abom-cli

The reference implementation of ABOM — the Agent Bill of Materials. Scan a repo, emit a signed Composition Manifest, and verify it.

pip install abom-cli        # (until published: pip install -e .)
abom scan .                 # → abom.json (signed with ed25519)
abom verify abom.json       # check signature
abom verify abom.json --policy policy.json   # + enforce a policy (exit 1 on violations)

Commands

Command What it does
abom scan [PATH] Detect agent components (models, prompts, tools, MCP servers, frameworks, vector stores, guardrails) and emit a signed Composition Manifest. -o - writes to stdout.
abom verify [FILE] Verify the ed25519 signature; with --policy, enforce model allowlist / residency / egress / approval rules. Non-zero exit on findings (CI-friendly).
abom keygen Show (or create) the local ed25519 signing key (~/.abom/signing_key.pem, override with ABOM_KEY).
abom version Print the tool and spec versions.

All commands accept -v (info) / -vv (debug) / -q (errors only) / --json-logs (NDJSON for CI) — logs go to stderr, so the ABOM on stdout stays clean.

Example

$ abom scan .
  ABOM · my-agent @ 1.2.0
  models                  3  gpt-4o-mini, claude-3-5-sonnet, OpenAI (SDK)
  frameworks              2  LangChain, LangGraph
  MCP servers             2  filesystem, github
  tools                   1  lookup_customer
  prompts                 1  prompts/system.txt
  signed: ed25519 · key 5846eabc738b3542
  → wrote abom.json

How detection works

abom scan is a static scanner (pure stdlib + cryptography):

  • Dependencies (requirements*.txt, pyproject.toml, package.json) → frameworks, model SDKs, vector stores, guardrails.
  • Source → concrete model names (gpt-4o, claude-*, …) and @tool-decorated functions.
  • Prompt files (*.prompt, prompts/*.txt|md) → hashed.
  • MCP configs (mcp.json, claude_desktop_config.json, …) → MCP servers.

Each component records detected_from so the manifest is auditable. The output validates against spec/abom-0.1.schema.json.

Signing

abom scan signs with ed25519 (cryptography). The key lives at ~/.abom/signing_key.pem (override with ABOM_KEY); the public key + a short key_id are embedded so abom verify is self-contained. A Notary / key registry pins trusted key ids in production.

Dev

make install          # pip install -e ".[dev]"
make test             # pytest (audit chain, scanner, signing)
make scan && make verify
make build            # wheel + sdist + twine check
python demo/demo.py   # generate → verify → tamper-evidence walkthrough

What else is in this package

src/abom/ also contains a prototype control-plane (api.py, db.py, orchestration.py, the Notary) behind the optional [server] extra — the beginnings of the commercial layer. It is not required for scan/verify and is not part of the v0.1 spec. See MVP_SPEC.md.

Project links

Data verified by PyPI on
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.2.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for josephassiga from gravatar.com josephassiga

Credits

Author: ABOM Contributors

GitHub Statistics

Data verified by PyPI on 
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.10

Provides Extra

dev mcp server

Tags

agent ai ai-security cyclonedx llm ml-bom provenance sbom supply-chain

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

abom_cli-0.1.13.tar.gz (73.8 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

abom_cli-0.1.13-py3-none-any.whl (63.4 kB view details)

Uploaded Python 3

File details

Details for the file abom_cli-0.1.13.tar.gz.

File metadata

  • Download URL: abom_cli-0.1.13.tar.gz
  • Upload date:
  • Size: 73.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for abom_cli-0.1.13.tar.gz
Algorithm Hash digest
SHA256 2aa1db72e5133bc73088a140cb54444e38ebe65c96e2f9c390274df5aa32f874
MD5 5a9449677eade7c675e7789cbec19346
BLAKE2b-256 cb8e86d6d01f78b59ffe2a353da6cdecddb3bf7abb68fae0eca2d306db6c7949

See more details on using hashes here.

Provenance

The following attestation bundles were made for abom_cli-0.1.13.tar.gz:

Publisher: release.yml on josephassiga/abom-dev

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file abom_cli-0.1.13-py3-none-any.whl.

File metadata

  • Download URL: abom_cli-0.1.13-py3-none-any.whl
  • Upload date:
  • Size: 63.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for abom_cli-0.1.13-py3-none-any.whl
Algorithm Hash digest
SHA256 92d88cddf5d805fbc2ea6d2f2f7eec967bcafd108ed5f25417de73f151fa2831
MD5 9bfaa4a9ba26ed3777236e2e402d31db
BLAKE2b-256 85c17bf4c1640b81804112108b9d42df37aeaff15eda1a43c6bb7f06902ca7c5

See more details on using hashes here.

Provenance

The following attestation bundles were made for abom_cli-0.1.13-py3-none-any.whl:

Publisher: release.yml on josephassiga/abom-dev

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page