Semantic SBOM/CBOM/AI-BOM diff, quality scoring, and compliance validation for CycloneDX/SPDX — component, license, and vulnerability change analysis, cryptographic inventory grading, PQC readiness (CNSA 2.0, NIST IR 8547), and regulatory gates for NTIA, FDA, EU CRA, BSI TR-03183, EUCC, SSDF, EO 14028, and the EU AI Act.

Reviews pull requests for the shortcuts AI coding agents take to look done without being done: relaxed tests, swallowed errors, fake renames, 11 checks in all. Flags them for a human by default, or blocks the merge if you turn that on. Can also turn a goal into a checklist and only accept a patch once every check passes.

A community wiki for all things AI/ML bill of materials (MLBOM, AIBOM) and transparency into AI/ML models.

Generate xBOMs enriched with AI, SaaS, Crypto and more using Static Code Analysis

Git-native AI code provenance: records which AI agent wrote which line, signs each attribution with ed25519, stores it in your git history. Cross-agent (Claude Code, Cursor, Copilot, Codex, Windsurf, OpenCode, Gemini).

Open security scanner and self-hosted control plane for AI, MCP, and cloud. One evidence model — run scans in your environment, centralize findings, govern in your VPC.

Scan codebases for AI SDK usage and map compliance risks to NIST AI RMF, ISO 42001, and EU AI Act

Open-source EU AI Act compliance scanner. 51 checks across Articles 9-15. Drop-in trust layers for LangChain, CrewAI, AutoGen, OpenAI. Local-first, no data leaves your machine.

The industry-standard Agentic Identity & Inventory Scanner. Automatically inventory autonomous agents (LangChain, AutoGen, CrewAI, PydanticAI) using static analysis, network heuristics, and eBPF. Foundational tool for AIBOM compliance and AgentOps governance.

Data and schema powering the worlds largest collection of SBOM/xBOM products, projects, and services

An AI-BOM visual viewer

Go CLI tool that scans a repository for Hugging Face model usage and emits a CycloneDX AI/ML Bill of Materials.

AI system discovery and risk mapping for agentic architectures. Generates CycloneDX AIBOMs with topology and risk classification.

Policy-as-Code guardrails for ML and LLM systems: OPA/Kyverno policies, compliance mappings, signed bundles, evidence trails, and plugin index.

AI Agent Scanner - A standalone AI Agent scanner that can discover agent repos, configuration, system prompts, classify risk and produce compliance-ready reports

SBOM generation for Python & AI projects. Extract metadata from GGUF, ONNX, and PyTorch models. Build SBOM directly from Hugging Face URL. Native Hatchling build-hook.

Audit AI agents, starting at the endpoint.

Runtime AIBOM emitter — generate AI Bills of Materials from what actually ran. Combines static inventory with runtime OTel trace evidence: models, tools, endpoints, versions. CycloneDX-compatible output.

THIS IS H A K C I N G Q U A L I T Y

AIBOM policy-as-code engine — deny risky combinations of models, tools, and data. OPA-style policy rules for AI supply chain governance. Enforce model pinning, tool approvals, and provider restrictions.