AMARA scans the AI supply chain without running it

Why it surfaced

Its central safety constraint is unusually clear: AMARA treats inspected files as bytes and never loads, imports, or executes them. The homepage demonstrates a terminal scan that quarantines a model containing a dangerous pickle payload calling `subprocess.run(['calc.exe'])`, then describes CI policies and severity-based exit codes.

AMARA inspects models, datasets, and LLM, agent, and MCP code for malware, backdoors, and poisoned content.