Melty guide / Safety check / October 12, 2026

Is Melty safe?
What can be verified.

People ask whether melty.gg is safe, a virus, malware or legit. We found no published independent audit of the launcher, so an honest page cannot answer yes or no. This one shows what public records say, with a source and a date on every finding.

Update: October 14, 2026. The official download now points to Melty-Setup-1.0.112.exe (103,894,160 bytes). The scans, signature details and reputation counts below were recorded on October 12, for the files and domains named in each finding. They do not certify the current installer. We did not re-verify its signature or antivirus results. The look-alike site’s download also changed; its current file has not been analysed here.

We rechecked the official site, download instructions, terms, privacy policy and Y Combinator listing on October 14. The current privacy policy also describes failure-log uploads; see the permissions section below. We have not installed or run either installer.

Short answer, as of October 12, 2026. No verdict. Six historical checks are on record:

The installer melty.gg served that day (version 1.0.94) was flagged by 0 of 67 antivirus engines on VirusTotal and has a valid code signature.
The domain was 11 days old. One of 92 reputation vendors labels it malware and two label it suspicious; Google Safe Browsing reports no unsafe content.
We found no public source code for the launcher and no published independent audit.
We have not inspected the installed app, its updater or its network traffic.
The app asks for broad access to your PC, described in its own terms.
On October 12, a look-alike site, melty.world, served a different, unsigned file under Melty’s name.

We have not installed Melty and are not affiliated with it or with Stella Montis Inc.

Is melty.gg legit? Who is behind it

A named company operates it

What we found: Melty’s terms identify the operator as Stella Montis Inc. and give a contact address at melty.gg. Y Combinator’s company directory lists “Melty” in its Fall 2026 batch, based in San Francisco, with https://www.melty.gg as the website and David Miller as founder.
Source: Melty Terms of Service (last updated October 6, 2026); Y Combinator directory entry
Checked: October 12, 2026
Does not prove: That the software is safe. An accelerator listing is a business fact, not a security review.

The domain is days old

What we found: melty.gg was registered on October 1, 2026 through Namecheap, with the registrant’s identity redacted. The HTTPS certificate it uses was issued the same day. On our check date the domain was 11 days old.
Source: The .gg registry’s WHOIS server (run whois -h whois.gg melty.gg); certificate dates from the VirusTotal domain record
Checked: October 12, 2026
Does not prove: Anything about intent. Age only tells you the domain is new; we did not establish a longer operating history. Gridinsoft’s report, below, names the young domain as one reason for its low score.

Is Melty a virus? What antivirus scans show

The official installer: 0 of 67 engines flagged it

What we found: On October 12, 2026, the download button on melty.gg served Melty-Setup-1.0.94.exe (103,779,568 bytes). VirusTotal’s report for that exact file shows 0 of 67 engines flagging it, analysed 2026-10-12 08:20 UTC. We did not download or run the file: we read its checksum from the download server’s response headers and looked that up, and the file name and byte size match. SHA-256: ac6f15b8aaf27d2e24674771091916f306f502d2ec65dddbeda694c71fac3d51
Source: VirusTotal file report
Checked: October 12, 2026
Does not prove: That the file is harmless. A zero-detection result is not proof of safety. The result covers version 1.0.94 only, and Melty updates itself.

The installer is code-signed

What we found: VirusTotal reports “Signed file, valid signature” for version 1.0.94. The signer name is David Miller, on a certificate issued under Microsoft’s ID Verified code-signing chain, signed 2026-10-12 08:04 UTC. That is the same name Y Combinator lists as Melty’s founder. The signer is an individual’s name, not “Stella Montis Inc.”
Source: VirusTotal file details, “Signature info”
Checked: October 12, 2026
Does not prove: That the program behaves well. A signature shows who signed the file and that it was not altered afterwards. A missing or invalid validation result needs investigation; it does not by itself identify a different or malicious file. Use the recorded hash to identify the specific historical file.

The website: one vendor says malware, two say suspicious

What we found: VirusTotal’s record for the domain melty.gg shows 1 of 92 vendors flagging it as malicious (Fortinet, labelled “Malware”) and two rating it “Suspicious” (Gridinsoft and SOCRadar). The rest rate it clean or give no rating; Google Safe Browsing, Kaspersky, BitDefender, ESET and Sophos are among the “Clean” results in that October 12 snapshot. In the installer scan above, Fortinet’s file engine returned “Undetected” for version 1.0.94. Google’s Safe Browsing page at that check reported no unsafe content found. Gridinsoft’s public report (dated October 10) scores the site 47/100 and lists its reasons: two blacklist hits, a nine-day-old domain and limited reputation data. It also carries one user review, dated October 6, which reads “Malicious application is installed when you download the exe” and gives no further detail.
Source: VirusTotal domain report; Google Safe Browsing site status (its data last updated October 11, 2026); Gridinsoft report
Checked: October 12, 2026
Does not prove: Either conclusion. The records we reviewed include no file analysis supporting any of these labels, and Gridinsoft’s own page notes that automated scoring can be wrong.

Can anyone inspect the code?

No public source code found for the launcher

What we found: Melty’s home, download, terms and privacy pages link out to Discord, X and Y Combinator only—no code repository. A GitHub search turned up mashups made by creators and one organisation that uses Melty’s name while linking to a different website, but no repository published by Melty for the launcher itself. That is a failure to find one, not proof that none exists.
Source: melty.gg pages retrieved on the check date; GitHub repository search
Checked: October 12, 2026
Does not prove: Anything bad. Without public source, outsiders cannot read what the app does, so you are relying on the company’s word and on scans.

Mashups are audited—by Melty

What we found: The terms say every mod and mashup is audited before release, that the audit reads every file (and the source code when a mashup is published from GitHub), that a release must first run on its creator’s PC, and that updates are audited again. The terms also ban publishing malware, spyware and cryptominers, and anyone can report a mashup from its page.
Source: Melty Terms of Service, sections 6, 9 and 10
Checked: October 12, 2026
Does not prove: How good the audit is. We found no published audit results and no third party attesting to the process. It is the company describing its own procedure.

What Melty can do on your PC

Permissions you grant by installing it

What we found

Under section 4 of the terms you agree to let the app:

find the games installed on your PC and read their versions;
download mashup files and tools such as mod loaders, launchers and build tools, from Melty or from the original authors;
write files into your game folders, keeping a copy of anything it replaces;
build parts of a mashup on your PC with tools it downloads;
search your folders and drives for your own copy of a game and copy the files a mashup needs;
start your games and the mashup’s own programs;
update itself automatically.

The privacy policy rechecked on October 14 says data sent to Melty includes install and play reports (worked or not, short error details, game version), crash reports with device details, and logs from the mashup, loaders and game after install, launch or game-crash failures. It says identifying information and secrets are removed before those logs are sent, that creators and their connected coding agents can see them without the sender’s identity, and that logs are kept for 30 days. If you host a multiplayer game, your IP address and port are shared with the players who join. It states that your game list and the files of your own game copies are not uploaded to Melty, and that a Minecraft sign-in is kept on your PC and used only with Microsoft.

Source

Checked

October 14, 2026

Does not prove

That the app does only this. These are the company’s statements; we did not monitor the app’s behaviour or network traffic. The access is wide: the app can run programs and replace itself with a new version, so each update is a new act of trust.

Look-alike downloads: melty.world

A copy of the site serves a different file

What we found: The domain melty.world was registered on October 5, 2026 through a different registrar. It reproduces Melty’s homepage and names Stella Montis Inc. as its publisher. In the pages rechecked on October 14, melty.gg does not link to it, and Y Combinator lists melty.gg as the company’s website. On October 12, 2026 its download button redirected to Melty-Setup-1.0.60.exe on a personal GitHub account’s release page, not to Melty’s own storage. VirusTotal’s record for that file says it is not signed, that its embedded details describe it as “Slack” from Slack Technologies, and that it has also been submitted under the name dropper-pkg-node24-win-x64.exe. Its detection count was 0 of 68 in that snapshot. On the same date, a GitHub organisation named “Melty-gg”, created October 10, 2026 and not verified, links to melty.world using the link text “melty.gg”.
Source: Registry record for melty.world; VirusTotal record for the file it served (analysed 2026-10-12 00:32 UTC); redirect and GitHub account details observed directly on the check date
Checked: October 12, 2026
Does not prove: Who runs it, whether it has any relationship to Melty, or what the file does—we did not download or analyse it. The October 12 records describe that specific file only. The download changed by October 14, and we have not checked the new file’s signature or behaviour.

What we did not check

We did not install or run Melty, or any mashup.
We did not analyse any file ourselves. Scan results are VirusTotal’s public records.
We did not inspect the installed app, its updater, or its network traffic.
We did not check individual mashups. Each one is separate software from a separate creator.
Every finding is a snapshot. Installer versions, scan results and vendor ratings change, sometimes within hours.

If you decide to install it

General precautions, not findings:

Download only from melty.gg/download. Type the address yourself rather than following a search ad, a GitHub README or a video description. Our Melty download page lists what the file melty.gg served looked like on our check date.
Before running the installer, open its Properties in Windows and look for the Digital Signatures tab. If the signature is missing or cannot be validated, stop and investigate. A signature check alone does not identify the file; the historical hash applies only to version 1.0.94.
Keep your antivirus on. Walk away from any instruction to disable it.
Back up saves you care about before modding a game. Melty’s own terms say the same.
Hosting a public multiplayer lobby shares your IP address with whoever joins.

Frequently asked questions

Is Melty a virus?

We cannot say yes or no, and we found no published independent audit. What is on record: the installer melty.gg served on October 12, 2026 (version 1.0.94) was flagged by 0 of 67 antivirus engines on VirusTotal and carries a valid code signature. A clean scan is not proof of safety, and it covers that one build only.

Is melty.gg legit?

Its terms name Stella Montis Inc. as the operator, and Y Combinator’s company directory lists Melty in its Fall 2026 batch with melty.gg as the website. The domain itself was registered on October 1, 2026; we did not establish a longer operating history. A directory listing is not a security review.

Is Melty AI safe to download?

Melty is a Windows launcher, not an AI model; the AI part is the coding agent a creator uses to build a mashup. If you download it, use only melty.gg/download and check that the file has a valid digital signature. We have not installed it ourselves and do not vouch for it.

Why does my antivirus flag Melty?

We have not inspected your file or your antivirus result. Leave a flagged file quarantined, record the exact detection name, file path, version and hash, and ask the publisher or your security vendor to investigate. Do not disable protection to make the launcher run.

Is melty.world the official Melty site?

It is not linked from melty.gg, and Y Combinator lists melty.gg as the company website. On October 12, 2026 its download button led to a different file from the official one: unsigned, and describing itself as another product in its own file details. We do not know who runs it.

Is Melty open source?

We found no public source repository for the launcher in the places we checked. None of melty.gg’s home, download, terms or privacy pages links to one. Some individual mashups do publish their source on GitHub, which is a separate thing.

Keep reading

The Melty guide explains what the launcher is. Melty download covers the official file, the GitHub question and where mashup files come from. Melty not loading walks through what to check when it will not start. For the wider trend, see our AI merge games home and the source-checked mashup index.

Historical findings checked October 12, 2026; official pages and privacy details rechecked October 14, 2026 as noted above. Linked pages change; open the source to see the current state. AI Merge Games is independent and not affiliated with Melty or Stella Montis Inc. Spotted an error? Tell us and we will re-check it.

Is Melty safe?What can be verified.