects malware in Pickle/PyTorch models, data poisoning in Parquet/CSV datasets, prompt injections and PII leaks in RAG pipelines, and Agent Hijacking risks in MCP servers. It answers whether your downloaded model is safe to load, if your PDF contains hidden prompt injections, and whether your dataset is poisoned - all in seconds, locally, without sending data to the cloud.
How does Veritensor detect Pickle malware without executing code?
Veritensor implements a Pickle Virtual Machine (PVM) emulator that statically analyzes pickle bytecode by emulating stack execution. Instead of grepping for dangerous strings like os.system, it parses the pickle VM stack opcodes and finds RCE payloads (like STACK_GLOBAL assembly) without actually executing the code. This catches obfuscated payloads that would bypass simple text-based scanners while remaining completely safe since nothing runs.
How do I verify a model from Hugging Face is authentic?
Run 'veritensor scan ./llama-2-7b.bin --repo meta-llama/Llama-2-7b'. Veritensor calculates the SHA256 hash of your local file (handling Git LFS pointers) and queries the Hugging Face Hub API to verify it matches the upstream registry bit-for-bit. This detects man-in-the-middle attacks, corruption, or tampering. If hashes diverge, the scan fails and blocks deployment.
What file formats does Veritensor support?
Veritensor supports models (Pickle/.pkl, PyTorch/.bin, Safetensors, Keras, GGUF), datasets (Parquet, CSV, Excel/.xlsx), RAG documents (PDF, Docx), Jupyter Notebooks (.ipynb), and configuration files (mcp.json, claude_desktop_config.json, requirements.txt, poetry.lock). The core scanner handles models and notebooks; full installation adds Parquet/CSV/Excel/PDF/Docx support.
How does Veritensor detect prompt injections in PDFs?
Veritensor uses DeBERTa for semantic analysis combined with stealth detection. It finds text hidden via CSS (font-size:0) in PDFs, detects white-text prompt injections in resumes, and identifies semantic prompt injections with confidence scoring. It also scans raw bytes for CSS hacks and uses GLiNER for PII detection. Run 'veritensor scan ./rag_documents --full-scan' for comprehensive RAG document scanning.
What is MCP Agent Hijacking and how does Veritensor detect it?
MCP Agent Hijacking occurs when LLM agents can execute dangerous code autonomously. Veritensor performs pure AST analysis on MCP servers, detecting os.system(), eval(), SQL mutations, and unrestricted file writes inside @mcp.tool() functions. It also audits mcp.json and claude_desktop_config.json for the Lethal Trifecta - filesystem + network + private data access in one server. The MCP scanner activates only for files with MCP decorators, adding zero overhead.
How does Veritensor handle false positives?
Veritensor implements AI Verification that automatically drops regex false positives, eliminating alert fatigue. The Smart Filtering system uses advanced static analysis and ML models rather than simple string matching. For enterprise deployments, there's a Server-Side Suppressions API for handling false positives at scale. The system distinguishes between actual threats and benign patterns through deep analysis of artifact internals.
Can I use Veritensor in air-gapped environments?
The open-source CLI runs completely locally without sending data to the cloud, ensuring zero data exfiltration - perfect for air-gapped environments. The enterprise Control Plane can be deployed inside your VPC with air-gapped deployment options, scanning S3 buckets and data lakes locally. Heavy ML analysis (DeBERTa for semantic injections, EasyOCR for image steganography) can run on Dockerized ML Workers within your isolated network.
How does Veritensor help with AI compliance (EU AI Act, SOC2)?
Veritensor generates cryptographic manifests and AI-SBOMs (Software Bill of Materials) for compliance reporting. The manifest command creates a JSON snapshot of your dataset's security state including model provenance (SHA256 hash + upstream source), dataset integrity hashes, and dependency CVEs. This satisfies EU AI Act, SOC2, DORA, CRA, and NIS2 requirements for transparency, vulnerability tracking, and secure software delivery with one-click auditor reporting.