aibomstd 0.2.4

AI Bill of Materials Standard — open standard SDK for AI component transparency

aibomstd

The open standard for AI Bill of Materials.

Scan any repo and instantly know what AI components are running, which send data outside your boundary, and what your compliance risk is.

---

Install

pip install aibomstd

---

CLI — scan a repo in seconds

aibomstd scan ./my-repo

┌─────────────────────┬────────────┬──────────────┬──────────┬────────┐
│ Component           │ Type       │ Provider     │ Boundary │ Risk   │
├─────────────────────┼────────────┼──────────────┼──────────┼────────┤
│ openai              │ api-client │ openai       │ leaves   │ high   │
│ anthropic           │ api-client │ anthropic    │ leaves   │ high   │
│ langchain           │ framework  │ langchain-ai │ internal │ none   │
│ torch               │ framework  │ pytorch      │ internal │ none   │
│ llama-3-8b.gguf     │ model      │ unknown      │ internal │ medium │
│ training.jsonl      │ dataset    │ unknown      │ internal │ medium │
└─────────────────────┴────────────┴──────────────┴──────────┴────────┘

Summary:
  Total components : 6
  Data egress      : YES
  Shadow AI        : YES
  Risk score       : HIGH

Generated: my-repo.aibom.json

---

What it detects

Component type	Examples
api-client	openai, anthropic, cohere, mistral, groq
framework	langchain, llama-index, transformers, ollama
model	.gguf, .safetensors, .pt, .onnx files
dataset	.jsonl, .parquet, .arrow files in data/ folders
Shadow AI	API keys in .env not declared in dependencies

Auto-detects data-leaves-boundary and data-residency for every component.

---

Other CLI commands

# Validate a BOM file against the schema
aibomstd validate my-repo.aibom.json

# Convert from cisco-aibom format
aibomstd convert cisco-output.json

# Check version
aibomstd version

---

SDK — generate BOMs in Python

from aibomstd import AiBomBuilder
from aibomstd.components import ModelComponent, ApiClientComponent

bom = (
    AiBomBuilder(product="my-ai-product", version="1.0.0")
    .add_component(ModelComponent(
        name="llama-3-8b-instruct",
        version="3.0",
        provider="meta",
        data_leaves_boundary=False,
        data_residency="IN"
    ))
    .add_component(ApiClientComponent(
        name="gpt-4o",
        version="2024-05-13",
        provider="openai",
        data_leaves_boundary=True,
        data_residency="US"
    ))
)

print(bom.to_json())       # aibomstd JSON
bom.to_html()              # self-contained HTML report
bom.to_cyclonedx()         # CycloneDX v1.7 JSON

---

Output formats

bom.to_json()        # aibomstd JSON (default)
bom.to_html()        # self-contained HTML report
bom.to_cyclonedx()   # CycloneDX v1.7 JSON

---

Convert from cisco-aibom

from aibomstd.converters.cisco import CiscoConverter
import json

cisco_output = json.load(open("cisco-scan-result.json"))
converter = CiscoConverter()
aibomstd_json = converter.convert(cisco_output)
print(json.dumps(aibomstd_json, indent=2))

---

Schema

Every output document references the canonical schema:

https://aibomstd.com/schema/v0.1/aibomstd.schema.json

Validate any BOM:

npx ajv validate \
  -s https://aibomstd.com/schema/v0.1/aibomstd.schema.json \
  -d my-repo.aibom.json \
  --spec=draft2020

---

License

Apache 2.0 — https://aibomstd.com