What is an AIBOM?
An AI bill of materials: the ingredient list for an AI system, from the model to the tools it can call.
Joshua Marpet and Cairn Viktor
An AI agent can change without a code release
An agent is AI software that plans and takes actions with tools, not just answers questions.
Swap in a new model version, or let a hosted provider update a snapshot, and behavior changes.
Edit one line of the system prompt, the standing instructions, and behavior changes.
Connect one more tool server, and the agent can now reach new data and take new actions.
If nobody wrote down what it was made of, nobody can tell you what changed.
Same idea, new ingredients
| Ingredient | Why it belongs on the list |
|---|---|
| Model | The trained weights doing the reasoning: which one, which version, from whom |
| Datasets | What the model was trained or tuned on, and what it retrieves from |
| Prompts | Standing instructions that steer every answer |
| Tools and MCP servers | What the agent can reach and do: files, tickets, email, code |
| Harness and memory | The framework that runs the loop, and what it remembers between sessions |
CycloneDX already speaks AI
CycloneDX is the bill of materials standard developed under the OWASP Foundation. Same file format as an SBOM, more component types.
CycloneDX 1.5 added machine learning transparency, which it calls ML-BOM.
CycloneDX 1.6 extended it, including its support for AI and ML model cards.
Component types include machine-learning-model and data, and a component can carry a modelCard.
Why a model card is not enough
A model card is a datasheet for the engine. An AIBOM is the parts list for the whole car.
A short document that comes with a trained model: evaluation results, intended use, and other details.
Proposed by Mitchell and colleagues in 2019.
It describes one ingredient, the model.
Your deployed system also has your prompts, your tools, your memory and your data. None of those are on the model card.
VCRI’s AIBOM Constellation Inventory
- Lists everything an AI agent depends on (model, harness, MCP servers, plugins, tools, prompts, memory, datasets, runtime, credential references) with versions and content hashes.
- Writes the list as a CycloneDX 1.6 AIBOM.
- One Python file, standard library only. No network access, runs no other programs.
- Never writes secret values. Credentials are recorded as a name and a scope.
- Inventory only: it does not score or rate anything. Open source under Apache-2.0.
Real output, one hosted model and one prompt
The tool hashed the bytes on disk, like this prompt file.
Someone typed it in and nothing was checked. A hosted model is always stated: its weights are not on your disk.
You can see which entries are evidence and which are claims.
Four commands
Run diff on a schedule and you have a drift alarm for your agent.
Write a starter manifest. Edit it to list your agent’s parts.
Turn the manifest into a CycloneDX AIBOM. Add --discover to read known MCP client config files.
List gaps: missing versions, suppliers or hashes.
Compare against the last approved AIBOM. Exits with code 1 if anything was added, removed, re-versioned or re-hashed.
Write down one agent
- Pick one AI assistant or agent your team runs. Name the person accountable for it.
- List its parts: model and version, prompts, tools and MCP servers, memory, data sources.
- Run python3 constellation.py init, fill it in, then build and check.
- Ask your AI vendors: which model and version does your product use, and will you tell us when it changes?
- Save the AIBOM. Next month, run diff and see what moved.
Free to use, teach and share.
This deck is part of the VCRI Learn series. Use it in your class, your team meeting or your chapter, with credit to The Value Chain Risk Institute.
valuechainrisk.org/learn