AIBOM Documentation

AIBOM is the only AI Bill of Materials tool with native bulk GitHub scanning. Inventory AI models, agents, and security risks across your entire organization in one command.

Competitive Edge

Other AIBOM tools make you scan repos one by one. AIBOM's scan-github command can clone, analyze, and aggregate results across hundreds of repositories with drift detection, risk gates, and compliance exports.

GitHub Scanner

Unique: Bulk scan your entire GitHub organization with drift gates ↗

Quickstart

Get up and running with AIBOM in under 5 minutes

CLI Reference

Complete command reference for all AIBOM commands

Quickstart

Choose your workflow: scan a single repo locally, or bulk scan your entire GitHub organization.

Option 1: Local Repository Scan

bash 
# Install and scan current directory
pip install aibom
aibom generate . --output AI_BOM.json

Option 2: Bulk GitHub Scan (Unique Feature)

bash 
# Scan multiple GitHub repos with risk gates
aibom scan-github \
  --repo owner/repo1 \
  --repo owner/repo2 \
  --output-dir results/ \
  --max-high-risk 0 \
  --fail-on new-external-provider

What is AIBOM?

AIBOM is an AI inventory and risk analyzer, a tool that scans your codebase to discover AI models, agents, prompts, and tools while assessing security risks. While traditional SBOM tools track dependencies, they miss critical AI-specific components like:

  • Large Language Models (LLMs) and their providers
  • AI agents and their configurations
  • Prompt templates and system prompts
  • Vector stores and embedding models
  • AI tools and external APIs

AIBOM detects these components across Python, JavaScript/TypeScript, Java, Go, and .NET codebases, providing complete visibility into your AI supply chain.

Info

AIBOM aligns with the OWASP LLM Top 10 risk framework for AI security.

Installation

From Source

bash 
git clone https://github.com/akumar0205/AIBOM.git
cd AIBOM
pip install -e .

Docker

bash 
docker build -f deploy/Dockerfile -t aibom .
docker run --rm -v $(pwd):/workspace aibom generate /workspace -o /out/aibom.json

CLI Reference

generate

Generate an AIBOM document from your codebase.

bash 
aibom generate [TARGET] [OPTIONS]

Options

  • -o, --output - Output file path (default: AI_BOM.json)
  • --profile - Output profile: canonical or ai-bom-like
  • --include-prompts - Include prompt content (requires acknowledgment)
  • --acknowledge-prompt-exposure-risk - Acknowledge risk of exposing prompts
  • --include-runtime-manifests - Include runtime dependency manifests
  • --redaction-policy - Evidence redaction policy (strict/default/off)
  • --audit-mode - Enable audit mode with full evidence collection
  • --bundle-out - Create evidence bundle at specified path
  • --risk-policy - Path to custom risk policy file
  • --fail-on-unsupported-threshold - Fail if unsupported artifacts exceed threshold

Examples

bash 
# Basic generation
aibom generate . -o AI_BOM.json

# Generate with executive-friendly profile
aibom generate . --profile ai-bom-like -o AI_BOM.json

# Audit mode with evidence bundle
aibom generate . --audit-mode --bundle-out evidence.zip

# Include runtime manifests
aibom generate . --include-runtime-manifests

# Custom risk policy
aibom generate . --risk-policy policy.json

export

Export AIBOM to standard formats (SPDX, CycloneDX, SARIF, VEX).

bash 
aibom export --input AI_BOM.json --format spdx-json -o SPDX.json

Supported Formats

  • spdx-json - SPDX 2.3 JSON format
  • cyclonedx-json - CycloneDX 1.5 JSON format
  • sarif-json - SARIF 2.1.0 format for security tools
  • vex-json - OpenVEX format for vulnerability tracking

validate

Validate an AIBOM document against the JSON schema.

bash 
aibom validate AI_BOM.json

diff

Compare two AIBOM documents and detect changes.

bash 
aibom diff old.json new.json --fail-on new-model,new-tool,new-external-provider

bundle

Create an evidence bundle with AIBOM, SPDX, and optional diff. Bundles also include COLLECTION.json with tool and detector versions, CLI args, git SHA plus dirty worktree state, lockfile hashes, scan statistics, and classified manifest entries for reproducible audits.

bash 
aibom bundle --input AI_BOM.json --out evidence.zip --baseline baseline.json

attest

Sign and verify evidence bundles with X.509 certificates.

bash 
# Sign a bundle
aibom attest --bundle evidence.zip --signing-key key.pem --signing-cert cert.pem

# Verify a bundle (fail-closed: requires a trust anchor)
aibom attest --bundle evidence.zip --signature evidence.zip.sig --signing-cert cert.pem --verify --ca-bundle ca.pem

Verification is fail-closed: --verify exits non-zero unless --ca-bundle or --trusted-root is supplied, and OCSP revocation checking without a responder integration errors instead of silently skipping.

risk

Show risk findings from an AIBOM document.

bash 
aibom risk --input AI_BOM.json

# With custom risk policy
aibom risk --input AI_BOM.json --risk-policy policy.json

periodic-scan

Schedule recurring scans with trend analysis.

bash 
aibom periodic-scan . --output periodic_scan.json --interval daily

# With history window
aibom periodic-scan . --history-window 10 --interval daily

scan-github

Bulk scan GitHub repositories and aggregate outputs. Clone repositories into a temp workspace, run AIBOM generation, and emit per-repo outputs plus summary files.

bash 
# Scan a single repository
aibom scan-github --repo openai/openai-quickstart-python --output-dir out

# Scan multiple repositories
aibom scan-github --repo owner/repo1 --repo owner/repo2 --output-dir out

# Scan from file with risk gates
aibom scan-github --repos-file repos.txt --max-high-risk 5 --max-unsupported 10

# With drift detection
aibom scan-github --repo owner/repo --baseline baseline.json --fail-on new-model,new-tool

Options

  • --repo - GitHub repo in owner/name format (repeatable)
  • --repos-file - File containing owner/name repos, one per line
  • --output-dir - Output directory (default: github_scan_out)
  • --branch - Specific branch to checkout
  • --depth - Git clone depth (default: 1)
  • --max-repos - Maximum number of repos to scan
  • --timeout-sec - Timeout per repo in seconds (default: 180)
  • --profile - Output profile: canonical or ai-bom-like
  • --max-high-risk - Fail when high/critical risks exceed this number
  • --max-unsupported - Fail when unsupported artifacts exceed this number
  • --baseline - Optional baseline AIBOM for drift checks
  • --fail-on - Comma-separated drift gates
  • --commit - Pin every repo scan to this commit SHA for reproducible results
  • --allow-tokenized-clone - Explicit opt-in to embed the token-env credential in clone URLs (a set token otherwise aborts the scan)
  • --local-mirrors-dir - Scan already-checked-out local mirrors instead of cloning (preferred, no network)

Every scan record captures repo_origin, the exact resolved_commit, branch, and scanned_at timestamp in summary.json, so repeated scans against the same commit are deterministic.

summarize

Print an AI BOM-like summary from an existing AIBOM JSON file.

bash 
# Print text summary
aibom summarize --input AI_BOM.json

# JSON output for programmatic use
aibom summarize --input AI_BOM.json --json

AI BOM-Like Profile

AIBOM can generate an executive-friendly companion presentation profile alongside the canonical AIBOM JSON. This profile format provides a condensed view of AI assets, risk highlights, and detector coverage metrics designed for quick consumption by security teams and executives.

Generate a Profile

bash 
# Generate both canonical AIBOM and AI BOM-like profile
aibom generate . --profile ai-bom-like -o AI_BOM.json

# The profile will be saved as AI_BOM_ai_profile.json
aibom scan-github --repo owner/repo --profile ai-bom-like --output-dir out

Profile Structure

The AI BOM-like profile includes:

  • Executive Summary - Counts of models, tools, datasets, frameworks, prompts, and risk findings
  • AI Assets - Sorted lists of detected models, tools, datasets, and frameworks with source locations
  • Risk Highlights - Top risk findings by severity with scores and rule IDs
  • Provenance & Compliance - Runtime context and risk policy information
  • Detector Coverage - Files scanned and findings per detector type
Note

The AI BOM-like profile is a presentation format and does not replace the canonical AIBOM JSON for compliance and audit purposes.

Risk Analysis

AIBOM includes built-in risk analysis aligned with the OWASP LLM Top 10. The following risk rules are included by default:

Built-in Risk Rules

  • Third-Party Provider (LLM07) - Detects external model providers like OpenAI, Anthropic
  • Exfiltration Surface (LLM06) - Identifies tools that may leak sensitive data
  • Prompt Injection Surface (LLM01) - Flags prompt templates that may be vulnerable
  • Secret Exposure (LLM06) - Flags provider credentials found in scanned configuration
  • Internet Egress (LLM06) - Flags network-capable tools that may carry data off-boundary
  • Retrieval Augmentation (LLM03) - Flags vector-store usage exposed to poisoning or staleness
  • Tool Execution (LLM08) - Flags agentic tool surfaces with side effects
  • Prompt Logging (LLM02) - Flags prompt templates that may be logged without redaction
  • Model Version Drift (LLM05) - Flags unpinned model references that can change silently
  • Unsupported Provider Use (LLM05) - Flags providers or wrappers outside the assessed inventory

Every finding carries a finding_kind (risk vs inventory asset), a control_objective, and a remediation hint for SOC triage.

Custom Risk Policies

You can define custom risk policies in JSON or YAML format:

json 
{
  "policy_id": "org-risk-rules",
  "version": "2026.03",
  "rule_overrides": {
    "third-party-provider": {
      "severity": "high",
      "threshold": 1,
      "allowlist": [
        {
          "entity_type": "model",
          "name": "ChatOpenAI",
          "source_file": "app.py",
          "reason": "approved-external-provider"
        }
      ]
    }
  }
}

SOC-Grade Assurance

AIBOM defaults are evidence-graded and fail-closed for auditor-facing use:

  • Evidence-graded provenance - Missing provenance is null with {status, method} evidence (observed, inferred, or missing) instead of "unknown" placeholders, which the schema rejects.
  • Semantic detectors - Python and JS/TS detectors resolve import aliases, factory wrappers, and config/environment dataflow into model constructors; dynamic imports are flagged suspected_usage. Every model and finding carries evidence_class and detection_method, with confidence calibrated to the evidence class.
  • Fail-closed attestation - Bundle verification requires a trust anchor (--ca-bundle or --trusted-root), and OCSP revocation without a responder integration errors instead of silently skipping.
  • Reproducible evidence - Bundles ship COLLECTION.json; GitHub scans pin commits and record origin, resolved commit, branch, and timestamp per repo.
  • Hardened schema - Stable schema ID, timestamp/format/enum constraints, and no extra properties on core entities.
  • Adversarial coverage - Wrapper, env-driven, dynamic-import, and misleading-config fixtures under tests/fixtures/adversarial/ with a recall-gated benchmark, plus export conformance tests for SPDX, CycloneDX, SARIF, and VEX outputs.

CI/CD Integration

GitHub Actions

yaml 
name: AIBOM Security Check
on: [pull_request]

jobs:
  aibom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: pip install aibom
      - run: aibom generate . -o new_aibom.json
      - run: |
          aibom diff .aibom/baseline.json new_aibom.json \
            --fail-on new-model,new-tool,new-external-provider

Drift Detection

Use aibom diff to detect changes between AIBOM versions and gate your CI/CD pipeline:

bash 
aibom diff baseline.json new.json --fail-on new-model,new-tool,new-external-provider
Important

Store your baseline AIBOM in version control to track changes over time.