Validation Sweep Results

33 MCP servers + 79 HuggingFace models scanned with Oxvault Scanner v0.4.1 on 2026-05-11. Full transparency — every finding is public.

112

Total

MCP

HF Models

Critical

High

1808

Warning

93%

Precision

12/12

CVE Rate

Artifact	Class	Status	Findings	Critical	High	Top Rule
wonderwhy-er/DesktopCommanderMCP	MCP	critical	24	1	0	mcp-install-hook-env-access (22)
mcpotato/42-eicar-street	HF Model	critical	6	1	0	aibom-signature-missing (3)
github/github-mcp-server	MCP	critical	31	1	0	mcp-cmd-injection (31)
HuggingFaceTB/SmolLM-360M	HF Model	high	464	0	1	aibom-onnx-custom-operator (448)
HuggingFaceTB/SmolLM-135M	HF Model	high	436	0	1	aibom-onnx-custom-operator (420)
BAAI/bge-base-en-v1.5	HF Model	high	9	0	1	aibom-signature-missing (3)
BAAI/bge-small-en-v1.5	HF Model	high	9	0	1	aibom-signature-missing (3)
microsoft/DialoGPT-small	HF Model	high	4	0	1	aibom-signature-missing (2)
facebook/m2m100_418M	HF Model	high	4	0	1	aibom-modelcard-suspicious-instructions (1)
microsoft/speecht5_tts	HF Model	high	4	0	1	aibom-modelcard-suspicious-instructions (1)
gitingest-app/gitingest-mcp	MCP	high	1	0	1	mcp-destructive-fs (1)
sentence-transformers/all-mpnet-base-v2	HF Model	warning	133	0	0	aibom-onnx-custom-operator (111)
sentence-transformers/all-MiniLM-L12-v2	HF Model	warning	130	0	0	aibom-onnx-custom-operator (108)
sentence-transformers/all-distilroberta-v1	HF Model	warning	94	0	0	aibom-onnx-custom-operator (72)
cross-encoder/ms-marco-MiniLM-L-6-v2	HF Model	warning	88	0	0	aibom-onnx-custom-operator (66)
sentence-transformers/multi-qa-MiniLM-L6-cos-v1	HF Model	warning	76	0	0	aibom-onnx-custom-operator (54)
sentence-transformers/all-MiniLM-L6-v2	HF Model	warning	76	0	0	aibom-onnx-custom-operator (54)
sentence-transformers/paraphrase-MiniLM-L6-v2	HF Model	warning	76	0	0	aibom-onnx-custom-operator (54)
intfloat/e5-base-v2	HF Model	warning	60	0	0	aibom-onnx-custom-operator (48)
intfloat/e5-small-v2	HF Model	warning	48	0	0	aibom-onnx-custom-operator (36)
thenlper/gte-small	HF Model	warning	48	0	0	aibom-onnx-custom-operator (36)
google-t5/t5-small	HF Model	warning	21	0	0	aibom-signature-missing (10)
bigscience/bloom-560m	HF Model	warning	13	0	0	aibom-signature-missing (5)
openai-community/gpt2	HF Model	warning	11	0	0	aibom-signature-missing (5)
sentence-transformers/sentence-t5-base	HF Model	warning	12	0	0	aibom-signature-missing (4)
hf-internal-testing/tiny-random-bert	HF Model	warning	9	0	0	aibom-signature-missing (3)
dslim/bert-base-NER	HF Model	warning	7	0	0	aibom-signature-missing (3)
google-bert/bert-base-uncased	HF Model	warning	6	0	0	aibom-signature-missing (3)
openai/clip-vit-large-patch14	HF Model	warning	6	0	0	aibom-signature-missing (2)
microsoft/mpnet-base	HF Model	warning	4	0	0	aibom-signature-missing (2)
Helsinki-NLP/opus-mt-fr-en	HF Model	warning	4	0	0	aibom-signature-missing (2)
hf-internal-testing/tiny-random-distilbert	HF Model	warning	5	0	0	aibom-modelcard-no-license (1)
hf-internal-testing/tiny-random-gpt2	HF Model	warning	6	0	0	aibom-signature-missing (2)
FacebookAI/xlm-roberta-base	HF Model	warning	6	0	0	aibom-signature-missing (3)
Qwen/Qwen2.5-0.5B	HF Model	warning	3	0	0	aibom-modelcard-no-source (1)
albert/albert-base-v2	HF Model	warning	4	0	0	aibom-signature-missing (2)
facebook/bart-base	HF Model	warning	6	0	0	aibom-signature-missing (2)
openai/clip-vit-base-patch32	HF Model	warning	4	0	0	aibom-modelcard-no-license (1)
microsoft/codebert-base	HF Model	warning	2	0	0	aibom-modelcard-no-license (1)
distilbert/distilbert-base-uncased	HF Model	warning	4	0	0	aibom-signature-missing (2)
google/flan-t5-small	HF Model	warning	6	0	0	aibom-signature-missing (2)
EleutherAI/gpt-neo-125m	HF Model	warning	6	0	0	aibom-signature-missing (2)
google/mobilenet_v2_1.0_224	HF Model	warning	6	0	0	aibom-signature-missing (2)
facebook/nllb-200-distilled-600M	HF Model	warning	3	0	0	aibom-modelcard-clean (1)
Helsinki-NLP/opus-mt-de-en	HF Model	warning	2	0	0	aibom-modelcard-no-source (1)
Helsinki-NLP/opus-mt-en-es	HF Model	warning	2	0	0	aibom-modelcard-no-source (1)
Helsinki-NLP/opus-mt-en-fr	HF Model	warning	2	0	0	aibom-modelcard-no-source (1)
Helsinki-NLP/opus-mt-en-ro	HF Model	warning	2	0	0	aibom-modelcard-no-source (1)
Helsinki-NLP/opus-mt-es-en	HF Model	warning	2	0	0	aibom-modelcard-no-source (1)
EleutherAI/pythia-160m	HF Model	warning	6	0	0	aibom-signature-missing (2)
EleutherAI/pythia-70m	HF Model	warning	6	0	0	aibom-signature-missing (2)
microsoft/resnet-18	HF Model	warning	6	0	0	aibom-signature-missing (2)
microsoft/resnet-50	HF Model	warning	6	0	0	aibom-signature-missing (2)
FacebookAI/roberta-base	HF Model	warning	4	0	0	aibom-signature-missing (2)
deepset/roberta-base-squad2	HF Model	warning	6	0	0	aibom-signature-missing (2)
FacebookAI/roberta-large-mnli	HF Model	warning	4	0	0	aibom-signature-missing (2)
microsoft/swin-tiny-patch4-window7-224	HF Model	warning	6	0	0	aibom-signature-missing (2)
google-t5/t5-base	HF Model	warning	4	0	0	aibom-signature-missing (2)
hf-internal-testing/tiny-random-bart	HF Model	warning	4	0	0	aibom-pickle-pytorch-zip (1)
hf-internal-testing/tiny-random-pegasus	HF Model	warning	4	0	0	aibom-pickle-pytorch-zip (1)
hf-internal-testing/tiny-random-roberta	HF Model	warning	4	0	0	aibom-pickle-pytorch-zip (1)
hf-internal-testing/tiny-random-t5	HF Model	warning	4	0	0	aibom-pickle-pytorch-zip (1)
google/vit-base-patch16-224	HF Model	warning	6	0	0	aibom-signature-missing (2)
facebook/wav2vec2-base-960h	HF Model	warning	6	0	0	aibom-signature-missing (2)
openai/whisper-base	HF Model	warning	6	0	0	aibom-signature-missing (2)
openai/whisper-small	HF Model	warning	6	0	0	aibom-signature-missing (2)
openai/whisper-tiny	HF Model	warning	6	0	0	aibom-signature-missing (2)
Qwen/Qwen2.5-0.5B-Instruct	HF Model	warning	3	0	0	aibom-modelcard-clean (1)
TinyLlama/TinyLlama-1.1B-Chat-v1.0	HF Model	warning	3	0	0	aibom-modelcard-clean (1)
Salesforce/blip-image-captioning-base	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
Salesforce/codegen-350M-mono	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
Salesforce/codet5-small	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
facebook/convnext-tiny-224	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
microsoft/deberta-v3-base	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
facebook/deit-base-distilled-patch16-224	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
sshleifer/distilbart-cnn-12-6	HF Model	warning	2	0	0	aibom-modelcard-clean (1)
facebook/dpr-question_encoder-single-nq-base	HF Model	warning	2	0	0	aibom-modelcard-clean (1)
google/electra-small-discriminator	HF Model	warning	2	0	0	aibom-modelcard-clean (1)
makenotion/notion-mcp-server	MCP	warning	8	0	0	mcp-env-read (7)
facebook/opt-125m	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
facebook/opt-350m	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
Helsinki-NLP/opus-mt-en-de	HF Model	warning	2	0	0	aibom-modelcard-clean (1)
cardiffnlp/twitter-roberta-base-sentiment-latest	HF Model	warning	4	0	0	aibom-modelcard-clean (1)
stripe/agent-toolkit	MCP	✓ clean	0	0	0	-
tinyfish-io/agentql-mcp	MCP	✓ clean	0	0	0	-
domdomegg/airtable-mcp-server	MCP	✓ clean	0	0	0	-
upstash/context7	MCP	✓ clean	0	0	0	-
exa-labs/exa-mcp-server	MCP	✓ clean	0	0	0	-
firecrawl/firecrawl-mcp-server	MCP	✓ clean	0	0	0	-
shinzo-labs/hubspot-mcp	MCP	✓ clean	0	0	0	-
ferrislucas/iterm-mcp	MCP	✓ clean	0	0	0	-
salesforcecli/mcp	MCP	info	5	0	0	mcp-env-read (5)
MarkusPfundstein/mcp-obsidian	MCP	✓ clean	0	0	0	-
e2b-dev/mcp-server	MCP	✓ clean	0	0	0	-
Flux159/mcp-server-kubernetes	MCP	✓ clean	0	0	0	-
benborla/mcp-server-mysql	MCP	✓ clean	0	0	0	-
neondatabase/mcp-server-neon	MCP	✓ clean	0	0	0	-
neondatabase-labs/mcp-server-neon	MCP	✓ clean	0	0	0	-
qdrant/mcp-server-qdrant	MCP	✓ clean	0	0	0	-
BurtTheCoder/mcp-shodan	MCP	✓ clean	0	0	0	-
mongodb-js/mongodb-mcp-server	MCP	✓ clean	0	0	0	-
microsoft/playwright-mcp	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
modelcontextprotocol/servers	MCP	✓ clean	0	0	0	-
tavily-ai/tavily-mcp	MCP	✓ clean	0	0	0	-