scopesafe-aibom 0.1.0

Agentic AI Bill of Materials scanner — discover and risk-assess the AI agents, models, tools, and MCP servers in a codebase.

aibom — Agentic AI Bill of Materials scanner

Discover, inventory, and risk-assess the AI agents, models, tools, and MCP servers in a codebase — without running it. aibom produces an AI-BOM (the AI equivalent of an SBOM) plus posture findings mapped to the OWASP LLM Top 10, and gates your CI on new critical/high findings.

Zero dependencies (Python stdlib only). Part of ScopeSafe.

pip install scopesafe-aibom   # installs the `aibom` command

aibom .            # human-readable report, exit 1 on CRITICAL/HIGH
aibom . --json     # raw AI-BOM JSON (SBOM export)

What it finds

• Agents — LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex constructors and graph idioms (StateGraph().compile(), .bind_tools(), factory functions), with cross-file resolution of imported tools/models
• Models — client instantiation across frameworks + direct SDKs, including config-default model names (model: str = field(default="provider/model"))
• Tools — @tool decorators, Tool() constructors, TOOLS = [...] lists, with capability tags (filesystem/exec/network/delete/...)
• MCP servers — .mcp.json / claude_desktop_config.json, scope classification (broad/scoped/unknown)
• Posture findings — broadly-scoped MCP servers, exec-capable servers, destructive tools without human-in-the-loop, hardcoded provider keys — each mapped to an OWASP LLM Top 10 category

Continuous monitoring (ScopeSafe platform)

Upload scans to track finding lifecycle (new / recurring / resolved) across your projects and gate PRs:

export AIBOM_TOKEN=aibom_...          # workspace API token from settings
export AIBOM_API_URL=https://api.scopesafe.net

aibom . --upload --project my-repo
# aibom: uploaded scan 3f2a... (project 'my-repo')
#   findings: 1 new, 4 recurring, 2 resolved
#   gate: fail — 1 new high finding(s), e.g. AGENT-001: ...

Exit codes with --upload: 0 gate passed/skipped · 1 gate failed · 2 upload error.

Development

pip install -e ".[dev]"
pytest -q
ruff check src/

License

MIT