abom-cli

The reference implementation of ABOM — the Agent Bill of Materials. Scan a repo, emit a signed Composition Manifest, and verify it.

pip install abom-cli        # (until published: pip install -e .)
abom scan .                 # → abom.json (signed with ed25519)
abom verify abom.json       # check signature
abom verify abom.json --policy policy.json   # + enforce a policy (exit 1 on violations)

Commands

Command What it does
abom scan [PATH] Detect agent components (models, prompts, tools, MCP servers, frameworks, vector stores, guardrails) and emit a signed Composition Manifest. -o - writes to stdout.
abom verify [FILE] Verify the ed25519 signature; with --policy, enforce model allowlist / residency / egress / approval rules. Non-zero exit on findings (CI-friendly).
abom keygen Show (or create) the local ed25519 signing key (~/.abom/signing_key.pem, override with ABOM_KEY).
abom version Print the tool and spec versions.

All commands accept -v (info) / -vv (debug) / -q (errors only) / --json-logs (NDJSON for CI) — logs go to stderr, so the ABOM on stdout stays clean.

Example

$ abom scan .
  ABOM · my-agent @ 1.2.0
  models                  3  gpt-4o-mini, claude-3-5-sonnet, OpenAI (SDK)
  frameworks              2  LangChain, LangGraph
  MCP servers             2  filesystem, github
  tools                   1  lookup_customer
  prompts                 1  prompts/system.txt
  signed: ed25519 · key 5846eabc738b3542
  → wrote abom.json

How detection works

abom scan is a static scanner (pure stdlib + cryptography):

  • Dependencies (requirements*.txt, pyproject.toml, package.json) → frameworks, model SDKs, vector stores, guardrails.
  • Source → concrete model names (gpt-4o, claude-*, …) and @tool-decorated functions.
  • Prompt files (*.prompt, prompts/*.txt|md) → hashed.
  • MCP configs (mcp.json, claude_desktop_config.json, …) → MCP servers.

Each component records detected_from so the manifest is auditable. The output validates against spec/abom-0.1.schema.json.

Signing

abom scan signs with ed25519 (cryptography). The key lives at ~/.abom/signing_key.pem (override with ABOM_KEY); the public key + a short key_id are embedded so abom verify is self-contained. A Notary / key registry pins trusted key ids in production.

Dev

make install          # pip install -e ".[dev]"
make test             # pytest (audit chain, scanner, signing)
make scan && make verify
make build            # wheel + sdist + twine check
python demo/demo.py   # generate → verify → tamper-evidence walkthrough

What else is in this package

src/abom/ also contains a prototype control-plane (api.py, db.py, orchestration.py, the Notary) behind the optional [server] extra — the beginnings of the commercial layer. It is not required for scan/verify and is not part of the v0.1 spec. See MVP_SPEC.md.

Project links

Data verified by PyPI on
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.2.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for josephassiga from gravatar.com josephassiga

Credits

Author: ABOM Contributors

GitHub Statistics

Data verified by PyPI on 
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

dev mcp server

Tags

agent ai ai-security cyclonedx llm ml-bom provenance sbom supply-chain

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

abom_cli-0.1.12.tar.gz (69.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

abom_cli-0.1.12-py3-none-any.whl (60.1 kB view details)

Uploaded Python 3

File details

Details for the file abom_cli-0.1.12.tar.gz.

File metadata

  • Download URL: abom_cli-0.1.12.tar.gz
  • Upload date:
  • Size: 69.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for abom_cli-0.1.12.tar.gz
Algorithm Hash digest
SHA256 ec32313f9a72f53becfb62e9a5b1239db03d0530cdbc17d87fdb420359679f8f
MD5 5f32f17b018564cf59205c3f09a9a8a3
BLAKE2b-256 934800700fdb6bd1a762c97083ca69b8de105ce4a4dfe8bb345aebd589947afe

See more details on using hashes here.

Provenance

The following attestation bundles were made for abom_cli-0.1.12.tar.gz:

Publisher: release.yml on josephassiga/abom-dev

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file abom_cli-0.1.12-py3-none-any.whl.

File metadata

  • Download URL: abom_cli-0.1.12-py3-none-any.whl
  • Upload date:
  • Size: 60.1 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for abom_cli-0.1.12-py3-none-any.whl
Algorithm Hash digest
SHA256 40079cb628bd872564e6737963efedf374767aa9f482016aaf132a55958239f6
MD5 dbc90d5b9c4c4cca86ded13e050b8f56
BLAKE2b-256 a7d028addb04a4d4fef8028dfe30bff6c91c88047de05336b2d19bf716a49c3f

See more details on using hashes here.

Provenance

The following attestation bundles were made for abom_cli-0.1.12-py3-none-any.whl:

Publisher: release.yml on josephassiga/abom-dev

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page