Open Source | MIT License

AI Inventory & Risk Analyzer

Generate an AI Bill of Materials for your AI codebase. Automatically detect models, agents, prompts, tools, and APIs across Python, JavaScript/TypeScript, Java, Go, and .NET with built-in OWASP LLM risk analysis.

Clone & Get Started
git clone https://github.com/akumar0205/AIBOM.git && cd AIBOM
Then run: pip install -e . && aibom generate .
Python
TypeScript
Java
Go
.NET

What AIBOM Detects

AIBOM finds AI components in your code and maps them to a structured inventory with OWASP LLM risk analysis.

your_code.py
from langchain import ChatOpenAI

llm = ChatOpenAI(
    model="gpt-4",
    temperature=0.7
)
gpt-4
OpenAI / LangChain
your_app.ts
import OpenAI from "openai";

const client = new OpenAI({
    model: "gpt-4o-mini"
});
gpt-4o-mini
OpenAI / TypeScript
Assistant.java
import dev.langchain4j.model.openai.OpenAiChatModel;

OpenAiChatModel model = OpenAiChatModel.builder()
    .modelName("gpt-4")
    .build();
gpt-4
OpenAI / LangChain4j
main.go
import "github.com/openai/openai-go"

client := openai.NewClient()
resp, err := client.Chat.Completions.New(
    ctx,
    openai.ChatCompletionNewParams{
        Model: "gpt-4",
    },
)
gpt-4
OpenAI / Go
your_code.py
from langchain.agents import initialize_agent

agent = initialize_agent(
    tools,
    llm,
    agent="zero-shot-react-description"
)
ReAct Agent
zero-shot-react-description
your_code.py
from langchain.tools import Tool

search = Tool(
    name="SerpAPI",
    func=search_run
)
SerpAPI
External Search Tool
9 Source Detectors
50+ Model Providers
5 Languages

Multi-Language Support

AIBOM detects AI components across your entire polyglot codebase with specialized parsers for each language.

Python

Full AST parsing for LangChain, OpenAI, Anthropic, and more

AST Analysis Jupyter Notebooks

TypeScript

Pattern-based detection for OpenAI SDK, LangChain.js

JS/TS AST Package.json

Java

Detect LangChain4j, Spring AI, and OpenAI integrations

LangChain4j Spring AI

Go

Find OpenAI and Anthropic SDK usage in Go applications

OpenAI Go LangChain Go

.NET

Scan C# projects for Semantic Kernel and AI integrations

Semantic Kernel Azure AI

Example Output

AIBOM generates a structured JSON document mapping all AI components in your codebase with risk findings and provenance tracking.

aibom generate .
$ aibom generate . --output AI_BOM.json --audit-mode
Scanning repository...
Analyzing 247 Python files
Analyzing 56 TypeScript files
Parsing runtime manifests
Detecting AI components
Evaluating risk policies
Generated AI_BOM.json
Project: customer-support-agent
AI Components Detected:
Models:
- gpt-4 (OpenAI)
- text-embedding-3-small
Frameworks:
- langchain
- openai
Agent:
- react-agent
Tools:
- serpapi
- wikipedia
Risk Findings:
- 2 third-party provider warnings
- 1 exfil surface detected

Key Capabilities

Beyond simple detection, AIBOM provides enterprise-grade features for AI supply chain security.

OWASP LLM Risk Analysis

Built-in heuristics aligned with OWASP LLM Top 10. Detect third-party providers, exfiltration surfaces, and prompt injection risks.

Multi-Language Support

Detect AI components in Python, Jupyter notebooks, JavaScript, TypeScript, Java, Go, and .NET codebases.

Cryptographic Attestation

Sign evidence bundles with X.509 certificates. Verify provenance, certificate chains, and enforce signer allowlists.

Drift Detection

Compare AIBOM versions to detect new models, tools, or external providers. Gate CI/CD pipelines on unauthorized changes.

Custom Risk Policies

Define organization-specific risk rules with allowlists, thresholds, and severity overrides in JSON or YAML format.

Periodic Scanning

Schedule recurring scans with trend analysis. Track novel components over time and maintain historical snapshots.

Why AIBOM Matters

AI systems contain many hidden dependencies that traditional tooling cannot see.

01

Hidden Dependencies

Models, prompts, tools, datasets, and APIs form complex dependency graphs that are invisible to traditional SBOM tools.

02

Security Risks

Prompt injection, model poisoning, and data leakage require visibility into how AI components interact with your systems.

03

Governance

Organizations need to track AI usage for compliance, risk management, and responsible AI practices.

04

Supply Chain

Third-party models and APIs introduce supply chain risks that must be audited and monitored continuously.

Traditional SBOM Dependencies Libraries AI Models Prompts & Agents AIBOM Dependencies Libraries AI Models Prompts & Agents + = Complete visibility Security coverage Compliance ready

How It Works

Three simple steps to complete AI supply chain visibility.

1

Clone & Install

Get the code from GitHub and install with pip. It's just a few commands to get started.

git clone https://github.com/akumar0205/AIBOM.git && cd AIBOM && pip install -e .
2

Scan Your Codebase

Run AIBOM against your project. It analyzes Python, TypeScript, Java, Go, and .NET files to detect AI components.

aibom generate . --output AI_BOM.json
3

Review & Export

Get a structured JSON document with risk findings. Export to SPDX, CycloneDX, SARIF, or VEX formats for your compliance tools.

aibom export --input AI_BOM.json --format spdx-json -o spdx.json

Get Started in Seconds

Clone the repo and scan your first AI project in under a minute.

1. Clone Repository

git clone https://github.com/akumar0205/AIBOM.git

2. Install

cd AIBOM && pip install -e .

3. Generate

aibom generate .

Advanced Usage

aibom generate . --audit-mode --bundle-out evidence.zip Create signed evidence bundle
aibom diff baseline.json new.json --fail-on new-model Detect drift between versions
aibom periodic-scan . --interval daily Schedule recurring scans

Contribute to AIBOM

AIBOM is built by and for the AI security community. We're looking for contributors to help us support more languages, frameworks, and risk detection rules. Whether you're an AI security researcher, ML engineer, or developer — your contributions are welcome!

Add Detectors

Build support for new AI frameworks and languages

Risk Rules

Implement new OWASP LLM-aligned risk detections

Export Formats

Add new SBOM and compliance export formats

Bug Reports

Help us improve by reporting issues and edge cases

Open Source

AIBOM is MIT licensed and free to use. Join our growing community of AI security practitioners.

Copied to clipboard