Metadata-Version: 2.4
Name: aibomstd
Version: 0.2.4
Summary: AI Bill of Materials Standard — open standard SDK for AI component transparency
Project-URL: Homepage, https://aibomstd.com
Project-URL: Repository, https://github.com/aibomstd/aibomstd
Project-URL: Documentation, https://aibomstd.com/docs
Project-URL: Bug Tracker, https://github.com/aibomstd/aibomstd/issues
Author-email: aibomstd Project <aibomstd@gmail.com>
License: Apache-2.0
Keywords: ai-bill-of-materials,ai-bom,ai-governance,eu-ai-act,mlsecops,supply-chain-security
Classifier: Development Status :: 3 - Alpha
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries
Requires-Python: >=3.11
Requires-Dist: httpx>=0.27.0
Requires-Dist: jinja2>=3.1.0
Requires-Dist: jsonschema>=4.23.0
Requires-Dist: pydantic>=2.0.0
Requires-Dist: rich>=13.0.0
Requires-Dist: typer>=0.12.0
Provides-Extra: dev
Requires-Dist: black>=24.0.0; extra == 'dev'
Requires-Dist: mypy>=1.0.0; extra == 'dev'
Requires-Dist: pytest-cov>=5.0.0; extra == 'dev'
Requires-Dist: pytest>=8.0.0; extra == 'dev'
Description-Content-Type: text/markdown

# aibomstd

**The open standard for AI Bill of Materials.**

Scan any repo and instantly know what AI components are running,
which send data outside your boundary, and what your compliance risk is.

[![CI](https://github.com/aibomstd/aibomstd/actions/workflows/validate-schema.yml/badge.svg)](https://github.com/aibomstd/aibomstd/actions)
[![PyPI](https://img.shields.io/pypi/v/aibomstd)](https://pypi.org/project/aibomstd)
[![License](https://img.shields.io/badge/license-Apache%202.0-green.svg)](https://github.com/aibomstd/aibomstd/blob/main/LICENSE)
[![Python](https://img.shields.io/pypi/pyversions/aibomstd)](https://pypi.org/project/aibomstd)

---

## Install

```bash
pip install aibomstd
```

---

## CLI — scan a repo in seconds

```bash
aibomstd scan ./my-repo
```

```
┌─────────────────────┬────────────┬──────────────┬──────────┬────────┐
│ Component           │ Type       │ Provider     │ Boundary │ Risk   │
├─────────────────────┼────────────┼──────────────┼──────────┼────────┤
│ openai              │ api-client │ openai       │ leaves   │ high   │
│ anthropic           │ api-client │ anthropic    │ leaves   │ high   │
│ langchain           │ framework  │ langchain-ai │ internal │ none   │
│ torch               │ framework  │ pytorch      │ internal │ none   │
│ llama-3-8b.gguf     │ model      │ unknown      │ internal │ medium │
│ training.jsonl      │ dataset    │ unknown      │ internal │ medium │
└─────────────────────┴────────────┴──────────────┴──────────┴────────┘

Summary:
  Total components : 6
  Data egress      : YES
  Shadow AI        : YES
  Risk score       : HIGH

Generated: my-repo.aibom.json
```

---

## What it detects

| Component type | Examples |
|---------------|---------|
| `api-client` | openai, anthropic, cohere, mistral, groq |
| `framework` | langchain, llama-index, transformers, ollama |
| `model` | .gguf, .safetensors, .pt, .onnx files |
| `dataset` | .jsonl, .parquet, .arrow files in data/ folders |
| Shadow AI | API keys in .env not declared in dependencies |

Auto-detects `data-leaves-boundary` and `data-residency` for every component.

---

## Other CLI commands

```bash
# Validate a BOM file against the schema
aibomstd validate my-repo.aibom.json

# Convert from cisco-aibom format
aibomstd convert cisco-output.json

# Check version
aibomstd version
```

---

## SDK — generate BOMs in Python

```python
from aibomstd import AiBomBuilder
from aibomstd.components import ModelComponent, ApiClientComponent

bom = (
    AiBomBuilder(product="my-ai-product", version="1.0.0")
    .add_component(ModelComponent(
        name="llama-3-8b-instruct",
        version="3.0",
        provider="meta",
        data_leaves_boundary=False,
        data_residency="IN"
    ))
    .add_component(ApiClientComponent(
        name="gpt-4o",
        version="2024-05-13",
        provider="openai",
        data_leaves_boundary=True,
        data_residency="US"
    ))
)

print(bom.to_json())       # aibomstd JSON
bom.to_html()              # self-contained HTML report
bom.to_cyclonedx()         # CycloneDX v1.7 JSON
```

---

## Output formats

```python
bom.to_json()        # aibomstd JSON (default)
bom.to_html()        # self-contained HTML report
bom.to_cyclonedx()   # CycloneDX v1.7 JSON
```

---

## Convert from cisco-aibom

```python
from aibomstd.converters.cisco import CiscoConverter
import json

cisco_output = json.load(open("cisco-scan-result.json"))
converter = CiscoConverter()
aibomstd_json = converter.convert(cisco_output)
print(json.dumps(aibomstd_json, indent=2))
```

---

## Schema

Every output document references the canonical schema:

```
https://aibomstd.com/schema/v0.1/aibomstd.schema.json
```

Validate any BOM:

```bash
npx ajv validate \
  -s https://aibomstd.com/schema/v0.1/aibomstd.schema.json \
  -d my-repo.aibom.json \
  --spec=draft2020
```

---

## License

Apache 2.0 — [https://aibomstd.com](https://aibomstd.com)
