aisbom
AI SBOM: AI Software Bill of Materials - The Supply Chain for Artificial Intelligence
Stars: 60
AIsbom is a specialized security and compliance scanner for Machine Learning artifacts. It performs Deep Binary Introspection on model files to detect malware risks and legal license violations hidden inside the serialized weights. The tool generates a compliant sbom.json (CycloneDX v1.6) including SHA256 hashes and license data. AIsbom also offers features like remote scanning on Hugging Face, config drift detection, strict mode for allowlisting, migration readiness for upcoming PyTorch changes, and markdown reporting for CI/CD integration. It advocates for a defense-in-depth strategy by combining static analysis and runtime isolation to ensure security. The tool visualizes security posture using an offline viewer and provides a trust factor by allowing users to generate safe mock artifacts for verification.
README:
AIsbom is a specialized security and compliance scanner for Machine Learning artifacts.
- SPDX 2.3: Standard SBOM format for industry compliance.
- CycloneDX: Supported (Default output format).
Install via Pip or download our standalone, air-gapped binary for USB/offline audits.
Unlike generic SBOM tools that only parse requirements.txt, AIsbom performs Deep Binary Introspection on model files (.pt, .pkl, .safetensors, .gguf) to detect malware risks and legal license violations hidden inside the serialized weights.
Install directly from PyPI. No cloning required.
pip install aisbom-cliNote: The package name is aisbom-cli, but the command you run is aisbom.
For environments where installing Python is not possible, download the single-file executable from our Releases page.
Available Binaries:
-
aisbom-linux-amd64(Linux x86_64) -
aisbom-macos-amd64(macOS Intel) -
aisbom-macos-arm64(macOS Silicon M1/M2/M3)
Due to Apple's strict security policies for unsigned binaries, you must explicitly allow the application to run.
# 1. Make the binary executable
chmod +x aisbom-macos-*
# 2. Remove the "Quarantine" attribute (Fixes "Unidentified Developer" error)
xattr -d com.apple.quarantine aisbom-macos-*
# 3. Run it
./aisbom-macos-arm64 --helpWhy is xattr needed?
macOS tags downloaded files with a "quarantine" attribute. Since our open-source binary is not code-signed with an Apple Developer ID, Gatekeeper will block it by default. The xattr -d command removes this tag, allowing the binary to execute on your machine.
- Zero Dependencies: Everything is bundled.
- Portable: Runs on bare metal servers.
Point it at any directory containing your ML project. It scans recursively for requirements files AND binary model artifacts.
aisbom scan ./my-project-folderYou will see a combined Security & Legal risk assessment in your terminal:
๐ง AI Model Artifacts Found
โโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ Filename โ Framework โ Security Risk โ Legal Risk โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ bert_finetune.pt โ PyTorch โ CRITICAL (RCE Found) โ UNKNOWN โ
โ safe_model.st โ SafeTensors โ LOW โ UNKNOWN โ
โ restricted_model.st โ SafeTensors โ LOW โ LEGAL RISK (cc-by-nc-4.0) โ
โ llama-3-quant.gguf โ GGUF โ LOW โ LEGAL RISK (cc-by-nc-sa) โ
โโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
A compliant sbom.json (CycloneDX v1.6) including SHA256 hashes and license data will be generated in your current directory.
Scan models directly on Hugging Face without downloading terabytes of weights. We use HTTP Range requests to inspect headers over the wire.
aisbom scan hf://google-bert/bert-base-uncased- Speed: Scans in seconds, not minutes.
- Storage: Zero disk usage.
-
Security: Verify "SafeTensors" compliance before you even
git clone.
Detect "Silent Regressions" in your AI Supply Chain. The diff command compares your current SBOM against a known baseline JSON.
aisbom diff baseline_sbom.json new_sbom.jsonDrift Analysis Output:
โโโโโโโโโโโโโโโโโณโโโโโโโโโโโณโโโโโโโโโโณโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโ
โ Component โ Type โ Change โ Security Risk โ Legal Risk โ Details โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ drift-risk.pt โ Modified โ DRIFT โ LOW -> โ - โ โ
โ โ โ โ CRITICAL โ โ โ
โ drift-license โ Modified โ DRIFT โ - โ UNKNOWN -> โ Lic: MIT -> โ
โ โ โ โ โ LEGAL RISK โ CC-BY-NC โ
โ drift-hash.pt โ Modified โ DRIFT โ INTEGRITY FAIL โ - โ Hash: ... โ
โโโโโโโโโโโโโโโโโดโโโโโโโโโโโดโโโโโโโโโโดโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโ
It enforces Quality Gates by exiting with code 1 if:
- A new CRITICAL risk is introduced.
- A Component's risk level escalates (e.g., LOW -> CRITICAL).
- Hash Drift: A verified file has been tampered with (Marked as INTEGRITY FAIL).
For high-security environments, switch from "Blocklisting" (looking for malware) to "Allowlisting" (blocking everything unknown).
aisbom scan model.pkl --strictThis will report any import that is not in the safe-list.
Allowed Libraries: torch (and submodules), numpy, collections, typing, datetime, re, pathlib, copy, functools, dataclasses, uuid.
Allowed Builtins: dict, list, set, tuple, int, float, str, bytes, etc., etc.).
- Flags any unknown global import as
CRITICAL.
Prepare your models for the upcoming PyTorch security defaults. PyTorch 2.6+ will default to weights_only=True, which breaks many legacy models.
aisbom scan model.pt --lintThe --lint flag activates the Migration Linter, which statically simulates the unpickling stack to predict runtime failures without executing code.
AIsbom advocates for a two-layer security approach:
-
Layer 1 (Pre-Execution): Use
aisbom scan --lintto statically analyze the file structure. This catches 99% of obvious malware and incompatible globals without ever loading the file. -
Layer 2 (Runtime Isolation): If you must load a model that uses
REDUCEor unsafe globals (common in legacy files), do not run it on bare metal.-
Recommendation: Use Sandboxed Execution (e.g.,
uvx+amazing-sandbox) to contain any potential RCE.
-
Recommendation: Use Sandboxed Execution (e.g.,
[!TIP] Why both? Static analysis is fast but can be tricked by complex obfuscation. Runtime sandboxing is secure but slow. Together, they provide speed and safety.
It detects:
- Custom Class Imports: Objects that are not in the PyTorch default allowlist.
-
Unsafe Globals: Usage of
posix.systemor other unsafe modules.
Output:
๐ก๏ธ Migration Readiness (weights_only=True)
โโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ File โ Issue โ Recommendation โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ mock_broken.pt โ Custom Class Import Detected: โ Module 'aisbom' is not in PyTorch โ
โ โ aisbom.mock.Layer โ default allowlist. Use โ
โ โ โ `torch.serialization.add_safe_globals` โ
โ โ โ . โ
โโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
Generate a GitHub-flavored Markdown report suitable for Pull Request comments.
aisbom scan . --format markdown --output report.mdGenerate SPDX 2.3 Software Bill of Materials.
aisbom scan . --format spdx --output sbom.spdx.jsonAdd AIsbom to your GitHub Actions pipeline.
Behavior: The scanner returns exit code 1 if Critical risks are found, automatically blocking the build/merge.
name: AI Security Scan
on: [pull_request]
jobs:
aisbom-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Scan AI Models
uses: Lab700xOrg/aisbom@v0
with:
directory: '.'Don't like reading JSON? You can visualize your security posture using our offline viewer.
- Run the scan to generate
sbom.json. - Go to aisbom.io/viewer.html.
- Drag and drop your JSON file.
- Get an instant dashboard of risks, license issues, and compliance stats.
Note: The viewer is client-side only. Your SBOM data never leaves your browser.
AI models are not just text files; they are executable programs and IP assets.
-
The Security Risk: PyTorch (
.pt) files are Zip archives containing Pickle bytecode. A malicious model can execute arbitrary code (RCE) instantly when loaded. - The Legal Risk: A developer might download a "Non-Commercial" model (CC-BY-NC) and deploy it to production. Since the license is hidden inside the binary header, standard tools miss it.
- The Solution: We look inside. We decompile bytecode and parse internal metadata headers without loading the heavy weights into RAM.
Security tools require trust. We do not distribute malicious binaries.
However, AIsbom includes a built-in generator so you can create safe "mock artifacts" to verify the scanner works.
1. Install:
pip install aisbom-cli2. Generate Test Artifacts: Run this command to create a mock "Pickle Bomb" and a "Restricted License" model in your current folder.
aisbom generate-test-artifactsResult: Files named mock_malware.pt, mock_restricted.safetensors, mock_restricted.gguf, and mock_broken.pt are created.
3. Scan them:
aisbom scan .Result: You will see mock_malware.pt flagged as CRITICAL, legal risks flagged, and if you run with --lint, mock_broken.pt will appear in the Migration Readiness table.
AIsbom uses a static analysis engine to disassemble Python Pickle opcodes. It looks for specific GLOBAL and STACK_GLOBAL instructions that reference dangerous modules:
-
os/posix(System calls) -
subprocess(Shell execution) -
builtins.eval/exec(Dynamic code execution) -
socket(Network reverse shells)
For Tasks:
Click tags to check more tools for each tasksFor Jobs:
Alternative AI tools for aisbom
Similar Open Source Tools
aisbom
AIsbom is a specialized security and compliance scanner for Machine Learning artifacts. It performs Deep Binary Introspection on model files to detect malware risks and legal license violations hidden inside the serialized weights. The tool generates a compliant sbom.json (CycloneDX v1.6) including SHA256 hashes and license data. AIsbom also offers features like remote scanning on Hugging Face, config drift detection, strict mode for allowlisting, migration readiness for upcoming PyTorch changes, and markdown reporting for CI/CD integration. It advocates for a defense-in-depth strategy by combining static analysis and runtime isolation to ensure security. The tool visualizes security posture using an offline viewer and provides a trust factor by allowing users to generate safe mock artifacts for verification.
dbgpts
The dbgpts repository contains data apps, AWEL operators, AWEL workflow templates, and agents that are built upon DB-GPT. Users can install and manage these components within their DB-GPT environment. The repository offers functionalities such as listing available flows, installing dbgpts from the official repository, viewing installed dbgpts, running flows, and managing repositories. Users can create new workflow templates and operators using the provided commands. The repository aims to enhance the capabilities of DB-GPT by providing a collection of useful tools and resources for data processing and workflow management.
MukeshRobot
MukeshRobot is a Telegram group controller bot written in Python. It is designed to help group administrators manage their groups more effectively. The bot can perform a variety of tasks, including: - Welcoming new members - Banning spammers - Deleting inappropriate messages - Managing group settings - Sending announcements - Playing games MukeshRobot is easy to set up and use. Simply add the bot to your group and give it administrator privileges. The bot will then automatically start performing its tasks. You can also customize the bot's behavior by editing the config file. MukeshRobot is a powerful tool that can help you keep your Telegram groups clean and organized. It is a must-have for any group administrator.
datapizza-ai
Datapizza AI is a Python-based GenAI framework designed for speed, providing an API-first design with multi-provider support, tool integration, memory management, and observability features. It offers less abstraction, more control, and is vendor-agnostic, allowing easy model swapping and clear interfaces. The framework enables building sophisticated AI systems, document processing, RAG pipelines, and more, with a focus on observability and performance monitoring. Datapizza AI is trusted by engineers for its predictability, fast debugging, and reliable code in production.
tinyclaw
TinyClaw is a lightweight wrapper around Claude Code that connects WhatsApp via QR code, processes messages sequentially, maintains conversation context, runs 24/7 in tmux, and is ready for multi-channel support. Its key innovation is the file-based queue system that prevents race conditions and enables multi-channel support. TinyClaw consists of components like whatsapp-client.js for WhatsApp I/O, queue-processor.js for message processing, heartbeat-cron.sh for health checks, and tinyclaw.sh as the main orchestrator with a CLI interface. It ensures no race conditions, is multi-channel ready, provides clean responses using claude -c -p, and supports persistent sessions. Security measures include local storage of WhatsApp session and queue files, channel-specific authentication, and running Claude with user permissions.
boxlite
BoxLite is an embedded, lightweight micro-VM runtime designed for AI agents running OCI containers with hardware-level isolation. It is built for high concurrency with no daemon required, offering features like lightweight VMs, high concurrency, hardware isolation, embeddability, and OCI compatibility. Users can spin up 'Boxes' to run containers for AI agent sandboxes and multi-tenant code execution scenarios where Docker alone is insufficient and full VM infrastructure is too heavy. BoxLite supports Python, Node.js, and Rust with quick start guides for each, along with features like CPU/memory limits, storage options, networking capabilities, security layers, and image registry configuration. The tool provides SDKs for Python and Node.js, with Go support coming soon. It offers detailed documentation, examples, and architecture insights for users to understand how BoxLite works under the hood.
pilot
Pilot is an AI tool designed to streamline the process of handling tickets from GitHub, Linear, Jira, or Asana. It plans the implementation, writes the code, runs tests, and opens a PR for you to review and merge. With features like Autopilot, Epic Decomposition, Self-Review, and more, Pilot aims to automate the ticket handling process and reduce the time spent on prioritizing and completing tasks. It integrates with various platforms, offers intelligence features, and provides real-time visibility through a dashboard. Pilot is free to use, with costs associated with Claude API usage. It is designed for bug fixes, small features, refactoring, tests, docs, and dependency updates, but may not be suitable for large architectural changes or security-critical code.
Shannon
Shannon is a battle-tested infrastructure for AI agents that solves problems at scale, such as runaway costs, non-deterministic failures, and security concerns. It offers features like intelligent caching, deterministic replay of workflows, time-travel debugging, WASI sandboxing, and hot-swapping between LLM providers. Shannon allows users to ship faster with zero configuration multi-agent setup, multiple AI patterns, time-travel debugging, and hot configuration changes. It is production-ready with features like WASI sandbox, token budget control, policy engine (OPA), and multi-tenancy. Shannon helps scale without breaking by reducing costs, being provider agnostic, observable by default, and designed for horizontal scaling with Temporal workflow orchestration.
AgentX
AgentX is a next-generation open-source AI agent development framework and runtime platform. It provides an event-driven runtime with a simple framework and minimal UI. The platform is ready-to-use and offers features like multi-user support, session persistence, real-time streaming, and Docker readiness. Users can build AI Agent applications with event-driven architecture using TypeScript for server-side (Node.js) and client-side (Browser/React) development. AgentX also includes comprehensive documentation, core concepts, guides, API references, and various packages for different functionalities. The architecture follows an event-driven design with layered components for server-side and client-side interactions.
open-computer-use
Open Computer Use is an open-source platform that enables AI agents to control computers through browser automation, terminal access, and desktop interaction. It is designed for developers to create autonomous AI workflows. The platform allows agents to browse the web, run terminal commands, control desktop applications, orchestrate multi-agents, stream execution, and is 100% open-source and self-hostable. It provides capabilities similar to Anthropic's Claude Computer Use but is fully open-source and extensible.
helix
HelixML is a private GenAI platform that allows users to deploy the best of open AI in their own data center or VPC while retaining complete data security and control. It includes support for fine-tuning models with drag-and-drop functionality. HelixML brings the best of open source AI to businesses in an ergonomic and scalable way, optimizing the tradeoff between GPU memory and latency.
memsearch
Memsearch is a tool that allows users to give their AI agents persistent memory in a few lines of code. It enables users to write memories as markdown and search them semantically. Inspired by OpenClaw's markdown-first memory architecture, Memsearch is pluggable into any agent framework. The tool offers features like smart deduplication, live sync, and a ready-made Claude Code plugin for building agent memory.
vibium
Vibium is a browser automation infrastructure designed for AI agents, providing a single binary that manages browser lifecycle, WebDriver BiDi protocol, and an MCP server. It offers zero configuration, AI-native capabilities, and is lightweight with no runtime dependencies. It is suitable for AI agents, test automation, and any tasks requiring browser interaction.
solo-server
Solo Server is a lightweight server designed for managing hardware-aware inference. It provides seamless setup through a simple CLI and HTTP servers, an open model registry for pulling models from platforms like Ollama and Hugging Face, cross-platform compatibility for effortless deployment of AI models on hardware, and a configurable framework that auto-detects hardware components (CPU, GPU, RAM) and sets optimal configurations.
myclaw
myclaw is a personal AI assistant built on agentsdk-go that offers a CLI agent for single message or interactive REPL mode, full orchestration with channels, cron, and heartbeat, support for various messaging channels like Telegram, Feishu, WeCom, WhatsApp, and a web UI, multi-provider support for Anthropic and OpenAI models, image recognition and document processing, scheduled tasks with JSON persistence, long-term and daily memory storage, custom skill loading, and more. It provides a comprehensive solution for interacting with AI models and managing tasks efficiently.
vllm-mlx
vLLM-MLX is a tool that brings native Apple Silicon GPU acceleration to vLLM by integrating Apple's ML framework with unified memory and Metal kernels. It offers optimized LLM inference with KV cache and quantization, vision-language models for multimodal inference, speech-to-text and text-to-speech with native voices, text embeddings for semantic search and RAG, and more. Users can benefit from features like multimodal support for text, image, video, and audio, native GPU acceleration on Apple Silicon, compatibility with OpenAI API, Anthropic Messages API, reasoning models extraction, integration with external tools via Model Context Protocol, memory-efficient caching, and high throughput for multiple concurrent users.
For similar tasks
aisbom
AIsbom is a specialized security and compliance scanner for Machine Learning artifacts. It performs Deep Binary Introspection on model files to detect malware risks and legal license violations hidden inside the serialized weights. The tool generates a compliant sbom.json (CycloneDX v1.6) including SHA256 hashes and license data. AIsbom also offers features like remote scanning on Hugging Face, config drift detection, strict mode for allowlisting, migration readiness for upcoming PyTorch changes, and markdown reporting for CI/CD integration. It advocates for a defense-in-depth strategy by combining static analysis and runtime isolation to ensure security. The tool visualizes security posture using an offline viewer and provides a trust factor by allowing users to generate safe mock artifacts for verification.
For similar jobs
weave
Weave is a toolkit for developing Generative AI applications, built by Weights & Biases. With Weave, you can log and debug language model inputs, outputs, and traces; build rigorous, apples-to-apples evaluations for language model use cases; and organize all the information generated across the LLM workflow, from experimentation to evaluations to production. Weave aims to bring rigor, best-practices, and composability to the inherently experimental process of developing Generative AI software, without introducing cognitive overhead.
LLMStack
LLMStack is a no-code platform for building generative AI agents, workflows, and chatbots. It allows users to connect their own data, internal tools, and GPT-powered models without any coding experience. LLMStack can be deployed to the cloud or on-premise and can be accessed via HTTP API or triggered from Slack or Discord.
VisionCraft
The VisionCraft API is a free API for using over 100 different AI models. From images to sound.
kaito
Kaito is an operator that automates the AI/ML inference model deployment in a Kubernetes cluster. It manages large model files using container images, avoids tuning deployment parameters to fit GPU hardware by providing preset configurations, auto-provisions GPU nodes based on model requirements, and hosts large model images in the public Microsoft Container Registry (MCR) if the license allows. Using Kaito, the workflow of onboarding large AI inference models in Kubernetes is largely simplified.
PyRIT
PyRIT is an open access automation framework designed to empower security professionals and ML engineers to red team foundation models and their applications. It automates AI Red Teaming tasks to allow operators to focus on more complicated and time-consuming tasks and can also identify security harms such as misuse (e.g., malware generation, jailbreaking), and privacy harms (e.g., identity theft). The goal is to allow researchers to have a baseline of how well their model and entire inference pipeline is doing against different harm categories and to be able to compare that baseline to future iterations of their model. This allows them to have empirical data on how well their model is doing today, and detect any degradation of performance based on future improvements.
tabby
Tabby is a self-hosted AI coding assistant, offering an open-source and on-premises alternative to GitHub Copilot. It boasts several key features: * Self-contained, with no need for a DBMS or cloud service. * OpenAPI interface, easy to integrate with existing infrastructure (e.g Cloud IDE). * Supports consumer-grade GPUs.
spear
SPEAR (Simulator for Photorealistic Embodied AI Research) is a powerful tool for training embodied agents. It features 300 unique virtual indoor environments with 2,566 unique rooms and 17,234 unique objects that can be manipulated individually. Each environment is designed by a professional artist and features detailed geometry, photorealistic materials, and a unique floor plan and object layout. SPEAR is implemented as Unreal Engine assets and provides an OpenAI Gym interface for interacting with the environments via Python.
Magick
Magick is a groundbreaking visual AIDE (Artificial Intelligence Development Environment) for no-code data pipelines and multimodal agents. Magick can connect to other services and comes with nodes and templates well-suited for intelligent agents, chatbots, complex reasoning systems and realistic characters.
