Local AI security scanner

Your AI is local.
Is it cooked?

One Bash script checks your model servers, containers, agent configs, and MCP grants for the mistakes that get local AI owned. It reads. It never fixes, phones home, or starts anything. 

curl -fsSL https://iscooked.com/iscooked.com | bash

Prefer to read it first?

Linux · macOS · Bash 4+ · No account · No telemetry

Example scan · synthetic output 
~ $ bash iscooked.com                    __            __       __  _________  ____  / /_____  ____/ /  ____/ /_ / ___/ __ \/ __ \/ //_/ _ \/ __  /  / ___/ __ \/ /__/ /_/ / /_/ / ,< /  __/ /_/ /_ (__  ) / / /\___/\____/\____/_/|_|\___/\__,_/(_)____/_/ /_/  Am I Cooked? — Local AI Security Scanner v1.3.1  https://iscooked.com  Scanning your setup...──────────────────────────────────────────────────────────────  [01] Network Exposure  ────────────────────────────────────────────────────────  🔥 COOKED  Unidentified service on port 8000 (commonly vLLM) is listening on ALL interfaces  ✅ SAFE  Unidentified service on port 1234 (commonly LM Studio) is bound to localhost only  [02] API Authentication  ────────────────────────────────────────────────────────  ⚠  WARMING UP  Ollama /api/tags on port 11434 accessible without authentication on localhost; other routes were not tested  [03] Model File Permissions  ────────────────────────────────────────────────────────  🔥 COOKED  Files in /srv/models are world-writable!  [04] Docker / Container Risks  ────────────────────────────────────────────────────────  ✅ SAFE  Container 'open-webui' is running as user 'app'  ⚠  WARMING UP  Container 'open-webui' is using host networking  [05] GPU Driver Exposure  ────────────────────────────────────────────────────────  ⏭  SKIP  No GPU devices detected  [06] Telemetry / Phoning Home  ────────────────────────────────────────────────────────  ⏭  SKIP  No supported opt-out evidence found  [07] Firewall Status  ────────────────────────────────────────────────────────  ✅ SAFE  UFW firewall is active  [08–17] 10 more areas skipped in this example──────────────────────────────────────────────────────────────  YOUR COOKED SCORE  28% cooked  [▒▒▒▒▒▒▒▒▒▒▒                             ]  SLIGHTLY WARM  2 critical  2 warnings  3 passed  0 unknown  12 skipped  (19 results)  Fix critical findings first.~ $
Example data. This page does not scan your device.
Checks for Ollama LM Studio vLLM Docker MCP OpenClaw
What it examines

Seventeen places
things go wrong.

Each check reports what it saw and what it could not see. A skipped check never counts as safe.

Network & access

01.1Network exposureFind listeners on common AI ports.
The scanner identifies loopback and non-loopback bindings. A network listener does not prove internet access or identify the application.
01.2API authenticationExamine model-list routes on identified services.
Supports Ollama, LM Studio, and vLLM on their common ports. An authentication result applies only to the route examined.
01.3Firewall statusSeparate active, inactive, and unknown states.
Examines recognized firewall backends. Missing access or an unexpected response can produce an unknown result.
01.4Plain HTTP exposureFind exposed services that use plain HTTP.
The SSL/TLS check examines common ports. It does not validate certificates or all encryption settings.

Files & secrets

02.1Model file permissionsFind model files that other users can read or change.
Examines common model directories and their permissions. Coverage depends on directory access and the model locations.
02.2Sensitive filesFind exposed environment files and ownership risks.
Uses bounded searches for key-like values in environment files. It reports findings without displaying credentials.
02.3History & logsFind possible keys in history and exposed log directories.
Examines known shell-history patterns and common AI log locations. It does not find every secret or examine every log file.

Containers & hardware

03.1Docker configurationExamine users, privileges, sockets, and host access.
Includes host networking, daemon sockets, and host-root mounts. Metadata requests have a time limit. The scanner does not change containers.
03.2GPU exposureExamine GPU device access and management listeners.
Includes supported NVIDIA and AMD device checks. Device access alone does not establish that a system is compromised.
03.3AI processesFind known AI processes and their users.
Matches known process names and identifies processes that run as root. It does not identify every AI application.

Agents & models

04.1Ollama configurationExamine host, origin, and service settings.
Includes OLLAMA_HOST, OLLAMA_ORIGINS, and supported service-manager configuration.
04.2Browser controlFind browser debugging listeners, including custom ports.
Uses Chromium process flags, sockets, and version metadata. It does not retrieve browser tabs, cookies, or WebSocket content.
04.3MCP configurationExamine filesystem grants and configuration permissions.
Model Context Protocol (MCP) checks support selected Claude Desktop, Claude Code, and Cursor JSON files. The scanner never starts an MCP server.
04.4OpenClaw gatewayExamine authentication and tool settings for OpenClaw CLI 2026.9.3 and later.
The check reads the OpenClaw CLI version and selected global policies in strict JSON. JSON5, includes, and unsupported overrides produce incomplete coverage.
04.5Remote model codeFind remote-code flags in active vLLM, TGI, and SGLang commands.
The check examines recognized launch arguments. It does not load model code or establish the behavior of other runtimes.
04.6Telemetry settingsExamine opt-out variables and known blocked domains.
Examines supported environment variables and exact hosts-file entries. It does not analyze active telemetry traffic.
04.7Runtime versionsFlag Ollama, vLLM, and LiteLLM proxy versions with known advisories, and LiteLLM releases that shipped malware.
Reads one version route per runtime on its default port and compares it with a reviewed minimum. A current version does not rule out advisories published after the review date. It also looks in common Python environments and local Docker tags for LiteLLM 1.82.7, 1.82.8, and 1.107.0, which were published with a credential stealer, and for the files that stealer drops.

Checks can be skipped or incomplete. A low score is not a security guarantee.

How the score works

Check the
doneness.

Every finding adds heat. Change the counts and watch the verdict move. This uses the same rules as the scanner.

Critical🔥 COOKED · examine first +10 each
Warning⚠ WARMING UP · needs attention +4 each
Unknown❓ UNKNOWN · could not verify +4 each
Passed✅ SAFE · check passed +0
Skipped⏭ SKIP · not examined +0
28% SLIGHTLY WARM 
  28% cooked  [▒▒▒▒▒▒▒▒▒▒▒                             ]

  SLIGHTLY WARM

  2 critical  2 warnings  3 passed
  0 unknown  12 skipped  (19 results)

  Fix critical findings first.

2 × 10 + 2 × 4 = 28. Any critical finding turns the verdict red, whatever the number.

The total stops at 100. The score is a capped heuristic, not a probability of compromise. Resolve unknown results · Read the scoring guide

New · Report viewer

Plate your
report.

Save a JSON report and open it in the viewer. Findings get grouped by check, unknowns link to their fix, and you can copy a clean summary for an issue or a teammate.

  1. 01
    Run bash iscooked.com --json > cooked.json
  2. 02
    Drop cooked.json into the viewer.
  3. 03
    The file is read by your browser. The viewer page blocks all network requests.
Open the report viewer
CriticalPort 8000 listens on all interfaces
CriticalFiles in /srv/models are world-writable
WarningOllama model list needs no authentication
WarningContainer uses host networking
UnknownDocker daemon inspection incomplete · next step
PassedUFW firewall is active
SkippedNo GPU devices detected
Run it

Your machine.
Your scan.

Read the source. Run the scanner. Examine the findings.

  1. Get the script
  2. Run it locally
  3. Examine the result

Quick run

Downloads and runs the script in your terminal.

curl -fsSL https://iscooked.com/iscooked.com | bash

Download & read

1. Download the script and read it.

curl -fsSL https://iscooked.com/iscooked.com -o iscooked.com &&
less iscooked.com

2. Start it when you are ready.

bash iscooked.com

Save a report

1. Write one JSON report. Requires Python 3.

bash iscooked.com --json > cooked.json

2. Open it in the report viewer. Add --fail-on critical to exit 1 when a critical finding occurs.

Linux or macOS · Bash 4+Read the source

Before you run it: run bash --version. The scanner requires Bash 4 or later. On macOS, the system Bash can be too old. Use the path to your newer Bash executable if necessary.

Python 3 enables structured checks. Missing optional tools cause skipped checks. Unknown or skipped results? Find the next step.

Use bash iscooked.com --help for options. Full requirements ↗

Open source · MIT License · v1.3.1

Before you run it.

Does it change my settings?

No. The scanner examines local settings. It does not apply fixes, start agents, or load models. You decide which settings to change.

Does anything leave my machine?

The initial command downloads the script. The scanner sends no telemetry or scan report. It probes selected local AI and browser service endpoints.

Does the report viewer upload my report?

No. Your browser reads the file. The viewer page is served with a content security policy that blocks every network request, so the page cannot send the report anywhere.

What does the score mean?

Critical findings add 10 points. Warnings and unknown findings add 4. Passed and skipped checks add none. The maximum is 100. A low score does not establish that your system is safe.

What can it miss?

Unsupported tools, inaccessible files, missing dependencies, and configuration formats can limit coverage. A skipped check does not establish safety. Read the coverage limits ↗

Why is it called iscooked?

Because "am I cooked?" is the question you ask after you notice Ollama listening on 0.0.0.0. The scanner answers it with evidence.