aisbom-cli

AIsbom is an AI BOM scanner and supply chain security platform for machine learning models. It generates AI Bills of Materials and is aimed at the problem of identifying malware, license risks, and model drift in model files that traditional SBOM tools miss.

The CLI scans ML models statically and supports PyTorch, Safetensors, and GGUF. It can inspect model artifacts without downloading them in some cases: the page shows a live scan of a Hugging Face model with header inspection over HTTP, and it describes remote streaming audit through hf:// using HTTP Range requests. Aisbom also offers drift detection with a command such as aisbom diff production.json candidate.json to compare model hashes, licenses, or dependencies between commits. A strict mode is available through --strict to enforce an allowlist-only policy and flag unknown imports or libraries as a critical risk. The site also says it decompiles tensors and inspects serialized data structures, and that it can produce machine-readable AI BOMs in CycloneDX and SPDX JSON.

Delivery options listed on the page include a Python package install, zero-install use with pipx run --spec aisbom-cli aisbom scan hf://..., and a standalone binary for air-gapped systems with no Python required. The hosted platform is separate from the CLI and is described as turning CI scans into a continuous inventory across repositories, with scan history, drift tracking, and shareable executive reports. The page also says every PR is scanned in CI via a GitHub Action, and that the CLI and GitHub Action stay free and fully local while the hosted dashboard upload is optional and opt-in with a free tier included.

The site reports 28K+ PyPI downloads and 3,400+ models scanned.