aibom-scanner 1.2.0

Scan codebases for AI SDK usage. Map compliance risks to NIST AI RMF, ISO 42001, and EU AI Act.

Quick Start

pip install aibom-scanner

aibom-scanner scan --path /path/to/your/repo

What It Finds

aibom-scanner detects AI SDKs in your codebase and generates an AI Bill of Materials (AIBOM) with compliance risk findings mapped to three frameworks.

Coverage: what the scan actually read

An AI Bill of Materials that silently omits what it could not parse is not incomplete, it is wrong. Every scan reports its own denominator:

Scanned 86 of 173 source files (49.7%) — 86 test/fixture files excluded, 98.9% of source attempted

Two ratios, because either one alone misleads:

Quoting only the second would report ~99% for a scan that read half a repo.

Every unread source file is attributed to exactly one reason:

• skipped_by_path — intentional exclusion (tests, fixtures, examples, vendor).
• unscanned_by_extension — this scanner version cannot parse the language.

Languages the scanner cannot read are reported, never treated as clean. When any turn up, a warning is printed to stderr, the table output shows an INCOMPLETE COVERAGE block, and SARIF carries a toolExecutionNotification so the run reads as partial rather than silently green. Currently unreadable: .php, .scala, .clj, .ex, .exs, .dart, .cpp, .c, .h, .hpp, .m, .mm, .pl, .lua, .r, .jl, .ps1, .kts.

Observed vs inferred findings

Every finding carries an evidence_basis:

• observed — backed by something in the scanned source (a detection, a provider).
• inferred — a governance checklist item. Nothing in the source backs it.

Inferred findings reflect absence of evidence, not evidence of absence. Table output separates them into their own section, --severity-threshold ignores them, and SARIF does not emit them as code-scanning alerts — a governance checklist item is not a defect at a code location.

Output Formats

# Table output (default in terminal)
aibom-scanner scan --path . --format table

# JSON (default when piped) — includes coverage and evidence_basis
aibom-scanner scan --path . --format json > aibom.json

# SARIF for GitHub Code Scanning — observed findings only, coverage in run properties
aibom-scanner scan --path . --format sarif > results.sarif

# Fail CI on high/critical OBSERVED findings (exit 1)
aibom-scanner scan --path . --severity-threshold high

# Fail CI when the scanner could not read some languages (exit 3)
aibom-scanner scan --path . --fail-on-incomplete-coverage

If both gates trip, 1 wins — an observed finding is more actionable than a coverage gap.

The coverage warning always goes to stderr, so piping --format json or --format sarif to a file yields clean, valid output.

GitHub Action

Add AI compliance scanning to every PR:

# .github/workflows/aibom-scan.yml
name: AIBOM Scan
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: saasvista/aibom-scanner@v1
        with:
          severity-threshold: high

AI Providers Detected

Risk Categories

Compliance Frameworks

How It Works

Your Codebase
     │
     ▼
┌─────────────┐     ┌──────────────┐     ┌─────────────┐     ┌────────────────┐
│ File Walker  │────▶│  AI SDK      │────▶│ Risk Engine │────▶│ Control Mapper │
│ git ls-files │     │  Detector    │     │ 34 rules    │     │ 48 controls    │
│ os.walk      │     │  70 patterns │     │ 8 categories│     │ 3 frameworks   │
└─────────────┘     └──────────────┘     └─────────────┘     └────────────────┘
                           │                    │                     │
                    Detections +          Risk findings         Gap analysis
                    model names +         with severity         NIST / ISO /
                    dependencies          qualification         EU AI Act
                                                                     │
                                                                     ▼
                                                              Table / JSON / SARIF

Why This Exists

We scanned 5 popular open-source AI repos (470K combined GitHub stars):

• 389 AI SDK detections
• 116 compliance findings
• 0 governance controls fully mapped

One enterprise security company had a BIS Entity-Listed Chinese AI provider inherited silently through an acquisition.

EU AI Act enforcement starts August 2026. If you don't know what AI SDKs are in your codebase, you can't govern them.

Contributing

Contributions welcome. See CONTRIBUTING.md for guidelines.

• Add detection patterns — new AI providers, SDKs, or frameworks
• Improve risk rules — better severity calibration, new categories
• New output formats — CycloneDX, SPDX, HTML reports
• Language support — Go, Rust, Java detection improvements

License

Apache-2.0. See LICENSE.

Built by SaaSVista — AI Risk & Compliance Copilot