scanned 18d ago·osv · gitleaks · opengrep · picklescan + heuristics·full breakdown in the Security tab ↓
Melting Pot — Multi-Agent RL Test Suite
Melting Pot is a Google DeepMind research suite with 50+ multi-agent social scenarios designed to evaluate generalization in MARL — can an agent trained in one social context transfer to novel partners and situations? Scenarios cover cooperation dilemmas, competitive games, resource harvesting, and commons management.
Key features
50+ scenarios across cooperation, competition, mixed motives, and signaling
Population-based evaluation protocol for measuring generalization (not just peak performance)
Built on DeepMind Lab2D for grid-world environments
Reference baseline agents (MEME, A3C) and evaluation metrics included
Python API compatible with RLlib, ACME, and custom training loops
Quick start
pip install dm-meltingpot
import meltingpot
env = meltingpot.substrate.build("commons_harvest__open",
roles=["default"] * 5)
step = env.reset()
for _ in range(500):
actions = [env.action_space[i].sample() for i in range(5)]
step = env.step(actions)
env.close()
npx ai-supply add meltingpot-multiagent-rl
Curated mirror of the open-source Melting Pot (Apache-2.0). Get it from the source.
! Security: Review · 8888/100 · grade Bscanned 18d ago
✓ no compromise signals9 risk-surface · 7/20 OWASP controls flagged
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
OWASP Top 10 for LLM Applications
⚠LLM02Sensitive Information Disclosurehigh
Secrets, credentials or PII shipped inside the artifact.
•IBAN-like number present — contains a string matching the IBAN format · google-deepmind-meltingpot-cfedcdf/meltingpot/configs/substrates/allelopathic_harvest.py (CWE-359)expected
PII or plaintext source leakage in embedding/vector exports.
Embedding inversion/poisoning is largely runtime; static check covers PII in vector exports.
•IBAN-like number present — contains a string matching the IBAN format · google-deepmind-meltingpot-cfedcdf/meltingpot/configs/substrates/allelopathic_harvest.py (CWE-359)expected
Poisoned training datasets with triggers or anomalous distributions.
Static check covers trigger phrasing, PII and label skew; full poisoning detection is runtime.
•IBAN-like number present — contains a string matching the IBAN format · google-deepmind-meltingpot-cfedcdf/meltingpot/configs/substrates/allelopathic_harvest.py (CWE-359)expected
Tampered model weight files; integrity must be verifiable.
Static check enforces safe formats + records a content hash for downstream verification.
Other findings (7) · hygiene / uncategorized
•Unrecognized file type — '.?' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/.devcontainer/Dockerfilerisk surface
•Unrecognized file type — '.gitignore' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/.gitignorerisk surface
•Unrecognized file type — '.pylintrc' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/.pylintrcrisk surface
•Unrecognized file type — '.python-version' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/.python-versionrisk surface
•Unrecognized file type — '.bib' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/CITATION.bibrisk surface
•Unrecognized file type — '.in' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/examples/requirements.inrisk surface
•Unrecognized file type — '.lua' is not on the allowlist · google-deepmind-meltingpot-cfedcdf/examples/tutorial/harvest/levels/harvest/init.luarisk surface