/ai-bom

name: ai-bom
description: Generates AI-BOM, MCP inventory, AI skill inventory, and AI authorship provenance documents with cdxgen, cataloging models, inference services, Hugging Face purls, MCP servers and their tools/prompts/resources, agent instruction files, and cdx:ai:codegen provenance signals, then audits them with AI-focused rule packs. Use when asked to inventory AI or ML usage, catalog MCP servers, audit agent instruction or skill files, assess AI supply-chain risk, or detect AI-generated code authorship.

AI-BOM, MCP inventory, and AI provenance

Four related but distinct concerns. Pick the right one before reaching for flags — conflating them produces a document that answers the wrong question.

| Question | Project type | | ----------------------------------------------------- | ------------------------------------- | | What models and inference services does this use? | `ai` / `aibom` / `ai-bom` | | What MCP servers, tools, and configs does this ship? | `mcp` | | What agent instruction and skill files does it ship? | `ai-skill` / `skill` / `skills` | | Was this code written with AI assistance? | `ai-provenance` / `ai-authorship` / `aicode` / `ai-codegen` |

Read [reference/safety.md](../../reference/safety.md) first. The review-before-sharing rule is especially relevant here: AI and MCP inventory is one of the categories most likely to contain credential-bearing configuration.

AI-BOM: models and inference services

aibom /absolute/path/to/project

Or explicitly, with the audit pack:

cdxgen -r --include-formulation \
  -o /absolute/path/to/aibom.json \
  --bom-audit --bom-audit-categories ai-bom \
  /absolute/path/to/project

`--include-formulation` matters here: it moves the AI and agentic inventory into the standard CycloneDX `formulation[]` section so downstream tools consume it as formal formulation data rather than ad-hoc top-level enrichment. Prefer it.

Direct model targets

`aibom` accepts a model reference rather than a project directory:

aibom pkg:huggingface/deepseek-ai/DeepSeek-R1-Distill-Qwen-7B
aibom https://huggingface.co/deepseek-ai/DeepSeek-R1-Distill-Qwen-7B
aibom /absolute/path/to/Modelfile
aibom /absolute/path/to/model.gguf

Hugging Face model repositories get proper `pkg:huggingface/<namespace>/<name>@<revision>` purls when a compliant repository reference is available. When remote resolution is enabled, cdxgen follows the revision-aware Hub endpoints, so explicit purl revisions, remote popularity/runtime hints, and Space-linked model/dataset relationships are preserved instead of collapsing to an unversioned HEAD lookup. Datasets referenced by model cards get reusable dataset component references with their own Hugging Face purls.

ML depth profiles

cdxgen --profile ml-tiny -o /absolute/path/to/bom.json /absolute/path/to/project

`ml` / `machine-learning`, `ml-deep` / `deep-learning`, and `ml-tiny` trade depth against runtime. Start with `ml` and escalate only if the inventory is thin.

AI audit categories

| Category | Checks | | ---------------- | ------------------------------------------------------------- | | `ai-bom` | Umbrella pack for AI-BOM review | | `ai-security` | Security posture of AI services and model usage | | `ai-governance` | Governance and policy conformance | | `ai-performance` | Performance-relevant model and runtime findings | | `ai-inventory` | Alias enabling both `ai-agent` and `mcp-server` |

MCP inventory

cdxgen -t mcp /absolute/path/to/project \
  -o /absolute/path/to/bom.json \
  --bom-audit --bom-audit-categories mcp-server

By default a plain `-t js` scan **also** reports shipped MCP configuration files and AI instruction/skill files, because both can influence build and post-build lifecycles. Control that overlay:

• `--exclude-type mcp` drops MCP config components, discovered services, and MCP primitives. Genuine MCP **SDK dependency packages** (`@modelcontextprotocol/*`, PyPI `mcp`, `io.modelcontextprotocol.sdk`) are real supply-chain components and are **always retained**.
• `--exclude-type ai-skill` drops AI skill and instruction inventory.
• `-t mcp` produces an exact MCP-focused BOM: SDK packages, discovered services, primitives, and config files such as `.vscode/mcp.json`.

What the MCP inventory contains

• `components` for MCP SDK packages
• `services` for discovered MCP servers
• synthetic components for MCP primitives: tools, prompts, resources, resource templates
• `dependencies` links from a server service to the primitives it exposes

Config formats recognised include `.vscode/mcp.json`, `.mcp.json`, `claude_desktop_config.json`, and `opencode.json`. Community agent layouts are covered too: OpenCode, Nanocoder, LangGraph, and common CrewAI project files.

Inspecting an MCP BOM

# discovered servers
jq '.services[]' /absolute/path/to/bom.json

# MCP primitives
jq '.components[] | select(.properties[]?.name == "cdx:mcp:role")' /absolute/path/to/bom.json

# shipped MCP config files
jq '.components[] | select(.properties[]?.value == "mcp-config")' /absolute/path/to/bom.json

# service-to-primitive links
jq '.dependencies[] | select(.ref | startswith("urn:service:mcp:"))' /absolute/path/to/bom.json

# audit findings
jq '.annotations[]' /absolute/path/to/bom.json

Key property namespaces: `cdx:mcp:serviceType`, `cdx:mcp:transport`, `cdx:mcp:exposureType`, `cdx:mcp:authPosture`, `cdx:mcp:trustProfile`, `cdx:mcp:credentialExposure`, `cdx:mcp:reviewNeeded`, `cdx:mcp:security:confusedDeputyRisk`, `cdx:mcp:security:tokenPassthroughRisk`.

The MCP findings that matter most

Escalate these:

• unau