Download with NGC CLI

After scanning a NIM container, use the NVIDIA GPU Cloud (NGC) CLI to download model artifacts listed in summary.referenced_models. Supply Chain does not download these files during the container scan. See NIM Container Scanning for manifest parsing and advisory details.

• ngc:// is not a supported --input scheme. Supply Chain accepts local paths, cloud storage URLs, Hugging Face URLs, and oci:// container references — not ngc:// artifact URIs.
• NGC serves model files over authenticated HTTPS APIs. Individual model artifacts require NGC credentials (NGC_API_KEY) to download.
• The scanner does not pass NGC credentials to artifact download endpoints. While NGC_API_KEY is used to pull oci://nvcr.io/nim/... container images, that credential is not applied when fetching files referenced by ngc:// URIs in the manifest.

1. Create an API key in the NGC portal.

2. Set the environment variable:

   export NGC_API_KEY=<your-api-key>

3. Configure the CLI:

   ngc config set

   Provide your API key when prompted.

Referenced models from a NIM container scan use this URI format:

ngc://{org}/{team}/{model}:{version}?file={filename}

Map the URI to an NGC CLI download command:

Example:

After downloading artifacts, scan the files locally using Supply Chain CLI. See Scanning a single file in Usage Examples for docker run commands.