An AI application depends on more than a model endpoint. Downloaded artifacts, inference libraries, tool servers, connectors, and deployment configuration can all influence what runs and what it can reach. A supply-chain review should follow those components through their lifecycle, from selection to replacement, rather than treating the model as an isolated purchase.
Ask what happens when the artifact is loaded
Some formats contain more than inert weights. Hugging Face’s pickle-scanning documentation explains that loading a malicious pickle can execute arbitrary code and describes limits of scanning. This does not mean every model format executes code; it means the loader and serialization format belong in the security decision.
Record where the artifact came from, its version and digest, how it is loaded, and whether custom code runs during initialization. Favor formats and loading modes that avoid unnecessary execution, while still reviewing any associated code and dependencies. A positive scan result is a reason to investigate. A clean scan should be one piece of evidence, not a substitute for provenance and controlled execution.
Treat a tool server as an application with authority
An integration protocol does not settle whether a particular server is safe to run or connect. Inspect its publisher, execution environment, network access, credentials, and the operations it exposes. A local process and a remotely hosted service create different review questions. In either case, the business should understand why the connection is needed.
The MCP security guidance addresses concerns including authorization and token handling. Our operating recommendation is to approve the specific server, version, transport, and permissions as a unit. Avoid treating a protocol name as a certification of all implementations. Changes to a server or its tool definitions should trigger a review proportional to the authority involved.
Keep an inventory that can answer an incident question
When a component is found to be unsafe, the urgent question is which workflows use it and what it could access. A list of approved vendors alone will not answer that. Connect component versions and deployment locations to application owners, credentials, data sources, and the business activities they support.
For Meridian’s supplier-analysis workflow, the record might link a document parser, model artifact, retrieval service, and supplier-system connector. The parser’s role is different from the connector’s authority. That distinction helps responders isolate the affected path rather than disable every AI application. Include the source of updates and the owner who decides when a new version enters production.
Make replacement and revocation routine
Pinning a reviewed version helps with reproducibility, but it does not make that version safe indefinitely. Review security notices, plan updates, and retain a tested way to replace a component or remove its access. Separate the production credentials from experimental environments so a trial does not inherit the authority of the live service.
Rehearse a focused incident: an approved tool server is withdrawn, a dependency needs an urgent update, or a model artifact can no longer be trusted. Identify the owner, the revocation path, the workflows that stop, and the evidence needed to restore service. The result should be a repeatable operating response. Buying another scanner cannot by itself establish those decision rights.