AI Model File Viewer & Safety Scan (GGUF, Safetensors, ONNX)

About the AI Model File Viewer & Safety Scan (GGUF, Safetensors, ONNX)

Open a model file straight from your disk and see what it is before you load it anywhere: the format, the architecture, the number of parameters, the quantisation and bits per weight, the context length, every tensor with its shape, type and size, and the file’s metadata. Only the headers are read — slices of the file, never the whole of it — so a multi-gigabyte model opens in seconds, and nothing is uploaded.

It reads GGUF (versions 2 and 3: all the key-value metadata, the tokenizer and the chat template, and the ggml type of every tensor), safetensors (the JSON header, checked for gaps and wrong sizes, and the model.safetensors.index.json of sharded models), ONNX (opsets, inputs and outputs, initializers, the operator counts and the nodes in order) and PyTorch checkpoints and pickles (.pt, .pth, .bin, .ckpt, .pkl). Open two files to compare them tensor by tensor.

The safety scan matters most for pickles: loading one imports and calls whatever it names. The scanner reads the opcodes without running anything, lists every imported callable and flags those that can run commands or reach the system; for GGUF it checks the chat template for template-injection tricks. Without a pass the result is a free preview: the summary card with the verdict and the first tensors; the full tensor table and its CSV, the metadata, the chat template, the ONNX graph, the full import list and the comparison unlock with a Pro pass.

Common uses

• Checking which quantisation a GGUF download really has, and whether it will fit in your GPU’s memory.
• Making sure a checkpoint from an unknown source does not run code when loaded.
• Reading a model’s architecture facts (layers, heads, key-value heads, RoPE base) without loading it.
• Finding the inputs and outputs of an ONNX model before writing the code that calls it.
• Seeing what changed between two fine-tuned versions of the same model.

How the formats are read

• GGUF: the magic GGUF, the version, the tensor and key-value counts, every key-value pair (long arrays such as the vocabulary are counted, not stored) and every tensor’s name, dimensions, ggml type and offset. Sizes come from the type’s block layout: Q4_0 packs 32 weights into 18 bytes (4.5 bits each), Q4_K 256 into 144 (4.5), Q6_K 256 into 210 (6.5625), Q8_0 32 into 34 (8.5). general.file_type gives the label people use, such as Q4_K_M.
• safetensors: an 8-byte little-endian header length, then the JSON header with each tensor’s dtype, shape and byte range; the format forbids gaps and overlaps, so the viewer checks both, and that each range has exactly the bytes its dtype and shape need.
• ONNX: the ModelProto read from the protobuf encoding field by field; weight bytes are skipped, so only the graph is read.
• PyTorch: a checkpoint is a ZIP archive whose data.pkl is a pickle describing the tensors (older checkpoints are a series of pickles); tensor names, types and shapes are rebuilt from the pickle’s structure without running it.

What the safety scan checks

• Pickles (.pt, .pth, .bin, .ckpt, .pkl): every callable the pickle imports through GLOBAL, STACK_GLOBAL or INST, and whether it calls it while loading. Callables are rated with the lists of the open-source scanner picklescan: modules and functions that run commands, open files or sockets or evaluate code (os, subprocess, builtins.eval, runpy, socket and others) are dangerous; the tensor-rebuilding functions and storage classes of plain PyTorch and NumPy weights are expected; everything else is unknown. Imports that cannot be worked out without running the pickle count as dangerous.
• GGUF: a GGUF file holds no code, but its chat template is a Jinja program that runtimes fill in. A runtime that renders it outside a sandbox can be attacked through it (as CVE-2024-34359 showed for llama-cpp-python 0.2.30 to 0.2.71), so the scan flags templates that reach Python internals, call commands or load other templates.
• safetensors and ONNX hold data and graphs, not Python code; an ONNX runtime may still load custom operators an application registers.

The scan lowers the risk of loading an untrusted file; it does not remove it. A pickle can do harm with callables no list names, so load pickles only from sources you trust, prefer safetensors, and keep torch.load(…, weights_only=True), the default of current PyTorch, which allows only tensors, primitive types and dictionaries.

Sources

• GGUF specification — the file format and the ggml types
• ggml-common.h — the block layouts behind bits per weight
• safetensors format — the header and its rules
• onnx.proto — the ONNX model structure
• pickle — Python object serialization and pickletools — the opcodes
• picklescan — the dangerous and expected import lists
• torch.load — weights_only
• GHSA-56xg-wfcc-g829 — chat-template injection in GGUF metadata

Limitations

• The page reads headers and pickles; it does not run the model, check that the weights are sensible, or render the chat template with a conversation.
• Tensor parts (embeddings, attention, MLP, norms) are worked out from tensor names, so unusual names land in “Other”.
• GGUF version 1 files, Keras files, TensorFlow SavedModels, TorchScript archives’ code and ONNX’s flatbuffer format (.ort) are not read.
• Pickles are read up to their first 256 MB; the tensors of a pickle that is not a state dict (a whole model object, for example) may not all be listed.
• The ONNX node list shows up to 1,000 nodes on the page, and the reader keeps the first 5,000.
• The safety scan rates callables by lists: an unknown callable is not proof of harm, and an expected one is not proof of safety.

Privacy

On this device: nothing is sent

Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.