aibomstd

aibomstd

The open standard for AI Bill of Materials.

Scan any repo and instantly know what AI components are running, which send data outside your boundary, and what your compliance risk is.

---

Install

pip install aibomstd

---

CLI — scan a repo in seconds

aibomstd scan ./my-repo

┌─────────────────────┬────────────┬──────────────┬──────────┬────────┐
│ Component           │ Type       │ Provider     │ Boundary │ Risk   │
├─────────────────────┼────────────┼──────────────┼──────────┼────────┤
│ openai              │ api-client │ openai       │ leaves   │ high   │
│ anthropic           │ api-client │ anthropic    │ leaves   │ high   │
│ langchain           │ framework  │ langchain-ai │ internal │ none   │
│ torch               │ framework  │ pytorch      │ internal │ none   │
│ llama-3-8b.gguf     │ model      │ unknown      │ internal │ medium │
│ training.jsonl      │ dataset    │ unknown      │ internal │ medium │
└─────────────────────┴────────────┴──────────────┴──────────┴────────┘

Summary:
  Total components : 6
  Data egress      : YES
  Shadow AI        : YES
  Risk score       : HIGH

Generated: my-repo.aibom.json

---

What it detects

Auto-detects data-leaves-boundary and data-residency for every component.

---

Other CLI commands

# Validate a BOM file against the schema
aibomstd validate my-repo.aibom.json

# Check version
aibomstd version

---

SDK — generate BOMs in Python

from aibomstd import AiBomBuilder
from aibomstd.components import ModelComponent, ApiClientComponent

bom = (
    AiBomBuilder(product="my-ai-product", version="1.0.0")
    .add_component(ModelComponent(
        name="llama-3-8b-instruct",
        version="3.0",
        provider="meta",
        data_leaves_boundary=False,
        data_residency="IN"
    ))
    .add_component(ApiClientComponent(
        name="gpt-4o",
        version="2024-05-13",
        provider="openai",
        data_leaves_boundary=True,
        data_residency="US"
    ))
)

print(bom.to_json())       # aibomstd JSON
bom.to_html()              # self-contained HTML report
bom.to_cyclonedx()         # CycloneDX v1.7 JSON

---

Schema

Every output document references the canonical schema:

https://aibomstd.com/schema/v0.1/aibomstd.schema.json

---

License

Apache 2.0 — https://aibomstd.com