Skip to content

Commit 70ccbd5

Browse files
Zie619claude
Zie619
and
claude
committed
Initial release v0.1.0
AI Bill of Materials scanner — discovers every AI agent, model, and API hiding in your infrastructure. Features: - 5 scanners: code, docker, network, cloud, n8n workflows - AI SDK detection for OpenAI, Anthropic, Google, Mistral, and more - 5 output formats: table, JSON/CycloneDX, HTML, Markdown, SARIF - Risk scoring engine with multi-factor assessment - Shadow AI and hardcoded API key detection - 124 tests with full coverage Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
0 parents  commit 70ccbd5

99 files changed

Lines changed: 12584 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.dockerignore‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
.venv/
2+
venv/
3+
.git/
4+
__pycache__/
5+
*.py[cod]
6+
dist/
7+
build/
8+
*.egg-info/
9+
.pytest_cache/
10+
.ruff_cache/
11+
.coverage
12+
htmlcov/
13+
tests/
14+
.github/
15+
*.md
16+
!README.md
17+
.idea/
18+
.vscode/

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
name: Bug Report
3+
about: Report a bug in ai-bom
4+
title: "[BUG] "
5+
labels: bug
6+
assignees: ""
7+
---
8+
9+
## Describe the bug
10+
A clear and concise description of what the bug is.
11+
12+
## To Reproduce
13+
Steps to reproduce the behavior:
14+
1. Run `ai-bom scan ...`
15+
2. With options: `--format ... --severity ...`
16+
3. On target: (describe the project/file structure)
17+
18+
## Expected behavior
19+
What you expected to happen.
20+
21+
## Actual behavior
22+
What actually happened. Include the full output or error message.
23+
24+
## Environment
25+
- ai-bom version: (`ai-bom version`)
26+
- Python version: (`python --version`)
27+
- OS: (e.g., Ubuntu 22.04, macOS 14, Windows 11)
28+
29+
## Scan Configuration
30+
- Output format used: (table / cyclonedx / json / html / markdown / sarif)
31+
- Severity filter: (none / critical / high / medium / low)
32+
- Scanner flags: (e.g., `--include-tests`, `--n8n-local`, `--no-color`)
33+
- Target type: (directory / single file / git URL)
34+
35+
## Additional context
36+
Add any other context, logs, or screenshots.

‎.github/ISSUE_TEMPLATE/feature_request.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Feature Request
3+
about: Suggest an idea for ai-bom
4+
title: "[FEATURE] "
5+
labels: enhancement
6+
assignees: ""
7+
---
8+
9+
## Problem
10+
A clear description of the problem this feature would solve.
11+
12+
## Proposed Solution
13+
Describe the solution you'd like.
14+
15+
## Alternatives Considered
16+
Describe any alternative solutions or features you've considered.
17+
18+
## Use Case
19+
Who would benefit from this feature and how?
20+
21+
## Additional context
22+
Add any other context, mockups, or references.

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
## Summary
2+
Brief description of changes.
3+
4+
## Changes
5+
- [ ] Change 1
6+
- [ ] Change 2
7+
8+
## Type
9+
- [ ] Bug fix
10+
- [ ] New feature
11+
- [ ] Breaking change
12+
- [ ] Documentation
13+
14+
## Testing
15+
- [ ] Added/updated tests
16+
- [ ] All tests pass (`pytest -v`)
17+
- [ ] Linting passes (`ruff check`)
18+
19+
## Checklist
20+
- [ ] Code follows project style
21+
- [ ] Self-reviewed the diff
22+
- [ ] No sensitive data (API keys, credentials) committed
23+
24+
## Scanner Changes (if applicable)
25+
- [ ] New scanner uses `__init_subclass__` auto-registration (set `name` class attribute)
26+
- [ ] Scanner implements `supports()` and `scan()` methods
27+
- [ ] New detection patterns added to `config.py`
28+
- [ ] Reporter registered in `reporters/__init__.py` REPORTERS dict

‎.github/workflows/ci.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
test:
11+
runs-on: ubuntu-latest
12+
strategy:
13+
matrix:
14+
python-version: ["3.10", "3.11", "3.12", "3.13"]
15+
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Set up Python ${{ matrix.python-version }}
20+
uses: actions/setup-python@v5
21+
with:
22+
python-version: ${{ matrix.python-version }}
23+
cache: 'pip'
24+
25+
- name: Install dependencies
26+
run: pip install -e ".[dev]"
27+
28+
- name: Lint with ruff
29+
run: ruff check src/ tests/
30+
31+
- name: Run tests
32+
run: pytest -v

‎.github/workflows/dogfood.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Dogfood (ai-bom scans itself)
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
permissions:
10+
security-events: write
11+
12+
jobs:
13+
scan:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Set up Python
19+
uses: actions/setup-python@v5
20+
with:
21+
python-version: "3.12"
22+
cache: 'pip'
23+
24+
- name: Install ai-bom
25+
run: pip install -e .
26+
27+
- name: Run ai-bom scan (SARIF)
28+
run: ai-bom scan . --format sarif -o results.sarif
29+
continue-on-error: true
30+
31+
- name: Upload SARIF to GitHub Security
32+
uses: github/codeql-action/upload-sarif@v3
33+
if: hashFiles('results.sarif') != ''
34+
with:
35+
sarif_file: results.sarif

‎.github/workflows/publish.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Publish to PyPI
2+
3+
on:
4+
push:
5+
tags: ["v*"]
6+
7+
permissions:
8+
id-token: write
9+
contents: read
10+
11+
jobs:
12+
publish:
13+
runs-on: ubuntu-latest
14+
environment: pypi
15+
16+
steps:
17+
- uses: actions/checkout@v4
18+
19+
- name: Set up Python
20+
uses: actions/setup-python@v5
21+
with:
22+
python-version: "3.12"
23+
24+
- name: Install build tools
25+
run: pip install build
26+
27+
- name: Build package
28+
run: python -m build
29+
30+
- name: Publish to PyPI
31+
uses: pypa/gh-action-pypi-publish@release/v1

‎.gitignore‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Virtual environments
2+
.venv/
3+
venv/
4+
env/
5+
6+
# Python bytecode
7+
__pycache__/
8+
*.py[cod]
9+
*$py.class
10+
11+
# Build artifacts
12+
dist/
13+
build/
14+
*.egg-info/
15+
16+
# Testing
17+
.pytest_cache/
18+
.coverage
19+
htmlcov/
20+
21+
# Linting
22+
.ruff_cache/
23+
24+
# IDE
25+
.idea/
26+
.vscode/
27+
*.swp
28+
*.swo
29+
30+
# Node
31+
node_modules/
32+
33+
# OS
34+
.DS_Store
35+
Thumbs.db

‎CHANGELOG.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file.
4+
5+
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6+
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7+
8+
## [Unreleased]
9+
10+
## [0.1.0] - 2026-02-08
11+
12+
### Added
13+
- 5 scanners: code, docker, network, cloud (Terraform/CloudFormation), n8n workflows
14+
- AI SDK detection for OpenAI, Anthropic, Google, Mistral, Cohere, HuggingFace, and more
15+
- Model version pinning and deprecation checks
16+
- Shadow AI detection (undeclared AI dependencies)
17+
- Hardcoded API key detection
18+
- n8n workflow agent chain analysis with MCP risk assessment
19+
- 5 output formats: table, JSON/CycloneDX, HTML, Markdown, SARIF
20+
- SARIF 2.1.0 output for GitHub Code Scanning integration
21+
- Single-file and directory scanning
22+
- Git repository URL scanning (auto-clone)
23+
- Severity filtering (critical, high, medium, low)
24+
- Risk scoring engine with multi-factor assessment
25+
- GitHub Action for CI/CD integration (`trusera/ai-bom@v1`)
26+
- Docker container distribution
27+
- 124 tests with full coverage of scanners and reporters
28+
29+
[Unreleased]: https://github.com/trusera/ai-bom/compare/v0.1.0...HEAD
30+
[0.1.0]: https://github.com/trusera/ai-bom/releases/tag/v0.1.0

‎CODE_OF_CONDUCT.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
We as members, contributors, and leaders pledge to make participation in our
6+
community a harassment-free experience for everyone, regardless of age, body
7+
size, visible or invisible disability, ethnicity, sex characteristics, gender
8+
identity and expression, level of experience, education, socio-economic status,
9+
nationality, personal appearance, race, religion, or sexual identity
10+
and orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to a positive environment:
15+
16+
* Using welcoming and inclusive language
17+
* Being respectful of differing viewpoints and experiences
18+
* Gracefully accepting constructive criticism
19+
* Focusing on what is best for the community
20+
* Showing empathy towards other community members
21+
22+
Examples of unacceptable behavior:
23+
24+
* The use of sexualized language or imagery and unwelcome sexual attention
25+
* Trolling, insulting or derogatory comments, and personal or political attacks
26+
* Public or private harassment
27+
* Publishing others' private information without explicit permission
28+
* Other conduct which could reasonably be considered inappropriate
29+
30+
## Enforcement
31+
32+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
33+
reported to the project team at **conduct@trusera.dev**.
34+
35+
All complaints will be reviewed and investigated promptly and fairly.
36+
37+
## Attribution
38+
39+
This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
40+
version 2.1.

0 commit comments

Comments
 (0)