Model files, MCP servers and an AI bill of materials

AI features bring new kinds of third-party parts: model files downloaded from a hub, datasets, and MCP servers that let an AI assistant call tools. Treat each one the way you treat an open source package. Know where it came from, what it can do and who owns it.

Model files

Some model formats can run code when loaded. Hugging Face’s own documentation says that loading a pickle file can lead to arbitrary code execution, and suggests loading models only from sources you trust or using safer formats such as safetensors. So a model download is not just data. It can be a program.

• Prefer formats that store weights only, not code.
• Record where each model came from, which version and who approved it.
• Load untrusted models in an isolated environment, never on a developer’s main machine.

MCP servers

The Model Context Protocol (MCP) lets AI assistants connect to tools and data. A local MCP server is a program that runs with the user’s permissions. The protocol’s own security guidance describes risks such as malicious startup commands in a client configuration, token passthrough and over-broad scopes.

1. Find out which MCP servers developers have installed, and where they came from.
2. Check what each one can reach: files, network, cloud accounts, source code.
3. Ask for least privilege: narrow scopes, no shared admin tokens.
4. Treat a new MCP server like any new dependency, with an owner and a review.

An AI bill of materials

An AI bill of materials (AIBOM) lists the models, datasets and AI components a system uses, the way a software bill of materials lists packages. CycloneDX, for example, supports a machine learning bill of materials covering models, datasets, their dependencies and provenance. You do not need a perfect one in month one. Start with a table: model, version, source, where it runs, what data it sees, owner.

Rule of thumb:If a team cannot tell you which model version is in production, start there. You cannot respond to a problem with a model you cannot name.