ai-finder

License: MIT Python 3.9+

AI artifact scanner for supply chain security and compliance

About

ai-finder detects AI/ML artifacts in codebases for:

  • Supply Chain Security - Identify AI models, SDKs, and dependencies
  • EU AI Act Compliance - Generate SBOM reports for regulatory requirements
  • Risk Assessment - Detect API keys, model provenance, and usage patterns

Features

SDK Detection (12 languages)

Language SDKs Detected
Python OpenAI, Anthropic, HuggingFace, LangChain, LlamaIndex, Strands, CrewAI, AutoGen
JavaScript/TypeScript OpenAI, Anthropic, LangChain, Vercel AI SDK
Go go-openai, go-anthropic
Rust async-openai, anthropic-rs
Java/Kotlin openai-java, LangChain4j, Spring AI
And more... Ruby, PHP, C#, C++, Swift, Scala, Kotlin

AI Package Detection (150+ packages)

Comprehensive detection across categories:

Category Packages
LLM Clients OpenAI, Anthropic, Cohere, Groq, Mistral, Ollama, Google GenAI, Azure OpenAI
Agent Frameworks LangChain, LlamaIndex, Strands Agents, CrewAI, AutoGen, Semantic Kernel
ML Frameworks PyTorch, TensorFlow, Keras, JAX, Transformers, scikit-learn, XGBoost
Vector Databases ChromaDB, Pinecone, Weaviate, Qdrant, Milvus, FAISS, LanceDB
Speech/Audio AI OpenAI Whisper, Faster Whisper, ElevenLabs, Bark
AI Safety AIProxyGuard, Guardrails AI, NeMo Guardrails, LLM Guard
Tools & Utilities Tavily, LangSmith, W&B, MLflow, Accelerate, Datasets
MCP/Tool Use MCP, Anthropic Tools

Model File Detection (12 formats)

GGUF, SafeTensors, ONNX, PyTorch, TensorFlow, TFLite, CoreML, JAX, Keras, MXNet, PaddlePaddle, Pickle

Manifest Parsing (11 formats)

requirements.txt, pyproject.toml, package.json, go.mod, Cargo.toml, pom.xml, build.gradle, Gemfile, composer.json, *.csproj, Package.swift

Output Formats

  • JSON - Machine-readable findings
  • CycloneDX 1.6 - OWASP SBOM format with ML-BOM support
  • SPDX 2.3 - Linux Foundation SBOM format
  • SPDX 3.0 - Latest SPDX specification with JSON-LD

License Handling

  • Licenses are automatically enriched from PyPI, npm, and HuggingFace
  • Unknown licenses are marked as NOASSERTION per SPDX specification
  • Supports SPDX license expressions

Installation

pip install ai-finder

Requires Python 3.9 or later.

Usage

# Scan a directory
ai-finder scan /path/to/project

# Generate SBOM (CycloneDX)
ai-finder scan /path/to/project -f cyclonedx -o sbom.json

# Generate SBOM (SPDX)
ai-finder scan /path/to/project -f spdx -o sbom.spdx.json

# Identify a model file
ai-finder identify model.gguf

# Initialize local KB
ai-finder kb init

# Lookup model by PURL
ai-finder kb lookup pkg:huggingface/TinyLlama/TinyLlama-1.1B-Chat-v1.0

Telemetry

This tool collects anonymous usage telemetry to help improve the product. No file paths, code content, or scan targets are collected.

Disable telemetry:

# Per-session
ai-finder --no-telemetry scan .

# Environment variable
export AI_FINDER_TELEMETRY=0

# Or use the standard
export DO_NOT_TRACK=1

See docs/TELEMETRY.md for full details on what is collected.

Development

# Clone repository
git clone https://github.com/scanoss/ai-finder.git
cd ai-finder

# Install with uv
uv sync --all-packages --all-extras

# Run tests
uv run pytest

# Lint
uv run ruff check .

Contributing

We welcome contributions! Please read CONTRIBUTING.md before submitting a pull request.

Security

If you discover a security vulnerability, please follow our Security Policy.

License

This project is licensed under the MIT License - see LICENSE for details.

Copyright (c) 2026 SCANOSS.

Project links

Data verified by PyPI on Jul 7, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.4.0)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for scanoss from gravatar.com scanoss

Credits

Author: SCANOSS

GitHub Statistics

Data verified by PyPI on Jul 7, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

MIT License (MIT)

Requires

Python >=3.9

Provides Extra

dev fuzzy relationships

Tags

ai compliance sbom scanner supply-chain

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

ai_finder-0.3.9.tar.gz (212.5 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

ai_finder-0.3.9-py3-none-any.whl (243.5 kB view details)

Uploaded Python 3

File details

Details for the file ai_finder-0.3.9.tar.gz.

File metadata

  • Download URL: ai_finder-0.3.9.tar.gz
  • Upload date:
  • Size: 212.5 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ai_finder-0.3.9.tar.gz
Algorithm Hash digest
SHA256 ab31770efff3c9e78281ef17d5b5086defddf2bf5b4105547928e57dce0bac0a
MD5 c49bb41d0faf91abda0006c5521eb99d
BLAKE2b-256 212e8c6010404ccfb0b1f24637b9c1a7c26c1281e9734bf293b50edbd4262682

See more details on using hashes here.

Provenance

The following attestation bundles were made for ai_finder-0.3.9.tar.gz:

Publisher: promote-to-pypi.yml on scanoss/ai-finder

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file ai_finder-0.3.9-py3-none-any.whl.

File metadata

  • Download URL: ai_finder-0.3.9-py3-none-any.whl
  • Upload date:
  • Size: 243.5 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.12

File hashes

Hashes for ai_finder-0.3.9-py3-none-any.whl
Algorithm Hash digest
SHA256 3491294b954a06bf18e560790978c37f0a6013eebc990050f82b53a113c043a7
MD5 80fccf1ca31c4896cd04a144f0e1d463
BLAKE2b-256 188c90f50179101b568722538dfd342a762fe4e189c1d2cba6fdba48fb904308

See more details on using hashes here.

Provenance

The following attestation bundles were made for ai_finder-0.3.9-py3-none-any.whl:

Publisher: promote-to-pypi.yml on scanoss/ai-finder

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.4.0

2 files

This release

0.3.9 This release

2 files

0.3.8

2 files

0.3.7

2 files

0.3.6

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page