Two releases this week, both ending in 4. More on that number at the end.

Hayward 1.4: a guard at the door

A pickle file is a program that happens to be called model.pt. torch.load, joblib.load and numpy.load(allow_pickle=True) run it. Hayward has always read model files without running them. Now it also watches while you load them:

Python
import hayward.guard

Our first guard scanned the file, declared it clean, and handed it to the loader. Our own reviews then found files that the scanner and the loader read differently. Same bytes, two opinions, one payload. So the guard moved to the one door every payload has to use: to run code, a pickle must ask Python for a function, and Python announces every request. The guard refuses the dangerous ones before they are imported.

Default mode is a bouncer who knows the usual troublemakers. install(strict=True) is a guest list: anything not on Hayward’s known-safe list stays outside. Use the guest list for files from strangers. Neither is a sandbox, and the usage guide says what they miss.

Your coding agent can also ask Hayward first, over MCP:

Rowan 0.4: the MCP release

Rowan reads AI and agent code and traces untrusted input to dangerous calls. The last release taught it MCP: it finds tools however they are registered, in Python and TypeScript, and its hidden-Unicode checks now read SKILL.md and agent instruction files.

For 0.4 we hand-checked its findings on a random sample of 300 MCP servers from the official registry, then fixed what it got wrong:

  • regex.exec() runs a regex, not your shell. Rowan now agrees.
  • A URL with a fixed host is not SSRF, and your-api-key-here is not a leaked secret.
  • “This leads to a dangerous call” now only travels through calls that actually pass the risky value along.

Why 4

A private key should be a random 384-bit number. This week, one certificate authority’s turned out to be 4. We felt 4 deserved better, so it got two releases.

Try it

Shell
pip install -U hayward
pipx install "rowan-sast[js-crossfile]"

Both are MIT licensed and never run the code they read. Found something either one gets wrong? Tell us at hello@hedgerow.dev.