Close Open Privacy Scan

link https://github.com/mlc-ai/mlc-llm
bolt Snapshot: commit a2bcc5c
science engine v1.5
schedule 2026-07-14T18:06:59.775288+00:00

verified_user No application data leak found

No high-confidence exfiltration was found in application code.

smart_toy AI deps detected: openai — detected in dependencies, not a safety judgment.

App Privacy Score

100 /100
Low privacy risk

Low risk · 1 finding(s)

Dependency score: 98 (Low risk)

bar_chart Score Breakdown

No category deductions recorded.

list Scan Summary

0 high 0 medium 1 low
First-party packages: 0
Dependency packages: 1
Ecosystem: java

swap_horiz External domains

169.254.169.254abseil.ioapi.openai.comapi.slack.comapi.telegram.orgapp.neptune.aiarrow.apache.orgarxiv.orgauth.openai.combedrock-mantlebitbucket.orgblog.amjith.comblog.mlc.aibugs.python.orgcdn-datasets.huggingface.cocdn-media.huggingface.cocdn.britannica.comcdn.jsdelivr.netclear.mlclip-cn-beijing.oss-cn-beijing.aliyuncs.comcloud.google.comcolab.research.google.comcollaboration.cmc.ec.gc.cacommonmark.orgconemu.github.iocookbook.openai.comcore.telegram.orgcran.r-project.orgcve.mitre.orgdagshub.comdata-apis.orgdatatracker.ietf.orgdeveloper.mozilla.orgdiscord.comdiscord.ggdiscordpy.readthedocs.iodiscuss.huggingface.codiscuss.pytorch.orgdocs.astral.shdocs.bodo.aidocs.flashinfer.aidocs.h5py.orgdocs.neptune.aidocs.nvidia.comdocs.pydantic.devdocs.pytest.orgdocs.python.orgdocs.pytorch.orgdocs.ray.iodocs.scipy.orgdocs.sqlalchemy.orgdocs.swanlab.cndocs.wandb.aidoi.orgdvc.orgedge.urm.nvidia.comen.wikibooks.orgen.wikipedia.orgen.wikiversity.orgessentia.upf.eduexample-resource.azure.openai.comexslt.orgfarm4.staticflickr.comfastapi.tiangolo.comfishshell.comflashinfer.aiflyte.orgfonts.googleapis.comgiou.stanford.edugist.github.comgithub.comgooseberrycreative.comguillaumejaume.github.iohelp.openai.comhf.cohips.hearstapps.comhost.comhostnamehtml.spec.whatwg.orghttpbin.orghub-ci.huggingface.cohuggingface.coi.postimg.ccimages.cocodataset.orgimages.pexels.comipywidgets.readthedocs.iojson-schema.orgjsonlines.orglearn.microsoft.comllm.mlc.aillvm.orglocalhost.tiangolo.comman7.orgmanagement.azure.commetadata.google.internalmistralai.github.iomlc.aimlir.llvm.orgmodel-spec.openai.commodelcontextprotocol.iomsdn.microsoft.comnineplanets.orgnlp.stanford.edunumba.readthedocs.ionumexpr.readthedocs.ionumpy.orgnvidia.github.ioopenai.comopenaipublic.blob.core.windows.netoptuna.readthedocs.iopaddle-model-ecology.bj.bcebos.compandas.pydata.orgparquet.apache.orgpbs.twimg.complatform.openai.compresbrey.mit.eduproceedings.neurips.ccpygments.orgpyperclip.readthedocs.iopypi.orgpytorch.orgqianwen-res.oss-cn-beijing.aliyuncs.comqwenlm.github.ioraw.githubusercontent.comrequests.readthedocs.iorrc.cvc.uab.ess3.amazonaws.comsafetensors-convert.hf.spacesethmlarson.devspdx.devspecs.frictionlessdata.iostackoverflow.comstorage.googleapis.comsuno-ai.notion.sitesupport.sas.comswagger.ioswanlab.cntest.pypi.orgthinkingmachines.aithumbs.dreamstime.comtimeapi.iotqdm.github.iotvm.apache.orgtwitter.comtyper.tiangolo.comunpkg.comvt100.netwebllm.mlc.aiwebsockets.readthedocs.iowww.apache.orgwww.comet.comwww.cs.cmu.eduwww.deepmind.comwww.delorie.comwww.dvc.orgwww.github.comwww.ilankelman.orgwww.json.orgwww.kxan.comwww.microsoft.comwww.mlflow.orgwww.nature.comwww.nvidia.comwww.opm.govwww.paddleocr.aiwww.python.orgwww.starlette.devwww.stata.comwww.statsmodels.orgwww.tensorflow.orgwww.w3.orgwww.w3schools.comwww.wandb.comwww.youtube.comxarray.pydata.orgxlrd.readthedocs.io

</> Dependencies

com.google.code.gson:gson

java dependency
expand_more 1 low-confidence finding(s)
low env_fs dependency Excluded from app score #261987693360c0a5 — Environment-variable access.
pkgs/java/[email protected]/com/google/gson/internal/JavaVersion.java:29 
    String javaVersion = System.getProperty("java.version");

Reads environment variables or the filesystem — an inventory-level capability, not a leak on its own.

Fix: Usually benign; confirm any secret read here is not later sent externally.

Skipped dependencies

Production

  • torch prod — no sdist (wheels only)
  • androidx.core:core-ktx prod — no sources jar (404)
  • androidx.lifecycle:lifecycle-runtime-ktx prod — no sources jar (404)
  • com.github.jeziellago:compose-markdown prod — no sources jar (404)
  • androidx.activity:activity-compose prod — no sources jar (404)
  • androidx.lifecycle:lifecycle-viewmodel-compose prod — no sources jar (404)
  • androidx.compose.material3:material3 prod — no sources jar (404)
  • androidx.appcompat:appcompat prod — no sources jar (404)
  • androidx.navigation:navigation-compose prod — no sources jar (404)
  • com.google.android.material:material prod — no sources jar (404)
  • org.jetbrains.kotlinx:kotlinx-serialization-json prod — no java source in jar