PkgFoundry
Catalog PyPI
Back to packageRELEASE DETAILS

0.4.0

PyPI

ai-finder

AI Finder - AI artifact scanner for supply chain security

aicompliancesbomscannersupply-chain
Published18 Aug 2026
Direct dependencies23
Transitive dependenciesNot calculated

README

Version 0.4.0 documentation

ai-finder

License: MIT Python 3.9+

AI artifact scanner for supply chain security and compliance

About

ai-finder detects AI/ML artifacts in codebases for:

  • Supply Chain Security - Identify AI models, SDKs, and dependencies
  • EU AI Act Compliance - Generate SBOM reports for regulatory requirements
  • Risk Assessment - Detect API keys, model provenance, and usage patterns

Features

SDK Detection (12 languages)

LanguageSDKs Detected
PythonOpenAI, Anthropic, HuggingFace, LangChain, LlamaIndex, Strands, CrewAI, AutoGen
JavaScript/TypeScriptOpenAI, Anthropic, LangChain, Vercel AI SDK
Gogo-openai, go-anthropic
Rustasync-openai, anthropic-rs
Java/Kotlinopenai-java, LangChain4j, Spring AI
And more...Ruby, PHP, C#, C++, Swift, Scala, Kotlin

AI Package Detection (150+ packages)

Comprehensive detection across categories:

CategoryPackages
LLM ClientsOpenAI, Anthropic, Cohere, Groq, Mistral, Ollama, Google GenAI, Azure OpenAI
Agent FrameworksLangChain, LlamaIndex, Strands Agents, CrewAI, AutoGen, Semantic Kernel
ML FrameworksPyTorch, TensorFlow, Keras, JAX, Transformers, scikit-learn, XGBoost
Vector DatabasesChromaDB, Pinecone, Weaviate, Qdrant, Milvus, FAISS, LanceDB
Speech/Audio AIOpenAI Whisper, Faster Whisper, ElevenLabs, Bark
AI SafetyAIProxyGuard, Guardrails AI, NeMo Guardrails, LLM Guard
Tools & UtilitiesTavily, LangSmith, W&B, MLflow, Accelerate, Datasets
MCP/Tool UseMCP, Anthropic Tools

Model File Detection (12 formats)

GGUF, SafeTensors, ONNX, PyTorch, TensorFlow, TFLite, CoreML, JAX, Keras, MXNet, PaddlePaddle, Pickle

Manifest Parsing (11 formats)

requirements.txt, pyproject.toml, package.json, go.mod, Cargo.toml, pom.xml, build.gradle, Gemfile, composer.json, *.csproj, Package.swift

Output Formats

  • JSON - Machine-readable findings
  • CycloneDX 1.6 - OWASP SBOM format with ML-BOM support
  • SPDX 2.3 - Linux Foundation SBOM format
  • SPDX 3.0 - Latest SPDX specification with JSON-LD

License Handling

  • Licenses are automatically enriched from PyPI, npm, and HuggingFace
  • Unknown licenses are marked as NOASSERTION per SPDX specification
  • Supports SPDX license expressions

Installation

pip install ai-finder

Requires Python 3.9 or later.

Usage

# Scan a directory
ai-finder scan /path/to/project

# Generate SBOM (CycloneDX)
ai-finder scan /path/to/project -f cyclonedx -o sbom.json

# Generate SBOM (SPDX)
ai-finder scan /path/to/project -f spdx -o sbom.spdx.json

# Identify a model file
ai-finder identify model.gguf

# Initialize local KB
ai-finder kb init

# Lookup model by PURL
ai-finder kb lookup pkg:huggingface/TinyLlama/TinyLlama-1.1B-Chat-v1.0

Telemetry

This tool collects anonymous usage telemetry to help improve the product. No file paths, code content, or scan targets are collected.

Disable telemetry:

# Per-session
ai-finder --no-telemetry scan .

# Environment variable
export AI_FINDER_TELEMETRY=0

# Or use the standard
export DO_NOT_TRACK=1

See docs/TELEMETRY.md for full details on what is collected.

Development

# Clone repository
git clone https://github.com/scanoss/ai-finder.git
cd ai-finder

# Install with uv
uv sync --all-packages --all-extras

# Run tests
uv run pytest

# Lint
uv run ruff check .

Contributing

We welcome contributions! Please read CONTRIBUTING.md before submitting a pull request.

Security

If you discover a security vulnerability, please follow our Security Policy.

License

This project is licensed under the MIT License - see LICENSE for details.

Copyright (c) 2026 SCANOSS.

Downloads & popularity

Awaiting observations

No metric observations yet

Download counts and popularity will appear here as the collector receives them.

Declared dependencies 23

Native requirements
23 direct targetsNot calculated transitive count
Package / targetRequirementRelationship
click
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
click>=8.0runtime
osslili
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
osslili>=1.6runtime
ptelemetry
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
ptelemetry>=0.2.2runtime
python-levenshtein
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
python-levenshtein>=0.25.1runtime
pyyaml
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pyyaml>=6.0runtime
requests
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
requests>=2.28runtime
tomli
Environment
{
  "extras": "",
  "marker": "python_version < \"3.11\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tomli>=2.0; python_version < "3.11"runtime
tqdm
Environment
{
  "extras": "",
  "marker": null,
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tqdm>=4.65runtime
pytest-cov
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pytest-cov>=4.0; extra == "dev"runtime
pytest-mock
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pytest-mock>=3.10; extra == "dev"runtime
pytest
Environment
{
  "extras": "",
  "marker": "extra == \"dev\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
pytest>=7.0; extra == "dev"runtime
python-tlsh
Environment
{
  "extras": "",
  "marker": "extra == \"fuzzy\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
python-tlsh>=4.5.0; extra == "fuzzy"runtime
tree-sitter-c-sharp
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-c-sharp>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-cpp
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-cpp>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-go
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-go>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-java
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-java>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-javascript
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-javascript>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-php
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-php>=0.22; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-python
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-python>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-ruby
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-ruby>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-rust
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-rust>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter-typescript
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter-typescript>=0.21; python_version >= "3.10" and extra == "relationships"runtime
tree-sitter
Environment
{
  "extras": "",
  "marker": "python_version >= \"3.10\" and extra == \"relationships\"",
  "requires_python": ">=3.9",
  "evaluation": "NOT_EVALUATED"
}
tree-sitter>=0.22; python_version >= "3.10" and extra == "relationships"runtime

Distribution files

2 collected
ai_finder-0.4.0-py3-none-any.whl

bdist_wheel · 219.64 KB · Python py3

Source file
ai_finder-0.4.0.tar.gz

sdist · 230.85 KB · Python source

Source file

Repository

PENDING
scanoss/ai-finder

Shared repository data · GitHub

License detected in repository
Not collected

Metadata history

Meaningful changes
Current collected state Current

Observed since 21 Oct, 10:42 UTC

No superseded metadata states collected. Unchanged observations do not create new revisions.

Record identity

package_version:f1fce8912bc931806d400c6683caa6f4857f50bbb39e120cc5e5d62cbc4a9ec7

Other collected versions

View all collected versions →